Terraform / OpenTofu

The Terraform provider tracks the versions of a Terraform provider (a plugin such as hashicorp/aws) or a registry module (such as terraform-aws-modules/vpc/aws), from a registry implementing the provider and module registry protocols. It is registered twice: provider=terraform defaults to registry.terraform.io and provider=opentofu defaults to registry.opentofu.org, so an annotation names the ecosystem it belongs to. Both faces are one implementation, and host points either at a private registry.

required_providers {
  aws = {
    source = "hashicorp/aws"
    # clover: provider=terraform source=hashicorp/aws constraint=minor
    version = "~> 6.39"
  }
}

A module is addressed by its third segment, the target system it provisions for:

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"
  # clover: provider=terraform source=terraform-aws-modules/vpc/aws constraint=minor
  version = "5.8.1"
}

A provider and a module are told apart by the shape of the address, exactly as Terraform reads it. A fully-qualified provider address (registry.terraform.io/hashicorp/aws) also has three segments, so its registry host belongs in host rather than source.

The version inside the constraint string is the only version-shaped token on the line, so Clover bumps it in place and the operator and precision around it survive. Auto-detection recognizes a required_providers version line on its own, reading the source from the enclosing entry, so a bare @clover (the form clover annotate writes) is usually enough. It resolves against the Terraform registry; an OpenTofu repository sets provider=opentofu explicitly.

Keys

The registries are public, so the provider needs no authentication. The versions endpoint returns the whole version history in one response and carries no publication dates. Because cooldown needs a date to measure age, a marker that sets one is skipped with a warning rather than updated past a gate Clover cannot check. To gate on age, track the provider’s GitHub repository instead, where releases carry timestamps.

Private registries

Any registry implementing the protocol works. Clover reads the host’s /.well-known/terraform.json service discovery document to locate the providers.v1 endpoint, exactly as terraform init does, so a registry that mounts the API elsewhere still resolves:

# clover: provider=terraform source=acme/internal host=registry.example.com
version = "~> 2.4"