From b3156c322e869078805b1b58adca9221db97becf Mon Sep 17 00:00:00 2001 From: Johannes Rudolph Date: Mon, 7 Sep 2026 18:28:29 +0200 Subject: [PATCH 1/2] fix(meshstack/noop): use minimum version constraints in the backplane The backplane capped tls, google and time with `~>`, against the repo convention that only root configurations pin. The cap on google was load-bearing: relaxing it resolves v8, which requires `secret_data_wo_version` wherever `secret_data_wo` is set, so add it. That argument already exists in google 7.x as optional, so the module now validates against both 7.46.1 and 8.1.0 and the constraint can stay `>= 7.0`. Takes meshstack/noop to 100% on the scorecard. Co-Authored-By: Claude Opus 5 --- modules/meshstack/noop/backplane/main.tf | 5 +++++ modules/meshstack/noop/backplane/versions.tf | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/meshstack/noop/backplane/main.tf b/modules/meshstack/noop/backplane/main.tf index 50599fb99..c43f1c08a 100644 --- a/modules/meshstack/noop/backplane/main.tf +++ b/modules/meshstack/noop/backplane/main.tf @@ -45,6 +45,11 @@ resource "google_secret_manager_secret" "runner_private_key" { resource "google_secret_manager_secret_version" "runner_private_key" { secret = google_secret_manager_secret.runner_private_key.id secret_data_wo = resource.tls_private_key.runner.private_key_pem_pkcs8 + + # google 8.x requires this alongside secret_data_wo (7.x accepted it alone). A write-only value + # is absent from state, so the provider cannot see it change — bump this counter to push a new + # key into the secret. + secret_data_wo_version = 1 } resource "google_secret_manager_secret" "runner_config" { diff --git a/modules/meshstack/noop/backplane/versions.tf b/modules/meshstack/noop/backplane/versions.tf index 91ce98f6f..e5cae3d09 100644 --- a/modules/meshstack/noop/backplane/versions.tf +++ b/modules/meshstack/noop/backplane/versions.tf @@ -4,11 +4,11 @@ terraform { required_providers { tls = { source = "hashicorp/tls" - version = "~> 4.0" + version = ">= 4.0" } google = { source = "hashicorp/google" - version = "~> 7.0" + version = ">= 7.0" } meshstack = { source = "meshcloud/meshstack" @@ -16,7 +16,7 @@ terraform { } time = { source = "hashicorp/time" - version = "~> 0.12" + version = ">= 0.12" } } } From 1318760b1d91b7aa01d25f936bc7df35af3c6994 Mon Sep 17 00:00:00 2001 From: Johannes Rudolph Date: Mon, 7 Sep 2026 18:36:33 +0200 Subject: [PATCH 2/2] fix(meshstack/noop): drop the e2e runner's provider version pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The backplane's relaxed constraints alone did not change what the e2e resolves: e2e/runner/terraform.tf capped google and tls too, so the run intersected ">= 7.0.0, ~> 7.0" and still installed google 7.46.1. The v8 compatibility fix in the previous commit was therefore never exercised. The scorecard only scans backplane/ and buildingblock/, so it reported the module as clean while this cap still bound the test. An e2e root needs no pins at all — the meshstack entry in the same block already has none. Dropping them lets the suite resolve google 8.1.0. Co-Authored-By: Claude Opus 5 --- modules/meshstack/noop/e2e/runner/terraform.tf | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/modules/meshstack/noop/e2e/runner/terraform.tf b/modules/meshstack/noop/e2e/runner/terraform.tf index bd4e078f8..5e11410b2 100644 --- a/modules/meshstack/noop/e2e/runner/terraform.tf +++ b/modules/meshstack/noop/e2e/runner/terraform.tf @@ -6,12 +6,10 @@ terraform { source = "meshcloud/meshstack" } google = { - source = "hashicorp/google" - version = "~> 7.0" + source = "hashicorp/google" } tls = { - source = "hashicorp/tls" - version = "~> 4.0" + source = "hashicorp/tls" } } }