hashicorp/terraform
Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.
How terraform is put together
This is the core Terraform CLI, a Go-based infrastructure-as-code engine that parses HCL configuration, builds a dependency graph of resources and providers, plans changes against state, and applies them via out-of-process provider plugins (hashicorp/go-plugin over gRPC). The main.go entrypoint wires up CLI config loading, credential sources, service discovery, provider installation sources, backend initialization (local and remote including the 'cloud' backend for HCP Terraform), OpenTelemetry tracing, and command dispatch via hashicorp/cli. State can be stored locally or in many remote backends (S3, Azure, GCS, Consul, Postgres, Kubernetes, Tencent COS, Alibaba OSS/OCI) implemented as separate Go modules under internal/backend/remote-state. Data flows: user CLI args -> command package -> terraform core graph evaluation -> provider plugin RPCs -> serialized state files.
Languages
Frameworks
Infrastructure
Major components
main / commands bootstrap
Entry point that loads CLI config, initializes credentials, telemetry, backends, and dispatches subcommands via hashicorp/cli.
internal/command
Implements each Terraform CLI command (apply, plan, init, etc.) plus UI views, state locking, and autocomplete.
internal/backend + internal/backend/remote-state/*
Backend abstraction and per-provider remote state storage implementations (azure, consul, cos, gcs, kubernetes, oci, oss, pg, s3).
internal/cloud
HCP Terraform/Terraform Cloud integration backend handling remote runs, apply/plan orchestration via go-tfe API, policy evaluations, and task stages.
internal/addrs
Parses and represents all addressable entities (resources, modules, providers, variables) with strict validation of traversal syntax.
internal/terraform (core graph engine)
Evaluates configuration into a plan/apply execution graph, invoking providers and managing resource lifecycle.
internal/getproviders / provider_source
Resolves and installs providers from registries, honors dev overrides and reattach configuration for unmanaged providers.
internal/legacy
Separate Go module retaining pre-0.12 shims for backward compatibility.
A quieter week of internal cleanups, wiring up deferred change rendering and a token expiry warning on login.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week of internal cleanups, wiring up deferred change rendering and a token expiry warning on login.
Week of 2026-08-17
The state migrate command gained detailed machine-readable reporting, plus a new minimal-refresh flag and crash fixes.
Week of 2026-08-10
Policy evaluation came to remote queries, import bugs in child modules were fixed, and an alpha release shipped.
Week of 2026-08-03
Security features for state store providers arrived in state migrate, plus graph engine simplification and hang fixes.
Week of 2026-07-27
A major rewrite of the internal dependency graph engine dominated the week, alongside policy query summaries and another alpha release.
Over the past five weeks, Terraform development has focused heavily on modernizing the tool's internal plumbing—rewriting how commands display progress and results to users (both for humans and machines), and simplifying the internal graph engine that figures out what to build. Alongside this cleanup, several user-facing features landed, including a new `-minimal-refresh` flag that speeds up planning by only refreshing resources with proposed changes, policy evaluation support for remote queries, and security hardening around provider trust during state migration. The team also shipped two alpha releases and fixed a handful of crashes and hangs reported in import, login, and policy workflows.
Week by week
2026-08-24A quieter week of internal cleanups, wiring up deferred change rendering and a token expiry warning on login.latest6 changes
Feature
Token TTL warning on login
Users now see a warning message when logging in if their authentication token is close to expiring.
Feature
Deferred change rendering connected
Changes that are postponed until later can now be displayed properly in both human-readable and machine-readable output.
Refactor
Plan rendering data simplified
The code that packages up plan data for display was restructured to return one tidy object instead of many separate pieces.
Refactor
Duplicate resource paths merged
Two overlapping code paths for expanding resources were combined into one, reducing maintenance burden.
Fix
Import validation fix
Fixed validation of imports when Terraform is working with only part of the configuration expanded.
Chore
Dead code removed
Removed an unused transformer from the resource-counting logic to keep the codebase lean.
2026-08-17The state migrate command gained detailed machine-readable reporting, plus a new minimal-refresh flag and crash fixes.6 changes
Feature
-minimal-refresh flag
A new plan option lets Terraform skip refreshing resources that have no proposed changes, making plans faster.
Feature
State migrate JSON reporting
The state migration command now reports its steps—provider installation and migration progress—in structured output across five parts.
Fix
Import panic fix
Fixed a crash that occurred when an import referenced a sensitive value as its identity.
Chore
Partial configuration tests
Added tests clarifying how partial configuration interacts with the provider state store feature.
Chore
Ephemeral value test coverage
Tests now confirm that optional ephemeral values don't have to be set during planning.
Chore
Dependency updates
Routine updates to internal libraries and GitHub Actions tooling to stay current and secure.
2026-08-10Policy evaluation came to remote queries, import bugs in child modules were fixed, and an alpha release shipped.6 changes
Feature
Policy evaluation in remote queries
Remote queries can now run policy checks against their results, including splitting replace actions into separate create/delete evaluations.
Fix
Child module import fixes
Several fixes addressed crashes and incorrect ID handling when importing resources into child modules.
Refactor
Provider installation messaging renamed
Messages about 'initializing' providers were renamed to 'installing' for clarity, along with related interface renames.
Chore
1.17.0-alpha release prep
Prepared and cleaned up after the 1.17.0-alpha20260812 pre-release build.
Refactor
New graph-based config validation
Validation checks from the old configuration system were brought over to the newer graph-based builder.
Fix
Backend prompt wording updated
The prompt shown when initializing backends was reworded to be clearer.
2026-08-03Security features for state store providers arrived in state migrate, plus graph engine simplification and hang fixes.6 changes
Feature
Provider trust security for state migrate
The state migrate command now includes security checks establishing trust in providers used with persistent state stores.
Fix
CLI hang fix
Fixed a bug where the command line would hang indefinitely when policy evaluations were still pending after a task stage failed.
Fix
Diagnostics preservation fixes
Error messages are no longer silently discarded when renewing ephemeral resources or writing state via the built-in terraform provider.
Feature
Lock file version validation
Terraform now validates that provider versions in your configuration match the versions recorded in the lock file.
Refactor
Deprecation check performance
Deprecation warnings are now checked earlier in the process, avoiding unnecessary work transforming values.
Refactor
Graph engine cleanup
Removed unused interfaces and walk methods from the internal dependency graph, simplifying future maintenance.
2026-07-27A major rewrite of the internal dependency graph engine dominated the week, alongside policy query summaries and another alpha release.6 changes
Refactor
Dependency graph rewrite
The internal graph engine that orders Terraform's work was substantially rewritten with simpler, typed structures replacing older generic edge and hashing machinery.
Feature
Policy query summary output
Query operations now produce a policy_query_summary output so users can see policy check results at a glance.
Fix
Address parser fix
Fixed a bug where the address parser incorrectly cut off resource addresses containing dots.
Feature
Version command format_version field
The version command's JSON output now includes a format_version field, and the command was moved onto the newer views architecture.
Fix
Math function NaN fixes
The pow() and log() functions no longer crash when given inputs that produce undefined math results.
Chore
1.17.0-alpha release prep
Prepared and cleaned up after the 1.17.0-alpha20260729 pre-release build, plus routine dependency bumps.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required