[devantler]

🤖 Generated by the Agentic Engineer

Why

The Cloudflare setup is pinned to an older release of the official Cloudflare tooling, four releases behind, and automatic updates cannot run here yet. Nothing has been brought under management so far, so moving now costs nothing; after the first import, every update has to be checked against the live account.

What

Moves the pinned Cloudflare tooling to its newest release and records its fingerprints for the machines that use it. The newer releases only add optional and read-only information to the records, buckets, zone and access tokens this setup manages, so nothing it declares changes meaning.

Fixes #22

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4bf257f2-2f07-4f11-967e-e6d6fc6b224c

📥 Commits

Reviewing files that changed from the base of the PR and between 51203ec and 2d35801.

📒 Files selected for processing: 2

• .terraform.lock.hcl
• versions.tf

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 3

• GitHub Check: zizmor
• GitHub Check: zizmor
• GitHub Check: Analyze (actions)

🧰 Additional context used

📚 Code guidelines: 1

AGENTS.md — unknown

📓 Path-based instructions: 1

Source excerpt: Use OpenTofu 1.12.x and the official Cloudflare provider version pinned in `versions.tf`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• versions.tf

🔇 Additional comments: 1

.terraform.lock.hcl: 1

8-24: 🩺 Stability & Availability

This is a validation request, not a demonstrated defect. scripts/test.sh includes tofu init and tofu validate, and CI invokes it. No evidence shows that either run failed or was skipped. The lockfile hashes do not identify their target platforms, but that does not establish incorrect or incomplete checksums.

📝 Walkthrough

The Cloudflare provider constraint changed from exactly 5.24.0 to exactly 5.28.0. The lock file now records version 5.28.0 and its corresponding checksums.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 2d358

This updates the Cloudflare provider pin and lock file to 5.28.0. No concrete problem was found in the supplied changes, and the repository's normal test script and CI cover the init and validate steps.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 1 error

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #22 requires the provider pin and lock entry to move to 5.28.0. versions.tf pins = 5.28.0, and .terraform.lock.hcl records 5.28.0 with the regenerated checksum set for the four stated plat…	Add the required check statement for the 5.27 account_token permission-group metadata change and the 5.27/5.28 dns_record include_shadow_metadata default change. Explain why each change does not affect main.tf. Provide successful lo…

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely states the main change: updating the Cloudflare provider to version 5.28.0.
Description check		The description explains why and how the Cloudflare provider is being updated, including the version change and lock file fingerprints. It is directly related to the changeset.
Out of Scope Changes check		The supplied change summary contains only the Cloudflare provider pin and its OpenTofu lock entry. Both changes implement issue #22. No unrelated resource changes or live plans or applies are shown.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Linked Issues check

Explanation

Issue #22 requires the provider pin and lock entry to move to 5.28.0. versions.tf pins = 5.28.0, and .terraform.lock.hcl records 5.28.0 with the regenerated checksum set for the four stated platforms. scripts/test.sh covers formatting, initialization, and validation, but the supplied evidence does not show a local or CI run. The PR description does not identify the breaking changes in provider versions 5.27 and 5.28 or explain their applicability to main.tf.

Resolution

Add the required check statement for the 5.27 account_token permission-group metadata change and the 5.27/5.28 dns_record include_shadow_metadata default change. Explain why each change does not affect main.tf. Provide successful local and CI evidence for scripts/test.sh.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness record — head 2d3580171ddf4323d164dbcc16fe9904aa216188

Upstream release review (5.24.0 → 5.28.0). Compared the provider's published resource schemas at 5.24.0 and 5.28.0 for every resource type this configuration declares (cloudflare_zone, cloudflare_dns_record, cloudflare_r2_bucket, cloudflare_r2_bucket_lifecycle, cloudflare_account_token):

• Schema versions are unchanged for all five (500/500/500/500/501), so no state upgrade runs.
• cloudflare_dns_record gains include_shadow_metadata (optional + computed). The 5.27/5.28 default of false on import/refresh does not matter here: the configuration never sets or reads it.
• cloudflare_account_token gains read-only creator_email_at_creation, provisioner_id, provisioner_type. The typed permission-group metadata change (5.27) does not touch this configuration, which passes permission groups by id only and reads only value.
• cloudflare_zone, cloudflare_r2_bucket, cloudflare_r2_bucket_lifecycle: description text only.

Applicability: nothing in 5.25–5.28 requires an adaptation here, and no new capability is needed by the current scope (#21). Nothing is imported yet, so there is no live plan to check.

Tested. Lock regenerated with tofu providers lock for linux_amd64, linux_arm64, darwin_amd64, darwin_arm64 (same 8 h1: + 9 zh: shape as before). scripts/test.sh (shellcheck, no-destructive-plan fixtures, fmt -check, init -backend=false, validate) passes locally on OpenTofu 1.13.1 with a git-ignored override relaxing required_version (CI runs the pinned 1.12.6).

Tried as a user. An operator's first step is tofu init + validate against the new pin: both succeed and download 5.28.0 with matching checksums.

Reviewed. CodeRabbit full review at this head: summary updated 16:16:56Z after the 16:13Z request, covering 2d3580171ddf4323d164dbcc16fe9904aa216188, "No actionable comments"; 0 review threads; commit status "Review completed". CI green (Validate, CodeQL, zizmor, dependency review, required checks).