opentofu: accept terraform_registry credentials for private registries#14865
Merged
robaiken merged 3 commits intoMay 12, 2026
Merged
Conversation
Contributor
Author
|
@robaiken This should be good to go, but in the future we will need to support |
diofeher
force-pushed
the
opentofu/accept-terraform-registry-credentials
branch
from
0411fbb to
bb54feb
Compare
robaiken
previously approved these changes
May 11, 2026
The OpenTofu registry client previously only honored credentials typed `opentofu_registry`. The dependabot.yml config schema does not expose that type yet, so users authenticating against private Terraform/OpenTofu registries (e.g. app.terraform.io) had no way to supply a token to the OpenTofu ecosystem and would fall through to anonymous requests, hitting `private_source_authentication_failure`. Accept `terraform_registry` credentials as well so existing configs keep working when the ecosystem is switched from `terraform` to `opentofu`. The registry HTTP API is identical between the two, so the same bearer token is valid.
…Performance/CollectionLiteralInLoop
diofeher
force-pushed
the
opentofu/accept-terraform-registry-credentials
branch
from
bb54feb to
41c72b9
Compare
robaiken
approved these changes
May 12, 2026
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RegistryClientpreviously only honored credentials typedopentofu_registry. That type isn't exposed in the dependabot.yml schema, so users withterraform-registryentries were effectively anonymous when their ecosystem wasopentofu, hittingprivate_source_authentication_failureagainst private registries (e.g.app.terraform.io).terraform_registrycredentials too, so configs that work for theterraformecosystem keep working when switched toopentofu. The registry HTTP API is the same between the two, so the bearer token is valid against either.