# Terraform and OpenTofu Registry Deprecation and Staleness Gate (`kingii98/terraform-and-opentofu-registry-deprecation-and-staleness-gate`) Actor Resolve Terraform or OpenTofu provider and module sources against the public registry. Report deprecation, release age, and how many major versions each upgrade crosses. - **URL**: https://apify.com/kingii98/terraform-and-opentofu-registry-deprecation-and-staleness-gate.md - **Developed by:** [kingii98](https://apify.com/kingii98) (community) - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $12.00 / 1,000 registry source checkeds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## Terraform and OpenTofu Registry Deprecation and Staleness Gate Give this Actor the provider and module sources of a project, with the version constraint each one carries today. It reads the public Terraform Registry or the public OpenTofu Registry and returns one row for each source: the latest version, the latest version the constraint still allows, how many major versions the upgrade crosses, how long it has been since the last release, the deprecation or archive state, the source repository, and an upgrade class. ### Who this is for A platform engineer who plans a provider or module upgrade, and who must know which sources are unsafe to move to before the work starts. Run it once each month in the upgrade planning cycle, and once before each quarterly platform maintenance window. ### What the Actor does 1. Reads 1 to 300 registry sources, each with a kind and a version constraint. 2. Resolves each supported source against the chosen public registry. 3. Parses the constraint locally and picks the highest release the constraint still allows. 4. Measures the upgrade distance: major versions crossed, minor versions behind, and releases behind. 5. Measures the release age: the date of the newest release and the days since that date. 6. Reads the registry deprecation, archive and warning fields. 7. Writes one dataset row for each source, and one run-summary record with the gate verdict. The Actor makes HTTP GET calls to the public registry only. It runs no Terraform or OpenTofu binary, reads no state file, uses no cloud credential, no browser, no proxy, no language model and no paid API. ### Registries and endpoints | Registry | Kind | Endpoints | | --- | --- | --- | | `terraform` | provider | `registry.terraform.io/v1/providers/{ns}/{name}` and `/v2/providers/{ns}/{name}` | | `terraform` | module | `registry.terraform.io/v1/modules/{ns}/{name}/{provider}` | | `opentofu` | provider | `api.opentofu.org/registry/docs/providers/{ns}/{name}/index.json` | | `opentofu` | module | `api.opentofu.org/registry/docs/modules/{ns}/{name}/{target}/index.json` | ### Input | Field | Type | Default | Meaning | | --- | --- | --- | --- | | `sources` | array | six-source sample set | 1 to 300 sources. Each item takes `source`, an optional `kind` (`provider`, `module` or `auto`) and an optional `constraint`. A plain string is also accepted. | | `registry` | string | `terraform` | `terraform` or `opentofu`. | | `staleDays` | integer | `365` | A source with no release in this many days gets the stale flag. | | `failOnDeprecated` | boolean | `true` | A deprecated, archived or blocked source counts as a gate failure. | | `failOnStale` | boolean | `false` | A stale source counts as a gate failure. | | `failOnMajorBehind` | integer | `0` | A source that is this many majors behind, or more, counts as a gate failure. `0` turns the rule off. | Example: ```json { "sources": [ { "source": "hashicorp/aws", "kind": "provider", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/vpc/aws", "kind": "module", "constraint": "~> 5.0" } ], "registry": "terraform", "staleDays": 365 } ``` #### Source addresses - A provider address is `namespace/type`, for example `hashicorp/aws`. - A module address is `namespace/name/provider`, for example `terraform-aws-modules/vpc/aws`. - A leading registry host is accepted and removed: `registry.terraform.io/hashicorp/aws`. - A submodule path is removed and reported: `terraform-aws-modules/iam/aws//modules/iam-role`. - A Git, HTTP, archive, local-path or private-registry source cannot be read from the public registry. It gets a `SKIPPED` row with the reason, and it is never charged. #### Constraint syntax The Actor reads the constraint syntax that Terraform and OpenTofu share: `= 1.2.3`, `!