mattrobinsonsre/terrapod v1.7.5

on GitHub

A fix release for the 1.7 line of Terrapod, an open-source platform replacement for Terraform Enterprise.

Read this before upgrading if you use run tasks

Run tasks configured at the pre_plan or pre_apply stage now actually fire. Both stage names have always been accepted by the API, the provider and the UI, but nothing ever evaluated them — a task configured at either boundary was stored, listed back, and silently never called (#1837).

If you have such a task configured and had concluded it did nothing, it will start gating runs when you upgrade. A mandatory task whose endpoint has since rotted will error queued runs (pre_plan) or refuse to confirm (pre_apply). Check for configured tasks at these two stages before upgrading:

GET /api/terrapod/v1/workspaces/{id}/run-tasks

Nothing changes for post_plan, which is where run tasks have always worked.

Highlights

• Run tasks fire at pre_plan and pre_apply — a pre_plan task holds the run queued before it is handed to a runner; a pre_apply task holds it planned, after confirm and before the apply starts. Each has its own re-drive, so a held run resumes by itself when the external service reports back. Only post_plan failures can be overridden: a pre_apply verdict is a go/no-go taken before any infrastructure moves, at the point the platform already stops for a human, and once an apply has started there is nothing an override could release. Put a task at post_plan if you want one somebody can wave through. See run-tasks.md
• A run task that never calls back no longer holds a run forever — a webhook that returned 2xx and then went silent wedged its run indefinitely, and enforcement level made no difference: an advisory task that never answered blocked exactly as hard as a mandatory one, because the stage never resolved. Results are now aged out at the callback token's own lifetime, past which the external service could not report back even if it tried
• A held run no longer reports itself as unblocked — a run held at pre_apply sits in planned, so its PR check reported success and the pull request looked mergeable while the run was in fact held and would never apply

Bug Fixes

• A token created at POST /users/{user_id}/authentication-tokens is bound to the user named in the path, not to the caller (#1838). The matching list endpoint had the same defect and now returns the named user's tokens
• terraform login / tofu login completes in Safari, and the fallback is no longer a long wait (#1823)
• redirect_uri is validated before an authorization code is delivered to it (#1829)
• terrapod plan is no longer a permanent no-op after a plan errored, and a run held at a gate says so on the pull request instead of showing a turning gear (#1831)
• Terrapod answers commands rather than conversations — a comment that merely begins with the word no longer draws an unsolicited usage table (#1836)
• Five pull-request feedback bugs reported by Event Horizon (#1802)

Security

• An authorization code is refused delivery to an unvalidated redirect_uri (#1829)
• Token creation and listing can no longer silently act on the caller instead of the named subject (#1838)

Status

Stable. Supported lines are 1.7 (current) and 1.6 (security fixes only).

Full Changelog: v1.7.4...v1.7.5