tfupdate-github-actions

GitHub Actions for tfupdate.

This action runs tfupdate to check for new versions of Terraform or providers, and automatically creates a Pull Request if updates are found.

Note

This repository is a fork from daisaru11/tfupdate-github-actions. See v1.0.0...HEAD for the differences.

Prerequisites

The workflow job requires the following permissions:

permissions:
  contents: write       # To push a new branch
  pull-requests: write  # To create a pull request

Inputs

Name	Required	Default	Description
github_token	No	github.token	GitHub Token
tfupdate_subcommand	Yes	—	Subcommand to execute (terraform or provider)
tfupdate_path	No	.	A path provided to tfupdate
tfupdate_options	No	-r	Options provided to tfupdate
tfupdate_provider_name	No	—	Provider name (required when subcommand is provider)
update_tfenv_version_files	No	false	Whether to update .terraform-version files (only for terraform subcommand)
update_tool_versions_files	No	false	Whether to update .tool-versions files (only for terraform subcommand)
pr_base_branch	No	Trigger branch	The base branch of a Pull Request
assignees	No	—	Comma-separated list of GitHub handles to assign to the PR

Subcommands

terraform

Fetches the latest Terraform version and updates version constraints in .tf files.

• update_tfenv_version_files: also updates .terraform-version files
• update_tool_versions_files: also updates the terraform entry in .tool-versions files

These version file updates target files in the same directory as changed .tf files and at the repository root.

- uses: masutaka/tfupdate-github-actions@v3.0.2
  with:
    tfupdate_subcommand: terraform
    tfupdate_path: './workspaces'
    assignees: 'alice'

provider

Fetches the latest version of the specified Terraform provider and updates version constraints. tfupdate_provider_name is required for this subcommand.

- uses: masutaka/tfupdate-github-actions@v3.0.2
  with:
    tfupdate_subcommand: provider
    tfupdate_path: './workspaces'
    tfupdate_provider_name: aws
    assignees: 'alice,bob'

Branch naming and PR deduplication

Branch naming

Branches are created with the following patterns:

• terraform: tfupdate/[path/]terraform-v{VERSION}
• provider: tfupdate/[path/]terraform-provider/{name}-v{VERSION}

When tfupdate_path is ., the path segment is omitted.

PR deduplication

Before creating a PR, the action checks whether a PR for the same branch already exists (open or merged). If a matching PR is found, the action skips creating a new one.

Full example

on:
  schedule:
    - cron: '0 0 * * *'

jobs:
  tfupdate_terraform:
    runs-on: ubuntu-slim
    name: Update terraform versions
    timeout-minutes: 5
    permissions:
      contents: write
      pull-requests: write
    steps:
    - uses: actions/checkout@v6
    - name: Create terraform update PR if need
      uses: masutaka/tfupdate-github-actions@v3.0.2
      with:
        tfupdate_subcommand: terraform
        tfupdate_path: './workspaces'
        assignees: 'alice'
  tfupdate_provider:
    runs-on: ubuntu-slim
    name: Update terraform provider versions
    timeout-minutes: 5
    permissions:
      contents: write
      pull-requests: write
    steps:
    - uses: actions/checkout@v6
    - name: Create terraform provider update PR if need
      uses: masutaka/tfupdate-github-actions@v3.0.2
      with:
        tfupdate_subcommand: provider
        tfupdate_path: './workspaces'
        tfupdate_provider_name: aws
        assignees: 'alice,bob'

You can see examples of Pull Requests to be created here.