v0.4.0

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.4.0")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• Link to API reference by @benbirt in #46
• docs: settle the toolchain's scope; pin releases from signed checksums by @benbirt in #47
• chore: bump hashicorp/null from 3.2.4 to 3.3.2 in /examples/lock by @dependabot[bot] in #48
• chore: bump bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml from 1.5.1 to 1.6.0 in the github-actions group by @dependabot[bot] in #49
• feat: call tf_library targets from other repositories by module_source by @benbirt in #50
• feat: fetch registry, git and archive modules with tf_modules by @benbirt in #51
• feat: pin locks the providers of modules from other repositories by @benbirt in #54
• test: plan real registry and GitHub modules in CI by @benbirt in #55
• chore: apply bazel mod tidy, and check for it in CI by @benbirt in #56
• feat: support OpenTofu's .tofu and .tofu.json files by @benbirt in #65
• fix(modules): count only the root's own calls as using direct deps by @benbirt in #66
• docs: bring CONTRIBUTING.md invariants up to date with from_lock and tf_modules by @benbirt in #67
• ci: cache per Bazel version, save caches only from main by @benbirt in #68
• fix(lock): check lock entries' addresses with OpenTofu's registry-address by @benbirt in #69
• fix(modules): report module cycles at once, check matched directories, resolve backslash paths by @benbirt in #70
• test: fetch far fewer provider zips in CI by @benbirt in #71
• fix(fmt): format and check the files in srcs by name, not the package directory by @benbirt in #72
• test: share the outer Bazel's user root with the nested Bazels by @benbirt in #73
• test: run broken_workspace's cases against one nested Bazel by @benbirt in #74
• test: share the host Go caches with the nested Bazels by @benbirt in #77
• fix(pin): lock the submodules callers reach and libraries without module_source by @benbirt in #75
• fix(modules): survive symlinks in fetched modules, rename the generated targets by @benbirt in #78
• fix(dupcheck): pass var_files labels and paths as separate flags by @benbirt in #79
• feat: let Bazel keep fetched providers, tofu and modules across output bases by @benbirt in #80
• ci: key the repository cache on everything that decides what is downloaded by @benbirt in #81
• fix(modules): fail naming the provider label a called module needs by @benbirt in #82
• feat: run a module's OpenTofu tests as a Bazel test with tf_test by @benbirt in #83
• fix(host_tools): explain the Go SDK floor when the host tools fail to build by @benbirt in #111
• fix(test): key a run module by tofu's rule, dropping only .tftest.hcl by @benbirt in #106
• fix(providers): make a tag for a locked provider fail the fetch, not the extension by @benbirt in #109
• fix: remove the validate scratch copy; constrain tofu toolchains on the exec platform only by @benbirt in #108
• chore: bump the github-actions group with 2 updates by @dependabot[bot] in #112
• fix(test): take a tf_test's root module from the provider, not the label by @benbirt in #107
• fix(runner): run tofu in one run directory per deploy; make the launchers ordinary executables by @benbirt in #110
• fix: reject variables files tofu loads by itself in data by @benbirt in #116
• fix(runner): refuse a symlink to a directory; keep the executable bit in a test's copy by @benbirt in #115
• fix(pin): combine a directory's requirements by provider source by @benbirt in #113
• test: run the integration tests' nested Bazel on the version running them by @benbirt in #114
• fix(modules): match a call to the most specific module; let a module call its own address by @benbirt in #117
• docs: correct the pin check, vars types and registry module labels by @benbirt in #118
• fix(providers): agree on a prerelease version; name the fix when a platform or the lock's package is missing by @benbirt in #120
• test: stop the case runner losing cases; make the fmt fixture buildable; ignore every nested workspace by @benbirt in #121
• fix(modules): re-resolve a fact of the wrong kind; name git submodules; small source and fetch fixes by @benbirt in #122
• fix: build a library whose root module is empty; refuse a deploy of one by @benbirt in #124
• fix(pin): lock what a bundle library in another repository serves by @benbirt in #126
• fix!: make OpenTofu 1.12 the oldest supported release; drop the 1.8.5 pin by @benbirt in #127
• fix(providers)!: name from_lock's lock lock_file, and require it by @benbirt in #134
• docs: rewrite the README, the API docstrings and the example comments by @benbirt in #128
• docs: rewrite CONTRIBUTING.md, CLAUDE.md and the integration test README by @benbirt in #129
• docs: rewrite comments in test drivers, build files, CI and fixtures by @benbirt in #130
• docs: rewrite the comments in the Go tools by @benbirt in #132
• docs: correct and tidy the Starlark comments and private docstrings by @benbirt in #133
• fix: bring stale messages and flag descriptions in the Go tools up to date by @benbirt in #137
• fix: two more stale flag descriptions in the Go tools by @benbirt in #138

