Clarify what all sources are supported for Terraform Dependency Updates

[captn3m0]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

What part(s) of the article would you like to see updated?

Background Information

Unlike other package managers, Terraform is a multi-sourcetype package managers with private registry support (that only applies to a few of these source types).

The following are various sample combinations of what all counts as a "module source" in Terraform:

No	Source	Sample Source	Is this a Terraform Registry	Private Access Supported	Update Possible
1	Local Path	../consul	NA	No
2	Terraform Registry	hashicorp/consul/aws	Yes, https://registry.terraform.io/	No	Yes
3	Terraform Private Registry	app.terraform.io/example-corp/k8s-cluster/azurerm	Yes	Yes	Yes
4	GitHub	github.com/hashicorp/example	No	Yes	Yes
5	GitHub (SSH)	git@github.com:hashicorp/example.git	No	Yes	Yes
6	BitBucket	bitbucket.org/hashicorp/terraform-consul-aws	No	Yes	Yes
7	Generic Git	git::https://example.com/vpc.git (Other Valid Git URLs also work)	No	Yes	Yes
8	Generic Mercurial	hg::http://example.com/vpc.hg	No	Yes	Yes
9	HTTP URls	https://example.com/terraform-source	No	Yes	No
10	S3 Bucket URL	s3::https://s3-eu-west-1.amazonaws.com/examplecorp-terraform-modules/vpc.zip	No	Yes	No
11	GCS Bucket URL	gcs::https://www.googleapis.com/storage/v1/modules/foomodule.zip	No	Yes	No

Current Documentation Status

The following is all of the text* that is present on the docs website about Dependabot Terraform setups:

The table tells us that Terraform integration supports both Private Repositories and Private registries (and not vendoring):

The second page tells us about terraform registry configuration.

The terraform-registry type supports a token.

registries:
 terraform-example:
 type: terraform-registry
 url: https://terraform.example.com
 token: ${{secrets.MY_TERRAFORM_API_TOKEN}}

Unanswered Questions

There are 7 different kinds of sources in the above table that support updates. Of these, 2 are well documented (Terraform Registry / Terraform Private Registry) with clear documentation on how it supports Private registries as well.

The other 5 are left very unclear, across each of their public/private variant (so 10 possibilities).

The core change in #30139:

You can give Dependabot access to private package registries hosted by GitLab or Bitbucket by specifying a type of git.

does not clarify if this works with Terraform. It is unclear if Mercurial repositories are updated.

Suggested Change

Similar to how swift in the table links to a clear indication of what is supported, a similar section should be added for Terraform. Something like:

Only modules hosted on Terraform Registry or a publicly reachable Git repository are supported. Private Terraform Registry is supported, and you can configure access for private git repositories by configuring a git registry.

Additional information

This is a re-opening of #8419. The relevant PR #30139 does not answer the important questions.

[nguyenalex836]

@captn3m0 Thank you for your suggestions to improve GitHub Docs! I will get this triaged for review ✨

[CBID2]

@captn3m0 Thank you for your suggestions to improve GitHub Docs! I will get this triaged for review ✨

Hi @nguyenalex836. This issue was raised in #8419 and solved with pull request #30139

[nguyenalex836]

Thank you for the heads up, @CBID2! ✨

@captn3m0 Would you be able to clarify how you think the pull request #30139 doesn't answer the important questions you are referring to?

[captn3m0]

I've mentioned that above:

The core change in #30139 :

You can give Dependabot access to private package registries hosted by GitLab or Bitbucket by specifying a type of git.

does not clarify if this works with Terraform. It is unclear if Mercurial repositories (hosted on bitbucket or elsewhere) are updated.

For discovery, this isn't listed under the terraform section, does not show up anywhere Terraform appears. It shows up under the "Private Registry" section, which is something I wouldn't look up if my source happens to be a public mercurial/git repository. The change is about "access" to the source itself - dependabot being able to access my source does not guarantee that dependabot will be able to correctly update it as well.

Further, the "supported sources" is still not clearly documented. You can piece together enough information after reading across 3 different pages that Git and Terraform registries are supported, but it does not tell a reader whether S3/GCS buckets or other sources might be supported. As a terraform user who might rely on a S3 source, I don't know if dependabot will update it.

[nguyenalex836]

@captn3m0 Thank you for the thorough reply! Our writers will review your response ✨

[mchammer01]

@captn3m0 👋 - thanks for the comprehensive context and explanation. Let me see what we can do to improve these docs ✨

[mchammer01]

I agree that the docs are lacking information wrt Terraform support, and will create an internal issue for us to tackle this.

[mchammer01]

Closing this in favor of the internal issue I've just created. I think this is probably a bit too complex for an external contributor to work on, especially if they are not familiar with Dependabot and Terraform.