mattrobinsonsre/terrapod v1.4.0

on GitHub

Terrapod is a free, open-source platform replacement for Terraform Enterprise. This release adds conditional auto-apply, a recovery path for deleted workspaces, and concurrency for the AI analysis queue.

Highlights

• Conditional auto-apply — auto-apply is no longer all-or-nothing. A workspace can be set to create (auto-apply runs that only create) or create_update (create and update, but hold anything that destroys), alongside never and always. The guardrail is enforced server-side, so it holds however the run was queued. The auto-apply boolean stays as a projection, so nothing that reads it needs to change.
• Deleted workspaces can be recovered — deleting a workspace now writes a delete marker recording what it was, and its state stays recoverable for a retention window. POST /deleted-workspaces/{id}/restore brings it back as a new workspace with its lineage and serials intact, so the next plan continues the original state rather than treating live infrastructure as unmanaged. It comes back inert — auto-apply, drift detection and auto-merge off, VCS not re-attached — and the response says what to switch back on. There is an undelete UI and MCP tools for it. An orphaned-state reaper cleans up what is genuinely past its window, and refuses to run when the orphan set looks implausible.
• Concurrent lanes for triggered tasks — the scheduler's triggered-task consumer now runs bounded per-lane pools rather than one at a time, so a burst of AI analysis no longer serialises behind itself, and queue depth is observable.
• Signing keys are administered, not merely authenticated — registering a provider signing key now requires registry:admin. See Behaviour changes below.
• Scheduled review of the accepted-risk register — the vulnerability suppressions carried in-repo are now re-examined on a schedule rather than only at release time, so an entry that could have been fixed does not quietly persist.

Behaviour changes

• Registering, revoking or deleting a provider GPG signing key now requires registry:admin. Previously any authenticated account could add one. A signing key is a trust anchor — every provider version signed by it becomes installable by every runner on the instance — so this was a hole worth closing. Reads are unchanged and remain open, because they return public key material that terraform init already receives.

  If you publish with a service token, that step now needs a token whose role grants registry admin, or it fails with 403 Requires registry:admin capability on the GPG key store — including on the next terraform apply of an existing terrapod_gpg_key resource. Grant it with registry_permission = "admin" and no allow_names or allow_labels; a role scoped to part of the registry deliberately cannot register a key. Platform admins are unaffected, and the rest of publishing still needs only registry:write. See Registry publishing.

No API route, response attribute, wire-protocol field, config key or Helm value was removed or renamed. Every contract snapshot in this release is additive, so an un-upgraded runner, listener, SDK or provider keeps working.

Bug Fixes

• A run created by a run trigger could not be applied on a VCS-connected workspace, failing with "Apply is not supported for CLI-uploaded code". The guard was keyed on the run's source when what it protects is a property of the code — it now asks where the configuration version came from, so trigger-, catalog- and lifecycle-created runs against VCS-managed code apply normally while genuinely API-uploaded code is still refused.
• The delete marker recorded 19 workspace settings and silently dropped 12, including the whole security-scan config and the conditional auto-apply mode — losing a guardrail rather than a preference on a delete/restore cycle.
• Log follow did not engage when a confirmed run started applying, and could not be disengaged by scrolling up.
• Four conditional auto-apply blockers, including a bulk-update path where the string "false" enabled auto-apply.
• Restore and the orphan reaper hardened: a bounded state-version cap, a repeat-restore guard, name sanitisation, and a refusal to reap when the orphan set is implausibly large.

Security

• Provider signing-key management is gated on registry:admin (above).
• js-yaml and nanoid bumped past published advisories.
• The API version-compatibility gate is now enabled, with --allow-api-version-mismatch as the explicit escape hatch.

Status

Stable — 1.x, under the SemVer compatibility contract enforced in CI across every public surface.

Full Changelog: v1.3.3...v1.4.0