tfreg

Documentation

Overview

Package tfreg asks the Terraform and OpenTofu registries what they know about the providers a .terraform.lock.hcl diff touches. Neither OSV.dev nor deps.dev has any Terraform system, so for infrastructure lockfiles this package IS the metadata layer, not a fallback:

• Release ages and the ⏱ cooldown flag, from each provider version's published timestamp.
• Archived / delisted providers land in the deprecation lane: registry.terraform.io carries an explicit warning for deprecated providers, an `unlisted` flag for delisted ones, and HashiCorp's archived providers say so in their description (kept verbatim, replacement suggestion included — "Please use the templatefile function or the Cloudinit provider instead"). Providers blocked by the OpenTofu registry are reported with the block reason.
• Unlisted detection: an incoming provider version missing from the registry's own version list — while the provider's other versions ARE listed — is what a pulled release looks like. Providers the registry does not know at all are never flagged.
• The upstream source repository, which the changelog layers turn into verified tag-to-tag compare links and release notes (provider repos tag vX.Y.Z, and the registry requires them to live in public VCS).

Routing follows the lockfile itself: providers pinned from the default registry.terraform.io host are asked about on registry.terraform.io (one GET per provider, the same v2 API the registry website uses); providers pinned as registry.opentofu.org/… are asked about on api.opentofu.org (one GET per provider). Custom or private registry hosts are left alone entirely.

registry.terraform.io sends no CORS headers, so the browser (wasm) build cannot query it. There, default-host providers fall back to api.opentofu.org — which mirrors the same provider namespace and is CORS-open — for release ages and source links ONLY: the mirror can lag the primary registry, so the fallback never flags unlisted versions and never reports deprecations. The native build never uses the fallback.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Variables

var Now = time.Now

Now is a var so tests can pin the clock.

var OpenTofuBaseURL = "https://api.opentofu.org"

OpenTofuBaseURL is the OpenTofu registry-metadata API base; a var so tests can fake it.

var TerraformBaseURL = "https://registry.terraform.io"

TerraformBaseURL is the Terraform registry API base; a var so tests can point it at an httptest server.

var UseTerraformRegistry = true

UseTerraformRegistry gates direct calls to registry.terraform.io. The browser (wasm) build sets it to false — the endpoint sends no CORS headers — which reroutes default-host providers to the CORS-open OpenTofu mirror in ages-and-links-only mode.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills Terraform/OpenTofu registry metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one provider was actually vetted against a registry (deps.dev never covers Terraform, so callers use it to decide whether release metadata was checked at all). freshDays mirrors -fresh-days. Best-effort: per-provider failures skip that provider; only total failure returns an error.