0.4.7

A wave refused because its plans moved after the approval names the terragucci approve command for the new plans, not chant approve (#846). Upgrade with npx @intentius/terragucci@0.4.7 init in each repo.

0.4.6

Approvals are one command, terragucci approve, and installing terragucci is enough.

Upgrade notes

• Run npx @intentius/terragucci@0.4.6 init in each repo and merge the pipeline it writes.
• Approvers run terragucci approve where they ran chant approve. @intentius/chant comes with terragucci, so the separate install can go.

Highlights

• terragucci approve answers every gate a person approves: waves, state migrations, state exports (approve export <root>), lock releases (approve unlock <root>) and pull request environments (approve ephemeral <pr>), each bound to the plan digest with --plan. Every printed hint is a terragucci command (#836).
• The choudoufu image runs choudoufu 0.25.0. Resource history lists each choudoufu record's past versions, and the estate page shows the count (#825, #837).
• Docs: a picker for repo shape, binary, forge and the tool you're leaving; a page for each setup and role; how-tos for policy, the audit trail, locks, secrets and choudoufu waves; a state backends reference; coverage grids by tool and forge (#838, #839, #840, #835).

0.4.5

SQL over the estate, choudoufu resume and live progress, more backends, and importers for five platforms.

Upgrade notes

• Terragrunt repos that use generate: run terragucci generate again, so each unit's state key reads the ephemeral suffix (#733).
• terragrunt.dependents now defaults to plan; set follow to keep the old behavior.
• With stock binaries, two overlapping pushes can fail the newer apply with "Saved plan is stale"; re-running it plans again (#752).

Highlights

• terragucci query runs SQL over inventory, changes, history, audit and edges, in process (#801).
• choudoufu: a killed or failed wave resumes under the same approval and applies only what its records lack (#816); a running wave shows each resource done, in flight or waiting (#813); estates move and adopt stock state through gated migrations (#807); drift and the estate views work on live roots (#804).
• Per-root applies for every binary, waves.after, a per-resource blast radius in the plan note (#752, #787, #806).
• Backends: GitLab-managed state (#808), gcs and azurerm versions, export, unlock and migrations with per-environment GCP and Azure identities (#812), migrations through pg, kubernetes, consul and http (#814, #820), and state read from HCP Terraform, Scalr, OTF and env zero workspaces or an exported file (#805).
• Importers: terragucci import hcp, otf, scalr, spacelift, env0, terragrunt-scale and terrateam (#817, #818, #815, #781).
• Atmos and Terramate as repo shapes, Terragrunt explicit stacks, runner and pass, a JSON Schema for terragucci.yml (#751, #750, #783, #802).

Fixes

• CDK Terrain pull request locks cover synthesized stacks (#819); Atmos pull request locks reach instances (#798); the format-fix push gets its lock answer (#542); config check refuses a terragucci.yml that is not a mapping (#803).

Changes in 0.4.5: https://intentius.io/terragucci/reference/whats-new/

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.4.5-*, pinned by digest in the package.

0.4.4

Plans across roots, state migrations, approvals from Slack, AI plan review, and two security fixes.

Security

• An old sensitive value no longer reaches plan.json, the report or the bucket: OpenTofu repeats some sensitive inputs unmarked, and those copies are now redacted (#689).
• The policy reads an AI review's verdict from the review job's own artifact for that head, never from a comment (#684).

Highlights

• A root that reads another's state plans on its planned outputs, unknowns named, and re-plans after its upstream applies; each apply writes a run page with the DAG (#647).
• State versions recorded per apply; migration files move resources between roots or to a new backend, approved by digest, with a gated revert (#613).
• Approve and Decline from Slack, an approving reply in Teams, through terragucci relay that you run (#655).
• AI review of a pull request's intent against its plan, on your own model (#654).
• steps, per-root version pins, cost thresholds that force approval, terragucci generate, terragucci import atlantis, DORA metrics, waves.jobs, unlock-state, a moved tip, and a dependency graph on the estate page.
• Terragrunt enforces attested modules per unit (#678); CDK Terrain stacks apply through gated waves (#681).

Changes in 0.4.4: https://intentius.io/terragucci/reference/whats-new/

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.4.4-*, pinned by digest in the package.

0.4.3

Approve from chat and the CLI, signed module releases, resource inventory and history on the estate page, and no forge token where a pull request's code runs.

• terragucci approve pushes an approval to chant/lifecycle with your token, and a scheduled resume job starts the wave (#585); --plan <digest> approves only that digest (#584).
• Under approval: pr-review, a waiting wave's chat message links the review (#578); notify posts a signed, versioned JSON event to your own webhook (#582); an approval's audit entry records who relayed it (#587).
• modules.attest: true signs each module release with cosign, with provenance and an SPDX SBOM (#579); modules.require: attested refuses roots that pin an unattested release (#580).
• A scheduled job continues every rollout in flight (#504).
• The estate page lists each root's resources and each resource's change history; JSON Schemas for the bucket's files.
• No forge token where a pull request's code runs: separate note jobs, a fmt job and credential-free checkouts (#328).
• A control repo's defaults reach each project (#437).
• Fixes: the check step runs when its shell cannot restart itself; rollouts read Forgejo's 404 on a new repo's pull requests as none open; on GitLab a policy denial under gate: never is recorded for an override.

What is new: https://intentius.io/terragucci/reference/whats-new/

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.4.3-*, pinned by digest in the package.

terragucci 0.4.2

One audit trail across your projects, CDK Terrain synth, chat notices, cost estimates, and fixes for large estates.