Full Changelog: v0.3.2...v0.4.0

v0.3.2

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.3.2")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• chore: add a Dependabot config by @benbirt in #41
• chore: bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0 in the go group by @dependabot[bot] in #42
• chore: bump bazel-contrib/setup-bazel from 0.19.0 to 0.19.1 in the github-actions group by @dependabot[bot] in #43
• docs: rewrite the README for Bazel users adopting rules_tofu by @benbirt in #44
• feat: publish API docs to the Bazel Central Registry by @benbirt in #45

New Contributors

• @dependabot[bot] made their first contribution in #42

Full Changelog: v0.3.1...v0.3.2

v0.3.1

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.3.1")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• fix: lock-only provider updates need no MODULE.bazel.lock change; first pin works by @benbirt in #40

Full Changelog: v0.3.0...v0.3.1

v0.3.0

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.3.0")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

Highlights

Providers from a lock file. tf_providers.from_lock() pins providers with a standard .terraform.lock.hcl, which Renovate and Dependabot can keep up to date, and bazel run @tf_providers//:pin writes it. This is now the documented default; see Providers in the README.

Breaking change

Every provider is now named through the @tf_providers hub, as @tf_providers//<namespace>/<name>. The per-provider repos (tf_providers_<namespace>_<name>) are private (#38).

Before:

# MODULE.bazel
use_repo(tf_providers, "tf_providers_hashicorp_aws")
# BUILD.bazel
providers = ["@tf_providers_hashicorp_aws//:provider"],

After:

# MODULE.bazel (`bazel mod tidy` makes this change)
use_repo(tf_providers, "tf_providers")
# BUILD.bazel
providers = ["@tf_providers//hashicorp/aws"],

tf_providers.provider tags themselves are unchanged.

What's Changed

• ci: fail on a stale MODULE.bazel.lock on the pinned Bazel by @benbirt in #36
• feat: vendor each provider's whole package, not just its binary by @benbirt in #37
• feat!: name every provider via the @tf_providers hub; make provider repos private by @benbirt in #38
• feat: take provider pins from .terraform.lock.hcl with from_lock by @benbirt in #39

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.2.0")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• feat: support Bazel 8.5+ and test on macOS by @benbirt in #32

Full Changelog: v0.1.2...v0.2.0

v0.1.2

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.1.2")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• fix: keep comments out of the module() block by @benbirt in #31

Full Changelog: v0.1.1...v0.1.2

v0.1.1

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.1.1")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• chore: bump publish-to-bcr to v1.5.1 by @benbirt in #30

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Using Bzlmod

Add to your MODULE.bazel:

bazel_dep(name = "rules_tofu", version = "0.1.0")

tofu = use_extension("@rules_tofu//toolchain:extensions.bzl", "tofu")
use_repo(tofu, "tofu_toolchains")

What's Changed

• Initial terrazel implementation: Bazel rules for OpenTofu/Terraform by @benbirt in #1
• Add destroy command support to terraform_deploy by @benbirt in #2
• Add interactive approval prompts for apply and destroy commands by @benbirt in #3
• Add var_files support to terraform_deploy for .tfvars.json inputs by @benbirt in #4
• Add CI workflow for building and testing with Bazel by @benbirt in #5
• Add support for arbitrary data files in Terraform rules by @benbirt in #6
• Pass extra CLI arguments to terraform/tofu commands by @benbirt in #7
• Create LICENSE by @benbirt in #8
• Implement tofu validate (Bazel test) and tofu fmt (run + check targets) by @benbirt in #9
• Add terraform_providers extension for hermetic provider vendoring by @benbirt in #10
• docs: drop .import and .console from known gaps by @benbirt in #11
• Move var_files duplicate-key detection to a bazel build action by @benbirt in #12
• Add Bazel-in-Bazel negative integration tests by @benbirt in #13
• rename project to rules_tofu and migrate terraform-prefixed rules and… by @benbirt in #14
• test: add integration test cases for remaining build-time negative fa… by @benbirt in #15
• Tfvars support by @benbirt in #16
• Claude/fixes and improvements by @benbirt in #17
• fix: silence OpenTofu init output to suppress unnecessary lockfile wa… by @benbirt in #18
• refactor: rename repository, upgrade Go and provider versions, and cl… by @benbirt in #19
• feat: BCR registration by @benbirt in #20
• fix: correct fmt_check, root-package deploys, and .tf.json backends by @benbirt in #21
• perf: materialize the provider plugin tree as a work-tree sibling by @benbirt in #22
• feat!: refuse apply/destroy against disposable local state by @benbirt in #23
• feat: make the root module arbitrate the OpenTofu version, and tidy both extensions by @benbirt in #24
• fix: ignore e2e/smoke's convenience symlinks in the root workspace by @benbirt in #26
• fix: list e2e/smoke's symlinks in .bazelignore instead of a REPO.bazel pattern by @benbirt in #27
• feat!: providers from the OpenTofu registry, with optional sha256 by @benbirt in #25
• chore: lowercase GitHub username in BCR metadata and docs by @benbirt in #28

New Contributors

• @benbirt made their first contribution in #1

Full Changelog: https://github.com/benbirt/rules_tofu/commits/v0.1.0