= 1.2.3`, `> 1.0`, `>= 1.0`, `< 2.0`, `<= 2.0`, `~> 4.16`, and a comma separated AND list such as `>= 2.0, < 4.0`. A bare `1.2.3` means `= 1.2.3`. An empty constraint allows every release. A prerelease is never picked unless a constraint names that prerelease. A constraint the Actor cannot read does not stop the run: the row keeps `constraintValid: false` and reports the registry facts without an upgrade distance. ### Output One dataset row for each input source, plus one `runSummary` record. | Field | Meaning | | --- | --- | | `recordType` | `source` or `runSummary`. | | `inputSource`, `label`, `kind`, `registry` | The address as given, the label, the resolved kind, and the registry that answered. | | `namespace`, `name`, `target`, `submodulePath` | The parsed address. | | `constraint`, `constraintValid`, `constraintSatisfied` | The constraint, whether it could be read, and whether any release meets it. | | `status` | `RESOLVED`, `NOT_FOUND`, `SKIPPED` or `ERROR`. | | `latestVersion`, `lastReleaseDate`, `daysSinceLastRelease` | The newest release and its age. | | `latestSatisfyingVersion` | The highest release the constraint still allows. | | `majorVersionsBehind` | How many major versions the upgrade to the newest release crosses. | | `minorVersionsBehind`, `releasesBehind` | Smaller upgrade distance measures. | | `stale` | True when `daysSinceLastRelease` is at or above `staleDays`. | | `deprecated`, `deprecationReason`, `deprecationSignal`, `registryWarnings` | The deprecation state and the registry field that states it. | | `sourceRepositoryUrl` | The source repository the registry names. | | `totalVersions`, `tier`, `verified`, `downloads` | Registry metadata. | | `upgradeClass` | `current`, `minor-behind`, `major-behind`, `stale`, `deprecated`, `skipped` or `unknown`. | | `flagged` | True for a deprecated or stale source. This is the charged flag. | | `gateFailure` | True when the row breaks one of the three gate rules. | | `error` | The registry error for an `ERROR` row. | `upgradeClass` takes the first class that fits, in this order: `deprecated`, `stale`, `major-behind`, `minor-behind`, `current`. A row the Actor could not resolve gets `unknown`, and a source that is not a public registry address gets `skipped`. The run-summary record repeats the thresholds and carries the counts: `sourceCount`, `checkedCount`, `skippedCount`, `notFoundCount`, `errorCount`, `deprecatedCount`, `staleCount`, `majorBehindCount`, `minorBehindCount`, `currentCount`, `flaggedCount`, `gateFailureCount`, `registryCalls`, `deprecationFieldPresentCount` and `gateVerdict`. `deprecationFieldPresentCount` states for how many checked sources the registry carried a usable deprecation, archive or warning field. Read it to see how much of the deprecation half of the report the registry itself supports. ### The gate verdict is not a run failure A failed gate, an unreachable source and a source with no findings are all business results. The run reports them in the dataset and in the status message, and ends as SUCCEEDED. A run fails only on a real malfunction. ### Pricing: pay per event | Event | Unit | Counted as | | --- | --- | --- | | `registry-source-checked` | One provider or module source resolved against the registry | One charge for each unique address that the Actor sent to the registry. Two rows that name the same address share one lookup and one charge. A `NOT_FOUND` or `ERROR` address is charged, because the registry call was made. A `SKIPPED` row is never charged, because it never reaches the registry. | | `deprecated-or-stale-source-flagged` | One source with a deprecation notice or a release gap above the threshold | One charge for each unique checked address whose row is `deprecated` or `stale`. | ### Limits - 1 to 300 sources for each run, at most 6 registry calls at a time. - 25 second timeout and an 8 MB response cap for each registry call. - The Actor reports what the public registry states. A provider that is deprecated in its repository, but that carries no registry field, is reported through the description and warning text signals only. - Release age comes from the newest release the registry lists. The Terraform Registry gives one publish date, for the newest version; the OpenTofu API gives a date for every version. - For an OpenTofu module the API states no repository field, so `sourceRepositoryUrl` follows the registry's own GitHub naming rule (`github.com//terraform--`). Every other case takes the repository the registry states. - The run-summary counts are counts of rows. The two charge counts, `chargedSourcesChecked` and `chargedFlagsRecorded`, are counts of unique addresses. ### Development ```bash uv sync uv run pytest uv run ruff check . ``` # Actor input Schema ## `sources` (type: `array`): 1 to 300 registry sources. Each item takes `source` (for example `hashicorp/aws` for a provider, or `terraform-aws-modules/vpc/aws` for