From 4012606d86fac7b8c07c32c2f9bf4f7a9cd725fe Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 25 Oct 2026 05:27:19 +0100 Subject: [PATCH 1/2] chore(deps): propose Cloudflare provider updates with Dependabot Dependabot now has a dedicated OpenTofu ecosystem that updates providers in .tf files and refreshes .terraform.lock.hcl. Dependabot already runs here for GitHub Actions, while the Renovate app has never run in this repository, so the provider pin has had no working updater. Move provider updates to Dependabot with the same seven-day cooldown the third-party actions use, and remove the Renovate configuration nothing runs. Part of #3 Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 8 ++++++++ README.md | 27 +++++++++++---------------- renovate.json | 19 ------------------- 3 files changed, 19 insertions(+), 35 deletions(-) delete mode 100644 renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6da05b0..5598a7c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,3 +10,11 @@ updates: # devantler-tech actions/workflows are our own code — bump now, no cooldown. exclude: - "devantler-tech/*" + - package-ecosystem: opentofu + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + # Third-party provider releases wait a week, as third-party actions do. + default-days: 7 diff --git a/README.md b/README.md index d36e8fd..9265ebe 100644 --- a/README.md +++ b/README.md @@ -93,19 +93,14 @@ variables. Keep all three out of shell history and repository files. ## Dependency updates -This repository configures Renovate to propose Cloudflare provider updates -and maintain the OpenTofu lock file using `registry.opentofu.org`. Provider versions remain exact pins; -updates require the existing CI and review gates and are never auto-merged. -Dependabot continues to manage GitHub Actions. - -The OpenTofu runtime stays on the reviewed 1.12.x line. Renovate's Terraform -runtime updates are disabled because they track a different product. Every -provider proposal must pass `scripts/test.sh`, including the destructive-plan -guard. Dependency automation has no production credentials or apply path. - -Validate changes to these rules with Renovate's repository configuration -validator on its supported Node 24 runtime: - -```sh -npx --yes --package=renovate@44.125.1 renovate-config-validator --no-global --strict renovate.json -``` +Dependabot proposes updates to the Cloudflare provider and to the GitHub +Actions this repository uses, as configured in `.github/dependabot.yml`. For +the provider it uses its OpenTofu support, which also refreshes the provider +checksums in `.terraform.lock.hcl`. Provider versions remain exact pins, and a +new third-party release waits seven days before it is proposed. Updates +require the existing CI and review gates and are never auto-merged. + +The OpenTofu runtime stays on the reviewed 1.12.x line; no updater changes it. +Every provider proposal must pass `scripts/test.sh`, including the +destructive-plan guard. Dependency automation has no production credentials or +apply path. diff --git a/renovate.json b/renovate.json deleted file mode 100644 index f10670a..0000000 --- a/renovate.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["config:recommended"], - "enabledManagers": ["terraform"], - "dependencyDashboard": false, - "semanticCommits": "enabled", - "automerge": false, - "ignoreDeps": ["hashicorp/terraform"], - "packageRules": [ - { - "matchDatasources": ["terraform-provider"], - "registryUrls": ["https://registry.opentofu.org"], - "rangeStrategy": "pin" - } - ], - "lockFileMaintenance": { - "enabled": true - } -} From 0b1ac0352772173410274554489defc21ce3ba40 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 25 Oct 2026 05:45:02 +0100 Subject: [PATCH 2/2] docs: limit the seven-day wait to version updates The cooldown delays Dependabot version updates only. Say so, and say that Dependabot security updates exist for the Actions but not for OpenTofu providers, so a reader does not expect provider security fixes to skip the wait. Co-Authored-By: Claude Opus 5.5 --- README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 9265ebe..8b801ef 100644 --- a/README.md +++ b/README.md @@ -96,9 +96,11 @@ variables. Keep all three out of shell history and repository files. Dependabot proposes updates to the Cloudflare provider and to the GitHub Actions this repository uses, as configured in `.github/dependabot.yml`. For the provider it uses its OpenTofu support, which also refreshes the provider -checksums in `.terraform.lock.hcl`. Provider versions remain exact pins, and a -new third-party release waits seven days before it is proposed. Updates -require the existing CI and review gates and are never auto-merged. +checksums in `.terraform.lock.hcl`. Provider versions remain exact pins. A new +third-party release waits seven days before Dependabot proposes it as a version +update; the wait does not apply to Dependabot security updates, which GitHub +offers for the Actions but not for OpenTofu providers. Updates require the +existing CI and review gates and are never auto-merged. The OpenTofu runtime stays on the reviewed 1.12.x line; no updater changes it. Every provider proposal must pass `scripts/test.sh`, including the