Prevent manual PRs to update TF and CONFTEST versions

[nitrocode]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

• I'd be willing to implement this feature (contributing guide)

Describe the user story

I'd like to dynamically update the terraform and conftest versions without having to put in manual PRs

Describe the solution you'd like

We could do things like hit the terraform API from within Docker

FROM debian:stable-slim

RUN apt update && apt install -y curl jq
RUN curl --silent https://api.releases.hashicorp.com/v1/releases/terraform\?limit\=10 | jq -r '.[].version' | grep -P '^1\.3\.[0-9]+$' | head -1 > /tmp/terraform-latest-1.3

CMD ["cat", "/tmp/terraform-latest-1.3"]

$ docker build -t test-tf-version --load .
$ docker run --rm -it test-tf-version
1.3.4

But I think it would be better to use something like Renovatebot and apply a custom regex configuration to allow the bot to put in PRs. This cannot be done using the pre-existing Dependabot due to a lack of customization.

https://docs.renovatebot.com/modules/manager/regex/

Describe the drawbacks of your solution

Using both dependabot and renovatebot (renovate) or using renovatebot instead of dependabot

Describe alternatives you've considered

• Manual PRs like
  • deps: bump terraform to 1.3.3 and docs update #2614
  • deps: bump terraform to 1.3.4 #2639
• Hit an API in the Dockerfile itself to get the latest conftest or terraform and install that

[nitrocode]

Renovate bot has been enabled. Next step is to configure it to put in a PR when a new version is released.

Renovate bot PR #2681