diff --git a/.changes/unreleased/BUG FIXES-20260729-114501.yaml b/.changes/unreleased/BUG FIXES-20260729-114501.yaml index 3e1dd5f..5a66ac4 100644 --- a/.changes/unreleased/BUG FIXES-20260729-114501.yaml +++ b/.changes/unreleased/BUG FIXES-20260729-114501.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: BUG FIXES body: "Delete permissions now resolve correctly for resources with non-standard API paths (e.g. `explorer-saved-queries`, `run-tasks`)" time: 2026-07-29T11:45:01.000000-06:00 diff --git a/.changes/unreleased/BUG FIXES-20260806-170000.yaml b/.changes/unreleased/BUG FIXES-20260806-170000.yaml index db0c0cf..405a256 100644 --- a/.changes/unreleased/BUG FIXES-20260806-170000.yaml +++ b/.changes/unreleased/BUG FIXES-20260806-170000.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: BUG FIXES body: "Credentials returned by the API are no longer printed. A created token, and the `hosted-state-download-url` and `hosted-json-state-download-url` of a state version, which grant access to state without a token, were rendered in every output format including `--json` and `--jq`. `--dry-run` echoed the request body and headers, so previewing a sensitive variable printed the value being set" time: 2026-08-06T17:00:00.000000-04:00 diff --git a/.changes/unreleased/BUG FIXES-20260820-083800.yaml b/.changes/unreleased/BUG FIXES-20260820-083800.yaml index f7c2ae0..5c69599 100644 --- a/.changes/unreleased/BUG FIXES-20260820-083800.yaml +++ b/.changes/unreleased/BUG FIXES-20260820-083800.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: BUG FIXES body: "Fixed a gap in the output masking added in #101: CopyRaw only attempted to parse and mask a raw response body when its Content-Type was application/json (or ended in +json). At least one Terraform Enterprise endpoint (plan JSON export) serves valid JSON labeled application/octet-stream, so its response bypassed masking entirely. A body labeled application/octet-stream is now peeked at, without buffering it, to check whether it opens with a JSON object or array before deciding whether to mask it, so this content type is no longer treated as a blanket mask candidate: genuinely binary or large bodies served under the same label, such as state archives and plan or apply logs, are streamed through exactly as before" time: 2026-08-20T08:38:00.000000-04:00 diff --git a/.changes/unreleased/ENHANCEMENTS-20260717-015613.yaml b/.changes/unreleased/ENHANCEMENTS-20260717-015613.yaml index 7f721c7..e40d285 100644 --- a/.changes/unreleased/ENHANCEMENTS-20260717-015613.yaml +++ b/.changes/unreleased/ENHANCEMENTS-20260717-015613.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: ENHANCEMENTS body: '`tfctl auth status` now explains why authentication failed instead of printing a bare "Unauthorized". It distinguishes a missing token, a token the server rejected (401), and a request that never reached the server, and prints the matching remedy. On SSO-protected Terraform Enterprise the 401 message also calls out a lapsed browser SSO session. JSON and agent output gain a machine-readable `reason` field.' time: 2026-07-17T01:56:13-04:00 diff --git a/.changes/unreleased/ENHANCEMENTS-20260717-023923.yaml b/.changes/unreleased/ENHANCEMENTS-20260717-023923.yaml index f7f9cd6..aef8acd 100644 --- a/.changes/unreleased/ENHANCEMENTS-20260717-023923.yaml +++ b/.changes/unreleased/ENHANCEMENTS-20260717-023923.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: ENHANCEMENTS body: '`run start` now accepts `--wait`, which blocks until the run reaches a terminal state, streaming each status transition and exiting non-zero if the run fails, is canceled, is discarded, or fails a mandatory policy. A run whose plan finishes but needs a manual apply (auto-apply disabled) stops instead of hanging. `--timeout` bounds how long to wait; if it elapses, tfctl stops watching and exits non-zero while the run continues in HCP Terraform. On completion the run URL is printed. `run status` now surfaces the same run URL as well.' time: 2026-07-17T02:39:23-04:00 diff --git a/.changes/unreleased/ENHANCEMENTS-20260806-170001.yaml b/.changes/unreleased/ENHANCEMENTS-20260806-170001.yaml index b536b3a..4ebf137 100644 --- a/.changes/unreleased/ENHANCEMENTS-20260806-170001.yaml +++ b/.changes/unreleased/ENHANCEMENTS-20260806-170001.