Terrapod is a free, open-source platform replacement for Terraform Enterprise. This release hardens the run lifecycle with stale-plan safety guards and closes two terraform/tofu CLI compatibility gaps.
Highlights
- Stale-plan guards — a saved plan is automatically discarded once it can no longer apply safely, so a stale plan can never apply outdated config. Always-on state-drift detection (the workspace state advanced since the plan was computed) plus an opt-in per-workspace
plan-expiry-secondsTTL. Discarded runs carry adiscard-reason, and confirming a stale plan returns 409. Enable time-based expiry per workspace; state-drift is on by default. - CLI
planon VCS-connected workspaces —terraform/tofu planspeculative plans now work on VCS-connected workspaces (previously rejected with 422) by honoring the speculative configuration version. Apply from the CLI remains VCS-gated. terraform force-unlock— thePOST /api/v2/workspaces/{id}/actions/force-unlockendpoint is now implemented, so a state lock stranded by an interrupted CLI operation is recoverable directly from the CLI.
Bug Fixes
- The listener status-report path no longer auto-applies a plan against state that moved since it was computed — it now routes through the guarded completion path.
- A malformed configuration-version id returns 422 instead of a 500.
- The state-version stale-plan cleanup is best-effort — a cleanup failure can never roll back a legitimate state-version write.
Security
- GitHub Actions workflows pinned to commit SHAs;
curl | shinstallers hardened. golang.org/x/netbumped to 0.55.0 (GHSA-5cv4-jp36-h3mw). All code-scanning and Dependabot alerts are at zero.
Status
Alpha — actively developed; the CLI-facing V2 API surface is stable for terraform / tofu / tfci.
Full Changelog: v0.51.0...v0.52.0