• terragucci audit writes every approval, apply, policy override and refused wave across your projects to one record in your bucket (#551).
• synth runs cdktn synth before the jobs read the roots; CDK Terrain is on cdktn 0.24.0, and a pull request plans only the stacks whose synthesized output changed (#575, #576).
• notify posts a waiting, refused or failed wave to Slack or Teams; cost puts a monthly estimate per root in the plan note.
• A wave applies at most parallelism roots at once, its roots share one provider cache, and plan and drift download each provider once per stage (#594). parallelism defaults to 4 (#596).
• An approval that already applied no longer refuses the next wave (#572); neither does a policy override that already applied (#589).
• reconcile carries the control repo's reports into each project (#597).
• The Terraform image is 1.14.9, so terraform query imports generate config. Rollouts read an empty Forgejo repo; an import that also updates a resource is named in the report; trust.json fails closed without "schema": 1.

What is new: https://intentius.io/terragucci/reference/whats-new/

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.4.2-*, pinned by digest in the package.

terragucci 0.4.1

choudoufu 0.23.0 in the choudoufu image, and two of its features now proven from terragucci.

• The terragucci-choudoufu image runs choudoufu 0.23.0, whose apply writes only the records that changed (#531).
• With binary: choudoufu, two applies that change different resources of one estate run at once with no estate-wide lock; two that change the same resource leave one winner and a write conflict naming it (claims cdf-concurrency and cdf-write-race, #532).
• A role scoped to one estate by its ownership tag applies that estate and is refused on another estate's resources (claim cdf-iam, proven on EC2, #532).

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.4.1-*, pinned by digest in the package.

terragucci 0.4.0

Approvals without signing by default, apply before merge on every forge and for Terragrunt, a page for the whole estate, reports in S3, GCS or Azure Blob, and policy that can be shared and overridden on the record.

Approvals

• One approval: key, read at the base commit: ledger (the default: an unsigned chant approve or terragucci approve counts), pr-review (the forge's review of the head approves the wave, GitHub, Forgejo and GitLab) or sealed (signed by a listed key). Every mode binds the wave's plan digest; a changed plan is refused (#431, #440, #443).
• terragucci approve [wave] finds the waiting wave and its digest; the plan note gives each wave's command (#444).
• The project token's own approval never counts (#478).

Pull requests

• Apply before merge on GitHub, Forgejo and GitLab (through the comments: schedule), and in Terragrunt repos (#446, #464, #468).
• apply.requires: [approved, mergeable, undiverged, checks], a real mergeable check, /terragucci lock and /terragucci unlock (#427).
• locks: plan locks a pull request's roots from its first plan on GitHub and Forgejo (#448).
• GitLab comment commands (/terragucci plan, apply, lock, unlock) from a scheduled poller in your own pipeline, with no server (#453).
• GitLab: init writes .gitlab/terragucci.yml and includes it from your own .gitlab-ci.yml (#436); opt-in gitlab: { token: protected } keeps the project token out of merge request pipelines (#478).

Terragrunt

• Waves follow the dependency layers, each with its own job, gate and approval (#394).

Policy

• policy.source reads Rego from a shared repository at a pinned ref (#425).
• A recorded policy override: a listed approver lets one denied plan through, bound to its digest and rules (#462).

Reports and the estate

• terragucci estate writes one page for every project to your bucket, with a presigned link (#429).
• Reports, the index and the estate page work on S3, GCS and Azure Blob Storage with the job's OIDC identity (#465, #466).
• An optional front door: a CloudFormation template for CloudFront with Origin Access Control and an OpenID Connect check in front of the private reports bucket (#430, #439).
• The plan job says when drift checks are overdue (#433).

The plan note

• Each group shows its diff with before and after values, each root's whole plan is in a collapsed section, the note is cut to the forge's comment limit and names what it cut, and it links report.html and each root's plan.txt in the bucket (#527).

CI

• terragucci's own CI runs on main and tags each passing commit ci/green/, and just release-preflight names the newest green commit to release (#473).

Fixes

• respond fmt names a binary it cannot run instead of failing with a TypeError (#470).
• A GitLab wave retried by the comments poll files its status under its own pipeline (#477).

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.4.0-*, pinned by digest in the package.

terragucci 0.3.1

Fixes for running terragucci's generated pipelines on hosted forges.

• git in every CI image accepts a checkout another user owns (#376, #378). On github.com, container jobs run as root over a checkout owned by the runner's user, and 0.3.0's images refused it: affected selection planned every root, gated waves failed instead of waiting, policy read at the base failed, and pull-request locks, comment apply and module publish failed. Upgrade from 0.3.0 if you run on GitHub.
• USER and HOME are set for any uid (#381, #382), so tools run as a uid with no passwd entry, including with an OTLP endpoint set.
• GitLab jobs push to the server's own protocol and port (#379, #383), so a self-managed GitLab over http or a non-443 port works.
• A waiting wave on GitLab ends its job with exit code 3 and fails terragucci/apply with the approve command, so the pipeline ends (#380, #386).

Images: ghcr.io/intentius/terragucci-{tofu,terraform,terragrunt,choudoufu}:0.3.1-*, pinned by digest in the package.

terragucci 0.3.0

On github.com, use 0.3.1. 0.3.0's CI images lack a git safe.directory setting, so on GitHub (container jobs run as root over a checkout owned by the runner's user) affected selection, gated waves, policy at the base, pull-request locks, comment apply and module publish fail (#376). 0.3.1 fixes it. Forgejo and GitLab runners that check out as the job's own user were not affected.