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: ENHANCEMENTS body: "Added a `redact` profile property and a `TFCTL_REDACT` environment variable to control masking of sensitive values in output, with modes `strict` (the default), `known`, and `off`, plus a `--no-redact` global flag to show masked values for a single command" time: 2026-08-06T17:00:01.000000-04:00 diff --git a/.changes/unreleased/ENHANCEMENTS-20260819-161936.yaml b/.changes/unreleased/ENHANCEMENTS-20260819-161936.yaml index 6d9b1c8..cef666b 100644 --- a/.changes/unreleased/ENHANCEMENTS-20260819-161936.yaml +++ b/.changes/unreleased/ENHANCEMENTS-20260819-161936.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: ENHANCEMENTS body: "Added a `-r name=id` flag to `api` and `create` for setting JSON:API relationships without a full request body. The relationship's linkage type is inferred from the schema (e.g. `-r project=prj-...` links to type `projects`); ambiguous or unknown relationships can be pinned with `-r name:type=id`, and to-many relationships accept comma-separated ids" time: 2026-08-19T16:19:36.000000-04:00 diff --git a/.changes/unreleased/NOTES-20260806-170002.yaml b/.changes/unreleased/NOTES-20260806-170002.yaml index 8f0682f..f50ebff 100644 --- a/.changes/unreleased/NOTES-20260806-170002.yaml +++ b/.changes/unreleased/NOTES-20260806-170002.yaml @@ -1,3 +1,6 @@ +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + kind: NOTES body: 'Sensitive values in command output are now masked by default. A script that reads a state version download URL, or a newly created token, out of `tfctl` output will see `(redacted)` until it passes `--no-redact` or sets `redact = "off"` in its profile' time: 2026-08-06T17:00:02.000000-04:00 diff --git a/.github/dependabot.yml b/.github/dependabot.yml index da48540..5f797f4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,10 +5,6 @@ updates: - package-ecosystem: "docker" open-pull-requests-limit: 1 directory: "/" - cooldown: - semver-major-days: 14 - semver-minor-days: 7 - semver-patch-days: 3 schedule: interval: "weekly" labels: @@ -18,10 +14,6 @@ updates: - package-ecosystem: "github-actions" open-pull-requests-limit: 3 directory: "/" - cooldown: - semver-major-days: 14 - semver-minor-days: 7 - semver-patch-days: 3 schedule: interval: "weekly" labels: diff --git a/internal/pkg/checkpoint/checkpoint.go b/internal/pkg/checkpoint/checkpoint.go index 3e96f77..e025ec9 100644 --- a/internal/pkg/checkpoint/checkpoint.go +++ b/internal/pkg/checkpoint/checkpoint.go @@ -1,3 +1,6 @@ +// Copyright IBM Corp. 2026 +// SPDX-License-Identifier: MPL-2.0 + // Package checkpoint provides functionality for interacting with HashiCorp's // Checkpoint service to check for new versions and alerts related to the // current version of the CLI. diff --git a/scripts/setup.sh b/scripts/setup.sh index 3b1b1d4..92d3453 100755 --- a/scripts/setup.sh +++ b/scripts/setup.sh @@ -1,4 +1,7 @@ #! /usr/bin/env bash +# Copyright IBM Corp. 2026 +# SPDX-License-Identifier: MPL-2.0 + set -e diff --git a/skills/existing.go b/skills/existing.go index 35ac586..3a025d8 100644 --- a/skills/existing.go +++ b/skills/existing.go @@ -1,3 +1,6 @@ +// Copyright IBM Corp. 2026 +// SPDX-License-Identifier: MPL-2.0 + package skills import ( diff --git a/skills/migrate.go b/skills/migrate.go index 3cdd242..7afef0c 100644 --- a/skills/migrate.go +++ b/skills/migrate.go @@ -1,3 +1,6 @@ +// Copyright IBM Corp. 2026 +// SPDX-License-Identifier: MPL-2.0 + package skills import (