a module), an optional `kind` (provider, module or auto) and an optional `constraint` (Terraform constraint syntax, for example `~> 5.0` or `>= 2.0, < 4.0`). A plain string item is also accepted and gets the auto kind with no constraint. Only public registry sources are read. A Git, HTTP or local source is reported as skipped. ## `registry` (type: `string`): Which public registry answers the lookups. `terraform` reads registry.terraform.io. `opentofu` reads the public OpenTofu registry API. ## `staleDays` (type: `integer`): A source with no new release in this many days gets the stale flag, and counts for the deprecated-or-stale-source-flagged charge. ## `failOnDeprecated` (type: `boolean`): Count a source that the registry marks deprecated, archived or blocked as a gate failure. ## `failOnStale` (type: `boolean`): Count a source with no release inside the stale age as a gate failure. Off by default, because a small provider often has a long and healthy release gap. ## `failOnMajorBehind` (type: `integer`): Count a source as a gate failure when the upgrade to the latest release crosses this many major versions or more. 0 turns this rule off. ## Actor input object example ```json { "sources": [ { "source": "hashicorp/aws", "kind": "provider", "constraint": "~> 5.0" }, { "source": "hashicorp/random", "kind": "provider", "constraint": "~> 3.6" }, { "source": "hashicorp/template", "kind": "provider", "constraint": ">= 2.0" }, { "source": "integrations/github", "kind": "provider", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/vpc/aws", "kind": "module", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/security-group/aws", "kind": "module", "constraint": "~> 5.1" } ], "registry": "terraform", "staleDays": 365, "failOnDeprecated": true, "failOnStale": false, "failOnMajorBehind": 0 } ``` # Actor output Schema ## `dataset` (type: `string`): One row for each registry source, plus one run-summary record that carries the gate verdict and the counts. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "sources": [ { "source": "hashicorp/aws", "kind": "provider", "constraint": "~> 5.0" }, { "source": "hashicorp/random", "kind": "provider", "constraint": "~> 3.6" }, { "source": "hashicorp/template", "kind": "provider", "constraint": ">= 2.0" }, { "source": "integrations/github", "kind": "provider", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/vpc/aws", "kind": "module", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/security-group/aws", "kind": "module", "constraint": "~> 5.1" } ], "registry": "terraform", "staleDays": 365, "failOnDeprecated": true, "failOnStale": false, "failOnMajorBehind": 0 }; // Run the Actor and wait for it to finish const run = await client.actor("kingii98/terraform-and-opentofu-registry-deprecation-and-staleness-gate").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "sources": [ { "source": "hashicorp/aws", "kind": "provider", "constraint": "~> 5.0", }, { "source": "hashicorp/random", "kind": "provider", "constraint": "~> 3.6", }, { "source": "hashicorp/template", "kind": "provider", "constraint": ">= 2.0", }, { "source": "integrations/github", "kind": "provider", "constraint": "~> 5.0", }, { "source": "terraform-aws-modules/vpc/aws", "kind": "module", "constraint": "~> 5.0", }, { "source": "terraform-aws-modules/security-group/aws", "kind": "module", "constraint": "~> 5.1", }, ], "registry": "terraform", "staleDays": 365, "failOnDeprecated": True, "failOnStale": False, "failOnMajorBehind": 0, } # Run the Actor and wait for it to finish run = client.actor("kingii98/terraform-and-opentofu-registry-deprecation-and-staleness-gate").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "sources": [ { "source": "hashicorp/aws", "kind": "provider", "constraint": "~> 5.0" }, { "source": "hashicorp/random", "kind": "provider", "constraint": "~> 3.6" }, { "source": "hashicorp/template", "kind": "provider", "constraint": ">= 2.0" }, { "source": "integrations/github", "kind": "provider", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/vpc/aws", "kind": "module", "constraint": "~> 5.0" }, { "source": "terraform-aws-modules/security-group/aws", "kind": "module", "constraint": "~> 5.1" } ], "registry": "terraform", "staleDays": 365, "failOnDeprecated": true, "failOnStale": false, "failOnMajorBehind": 0 }' | apify call kingii98/terraform-and-opentofu-registry-deprecation-and-staleness-gate --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,kingii98/terraform-and-opentofu-registry-deprecation-and-staleness-gate" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/gTWMTxhb4QJg3bGVe/builds/jsxa6p6KGcxn9qzVd/openapi.json