Description

The Terraform crawler looks recursively for every .terraform.lock.hcl file from a root directory, and updates each provider pinned in it.

Providers are read from the lock file rather than from required_providers blocks, so a module with no lock file yields nothing. Run terraform init first if that is the case.

This crawler is enabled by default, so it can be used either automatically by running updatecli diff from a directory containing the files to update, or by providing a manifest. The automatic discovery behavior can be tuned by providing a YAML manifest with a terraform crawler in top-level directive autodiscovery as explained in the "Autodiscovery" page.

Generated manifests

Automation is done by using two resources: terraform/registry as the source and terraform/lock as the target.

The version filter is narrowed per provider from the version currently locked, so a provider on 5.30.0 is filtered with >=5.30.0.

Platforms

A Terraform lock file records a checksum per target platform, and the target has to refresh all of them or terraform init will fail on the platforms left behind.

Use platforms to declare which ones to request. When unset, Updatecli falls back to linux_amd64, linux_arm64, darwin_amd64, and darwin_arm64.

Important
The checksums written back cover exactly the platforms requested. If your lock file needs a platform outside the fallback list, such as windows_amd64, list every platform you require explicitly.

Manifest

Parameters

NameTypeDescriptionRequired
ignorearray

“ignore” defines rules to exclude matching Terraform providers from the autodiscovery.

remark:

  • a Terraform provider is ignored when it matches at least one rule.
    pathstring

“path” defines a “.terraform.lock.hcl” path pattern.

remark:

  • the pattern must match the whole path, not just a substring.
  • the pattern follows the Go filepath.Match syntax, such as “*” or “?”.
    providersobject

“providers” defines the Terraform providers to match, keyed by provider address as written in “.terraform.lock.hcl”.

remark:

  • an empty value matches any version.
  • otherwise the value is a semantic version constraint, such as “>=1.0.0”.
  • when the version or the constraint cannot be parsed, the value must equal the version.

example:

providers:
  # ignore every version of this provider
  registry.terraform.io/hashicorp/aws:
  # ignore the versions matching this constraint
  registry.terraform.io/hashicorp/kubernetes: "1.x"
onlyarray

“only” defines rules to restrict the autodiscovery to matching Terraform providers.

remark:

  • a Terraform provider is kept only when it matches at least one rule.
    pathstring

“path” defines a “.terraform.lock.hcl” path pattern.

remark:

  • the pattern must match the whole path, not just a substring.
  • the pattern follows the Go filepath.Match syntax, such as “*” or “?”.
    providersobject

“providers” defines the Terraform providers to match, keyed by provider address as written in “.terraform.lock.hcl”.

remark:

  • an empty value matches any version.
  • otherwise the value is a semantic version constraint, such as “>=1.0.0”.
  • when the version or the constraint cannot be parsed, the value must equal the version.

example:

providers:
  # ignore every version of this provider
  registry.terraform.io/hashicorp/aws:
  # ignore the versions matching this constraint
  registry.terraform.io/hashicorp/kubernetes: "1.x"
platformsarray

“platforms” defines the target platforms to request provider checksums for.

default:

- linux_amd64
- linux_arm64
- darwin_amd64
- darwin_arm64
rootdirstring

“rootdir” defines the directory where the crawler starts searching for “.terraform.lock.hcl” files.

default: the scm directory when “scmid” is set, otherwise the directory relative paths resolve from, by default the working directory.

remark:

  • a relative path is resolved from the default directory.
  • an absolute path is used as is, instead of the scm directory.
versionfilterobject

“versionfilter” defines the version filter used by the generated manifests.

default: kind “semver” with pattern “*”, any version greater than or equal to the current one.

remark:

  • with kind “semver”, “pattern” accepts:
    • “prerelease”: the latest prerelease of the current version.
    • “patch”: patch updates only.
    • “minor”: patch and minor updates.
    • “minoronly”: minor updates only.
    • “major”: patch, minor and major updates.
    • “majoronly”: major updates only.
    • a version constraint, such as “>= 1.0.0”.
  • with kind “regex”, “pattern” accepts a regular expression.
  • more examples at https://www.updatecli.io/docs/core/versionfilter/

example:

versionfilter:
  kind: semver
  pattern: minor
    kindstring

“kind” defines the versioning scheme used to select a version.

default: latest

remark:

  • accepted values are “latest”, “semver”, “regex”, “regex/semver”, “time”, “regex/time”, “lex” and “pep440”.
  • “latest” returns the last version of the list.
  • “lex” sorts the versions lexicographically and returns the last one.
  • “pep440” follows https://peps.python.org/pep-0440/

example:

  • kind: semver
    patternstring

“pattern” defines the version pattern, according to “kind”.

default:

  • latest: “latest”
  • semver and pep440: “*”
  • regex: “.*”
  • time and regex/time: “2006-01-02”

remark:

  • for “latest”, “latest” returns the last version, any other value must match a version exactly.
  • for “semver” and “regex/semver”, it is a semantic versioning constraint.
  • for “pep440”, it is a pep440 version specifier.
  • for “regex”, it is a regular expression.
  • for “time” and “regex/time”, it is a Go date layout.
  • ignored by “lex”.

example:

  • pattern: ~1.2
  • pattern: “>=1.0.0 <2.0.0”
  • pattern: ^v\d+.\d+.\d+$
    regexstring

“regex” defines the regular expression extracting the version from each entry.

remark:

  • only used by the kinds “regex/semver” and “regex/time”.
  • the value of the first capture group is used as the version.

example:

  • regex: ^v(\d+.\d+.\d+)$
    replaceallobject

“replaceall” applies a regular expression replacement to each version before filtering.

remark:

  • only used by the kinds “regex”, “regex/semver” and “regex/time”.
  • the replacement runs before “pattern” or “regex” is evaluated.

example:

replaceall:
  pattern: "_"
  replacement: "."

turns “curl-8_15_0” into “curl-8.15.0”.

        patternstring

“pattern” defines the regular expression matching the text to replace.

example:

  • pattern: “_”
        replacementstring

“replacement” defines the text replacing each match of “pattern”.

remark:

  • capture groups can be referenced with $1, $2, and so on.

example:

  • replacement: “.”
    strictboolean

“strict” enforces strict semantic versioning rules when parsing versions.

default: false

remark:

  • only used by the kinds “semver” and “regex/semver”.
⚠ This table is generated from the Updatecli codebase and may contain inaccurate data. Feel free to report them on github.com/updatecli/updatecli

Example

# updatecli.d/default.yaml
name: "Terraform autodiscovery using git scm"
scms:
  default:
    kind: git
    spec:
      url: https://github.com/updatecli-test/jenkins-infra-aws.git
      branch: main

autodiscovery:
  # scmid is applied to all crawlers
  scmid: default
  crawlers:
    terraform:
      # platforms to request package checksums for, defaults to:
      platforms:
        - linux_amd64
        - linux_arm64
        - darwin_amd64
        - darwin_arm64
      # To ignore specific path
      #ignore:
      #  - path: <filepath relative to scm repository>
      #  - providers:
      #      # Ignoring provider updates for this provider
      #      registry.terraform.io/hashicorp/aws:
      #      # Ignore provider updates for this version
      #      registry.terraform.io/hashicorp/kubernetes: "1.x"

      ignore:
      #  - path: <filepath relative to scm repository>
      #  - providers:
      #      # Ignoring provider updates for this provider
      #      registry.terraform.io/hashicorp/aws:
      #      # Ignore provider updates for this version
      #      registry.terraform.io/hashicorp/kubernetes: "1.x"