Skip to content

v0.44.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jun 13:13
v0.44.0
a673e00
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A quality-and-hardening release of Terrapod — an open-source platform replacement for Terraform Enterprise — implementing the full backlog from a whole-project review across UX/accessibility, test + SDK coverage, security defense-in-depth, and documentation.

Highlights

  • Per-connection GitHub webhook secret — each VCS connection can carry its own webhook HMAC secret so one installation's secret can't forge another's webhooks; falls back to the global secret when unset. Wired end-to-end across the API, go-terrapod SDK, the Terraform provider, and the web UI.
  • Dedicated token signing key — runner tokens and run-task/download-ticket callback tokens can sign with a dedicated api.tokenSigningKey secret instead of one derived from the database URL, decoupling token-forgery resistance from database credentials. Backward-compatible: leaving it unset invalidates no in-flight token.
  • Accessible modals + live SSE status — a focus-trapping, Escape-dismissable Modal primitive on the catalog destructive flows, and a live connection indicator on the workspace list, workspace detail, and run pages so a dropped event stream is visible.
  • Broader SDK coverage — go-terrapod gains typed methods for individual-policy CRUD, the workspace bulk search/update surface, and the labels browser.

Security

  • Sensitive→non-sensitive variable downgrades now clear the value so a previously-hidden secret can't be exposed by toggling a flag.
  • State-divergence checks use a collision-resistant SHA-256 (the TFE-contract md5 is retained; legacy rows fall back to md5).
  • The unread CA private-key disk cache is removed and the CA key column renamed to reflect that at-rest protection comes from database encryption.

Bug Fixes

  • Registry module-version creation returns a clean 409 on a duplicate instead of a 500 + dangling pending row.
  • De-flaked the audit-log method-filter E2E and added a deterministic SSE-through-proxy live-update test.
  • A new workspace now appears on an open workspace list over SSE without a manual reload.

Upgrade Notes

Three additive/rename database migrations run automatically on upgrade (state_versions.sha256, certificate_authority.ca_key_pem, vcs_connections.webhook_secret). No configuration changes are required; the new api.tokenSigningKey and per-connection webhook secret are opt-in.

Status

Beta — production-capable; single-maintainer project, API-compatible with the terraform/tofu cloud-block workflow.

Full Changelog: v0.43.0...v0.44.0

Assets 32
Loading