jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(deps): OpenTofu 1.12.6 to 1.12.7 in the provisioner and runner roles #104

Merged
jfraeys merged 1 commit from jfraeys/chore/deps-opentofu-1.12.7 into main 2026-10-13 14:31:30 -04:00
Conversation 0 Commits 1 Files changed 2 +6 -6
jfraeys commented 2026-10-13 12:30:50 -04:00
Owner
Copy link

OpenTofu 1.12.7 (2026-10-01) addresses upstream Go security advisories (CVE-2026-78662, CVE-2026-56855). Same minor line, so no behaviour change expected. SHA-256 values are from the release's own tofu_1.12.7_SHA256SUMS (linux amd64 6807f7ae..., arm64 a63fc6bf...), so get_url verifies the download; check-downloads hygiene passes.

Validation gap, stated plainly: roles/ci_ephemeral_provisioner is skipped in staging (docs/staging-parity.md), so the staging run does not install this binary on the services host. The runner's copy (forgejo_runner_native) is exercised by the next CI run that cold-starts a runner VM. After this merges and the provisioner role is deployed (scripts/deploy-services.sh --tags ci_ephemeral_provisioner --limit services, when nothing is queued), watch the next cold start: tofu apply creating the runner VM is the test.

Decision for you, not made here: your laptop runs OpenTofu 1.13.1, and the role's comment says the provisioner's version should track the laptop because S3 state locking differs between versions. Today they already differ (1.12.6 vs 1.13.1). This PR takes the security patch on the current line; moving the CI roles and the pin to 1.13.1 is a minor-version change that I would validate on a throwaway workspace first.

🤖 Generated with Claude Code

OpenTofu 1.12.7 (2026-10-01) addresses upstream Go security advisories (CVE-2026-78662, CVE-2026-56855). Same minor line, so no behaviour change expected. SHA-256 values are from the release's own tofu_1.12.7_SHA256SUMS (linux amd64 6807f7ae..., arm64 a63fc6bf...), so get_url verifies the download; check-downloads hygiene passes. Validation gap, stated plainly: roles/ci_ephemeral_provisioner is skipped in staging (docs/staging-parity.md), so the staging run does not install this binary on the services host. The runner's copy (forgejo_runner_native) is exercised by the next CI run that cold-starts a runner VM. After this merges and the provisioner role is deployed (`scripts/deploy-services.sh --tags ci_ephemeral_provisioner --limit services`, when nothing is queued), watch the next cold start: tofu apply creating the runner VM is the test. Decision for you, not made here: your laptop runs OpenTofu 1.13.1, and the role's comment says the provisioner's version should track the laptop because S3 state locking differs between versions. Today they already differ (1.12.6 vs 1.13.1). This PR takes the security patch on the current line; moving the CI roles and the pin to 1.13.1 is a minor-version change that I would validate on a throwaway workspace first. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
chore(deps): OpenTofu 1.12.6 to 1.12.7 (Go security advisories) in the provisioner and runner roles
All checks were successful
Lint / lint (pull_request) Successful in 1m24s
Details
Secret scan / scan (pull_request) Successful in 13s
Details
4cb680e5f3
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!104
No description provided.