refs platform/board#4025: add vulnerability_scanning_config block (#26)

FabrizioCafolla · web-flow · commit 63c168b10e2b · 2025-11-24T15:44:23.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -20,6 +20,16 @@ Following semver, any non backwards compatible feature implies that the next rel
 
 ## [Unreleased]
 
+## [0.12.0] - 2025-11-24
+
+[Compare with previous version](https://github.com/sparkfabrik/terraform-google-gcp-artifact-registry/compare/0.11.1...0.12.0)
+
+### Changed
+
+**:warning: BREAKING CHANGES**
+
+- FEAT (refs platform/board#4025): add `vulnerability_scanning_config` block. This configuration require `hashicorp/google` provider to `>= 6.15.0` version ([CHANGELOG](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md#6150-january-6-2025))
+
 ## [0.11.1] - 2025-11-07
 
 [Compare with previous version](https://github.com/sparkfabrik/terraform-google-gcp-artifact-registry/compare/0.11.0...0.11.1)
@@ -36,7 +46,7 @@ Following semver, any non backwards compatible feature implies that the next rel
 
 ⚠️ **BREAKING CHANGES**
 
-- FEAT (refs platform/board#3863): Add default cleanup cache policies. If you don't want it set `cleanup_policies_enable_default` attribute (in the *repository* item defined into `repositories` variable) to `false`
+- FEAT (refs platform/board#3863): Add default cleanup cache policies. If you don't want it set `cleanup_policies_enable_default` attribute (in the _repository_ item defined into `repositories` variable) to `false`
 
 ## [0.10.2] - 2025-09-04
 
diff --git a/README.md b/README.md
@@ -13,14 +13,14 @@ This module is provided without any kind of warranty and is GPL3 licensed.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_google"></a> [google](#provider\_google) | >= 5.26.0 |
+| <a name="provider_google"></a> [google](#provider\_google) | >= 6.15.0 |
 
 ## Requirements
 
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
-| <a name="requirement_google"></a> [google](#requirement\_google) | >= 5.26.0 |
+| <a name="requirement_google"></a> [google](#requirement\_google) | >= 6.15.0 |
 
 ## Inputs
 
@@ -33,7 +33,7 @@ This module is provided without any kind of warranty and is GPL3 licensed.
 | <a name="input_default_location"></a> [default\_location](#input\_default\_location) | The default location for the Artifact Registry repositories. | `string` | `"europe-west1"` | no |
 | <a name="input_enable_api"></a> [enable\_api](#input\_enable\_api) | Enable the Artifact Registry API. | `bool` | `true` | no |
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The GCP project ID that hosts the Artifact Registry. | `string` | n/a | yes |
-| <a name="input_repositories"></a> [repositories](#input\_repositories) | List of Artifact Registry repositories to create. | <pre>map(object({<br>    description                     = string<br>    format                          = optional(string, "DOCKER")<br>    mode                            = optional(string, "STANDARD_REPOSITORY")<br>    cleanup_policy_dry_run          = optional(bool, true)<br>    cleanup_policies_enable_default = optional(bool, true)<br>    cleanup_policies = optional(map(object({<br>      action = optional(string, ""),<br>      condition = optional(object({<br>        tag_state             = optional(string),<br>        tag_prefixes          = optional(list(string), []),<br>        version_name_prefixes = optional(list(string), []),<br>        package_name_prefixes = optional(list(string), []),<br>        older_than            = optional(string),<br>        newer_than            = optional(string),<br>      }), {}),<br>      most_recent_versions = optional(object({<br>        package_name_prefixes = optional(list(string), []),<br>        keep_count            = optional(number, null)<br>      }), {})<br>    })), {})<br>    docker_immutable_tags = optional(bool, false)<br>    virtual_repository_config = optional(map(object({<br>      repository = string<br>      priority   = optional(number, 0)<br>    })), null)<br>    remote_repository_config_docker = optional(object({<br>      description                                           = optional(string, "")<br>      custom_repository_uri                                 = string<br>      disable_upstream_validation                           = optional(bool, false)<br>      username_password_credentials_username                = optional(string, "")<br>      username_password_credentials_password_secret_name    = optional(string, "")<br>      username_password_credentials_password_secret_version = optional(string, "")<br>    }), null)<br>    readers  = optional(list(string), [])<br>    writers  = optional(list(string), [])<br>    location = optional(string, "")<br>    labels   = optional(map(string), {})<br>  }))</pre> | n/a | yes |
+| <a name="input_repositories"></a> [repositories](#input\_repositories) | List of Artifact Registry repositories to create. | <pre>map(object({<br>    description                     = string<br>    format                          = optional(string, "DOCKER")<br>    mode                            = optional(string, "STANDARD_REPOSITORY")<br>    vulnerability_scanning_enabled = optional(bool, false)<br>    cleanup_policy_dry_run          = optional(bool, true)<br>    cleanup_policies_enable_default = optional(bool, true)<br>    cleanup_policies = optional(map(object({<br>      action = optional(string, ""),<br>      condition = optional(object({<br>        tag_state             = optional(string),<br>        tag_prefixes          = optional(list(string), []),<br>        version_name_prefixes = optional(list(string), []),<br>        package_name_prefixes = optional(list(string), []),<br>        older_than            = optional(string),<br>        newer_than            = optional(string),<br>      }), {}),<br>      most_recent_versions = optional(object({<br>        package_name_prefixes = optional(list(string), []),<br>        keep_count            = optional(number, null)<br>      }), {})<br>    })), {})<br>    docker_immutable_tags = optional(bool, false)<br>    virtual_repository_config = optional(map(object({<br>      repository = string<br>      priority   = optional(number, 0)<br>    })), null)<br>    remote_repository_config_docker = optional(object({<br>      description                                           = optional(string, "")<br>      custom_repository_uri                                 = string<br>      disable_upstream_validation                           = optional(bool, false)<br>      username_password_credentials_username                = optional(string, "")<br>      username_password_credentials_password_secret_name    = optional(string, "")<br>      username_password_credentials_password_secret_version = optional(string, "")<br>    }), null)<br>    readers  = optional(list(string), [])<br>    writers  = optional(list(string), [])<br>    location = optional(string, "")<br>    labels   = optional(map(string), {})<br>  }))</pre> | n/a | yes |
 
 ## Outputs
 
diff --git a/main.tf b/main.tf
@@ -147,7 +147,11 @@ resource "google_artifact_registry_repository" "repositories" {
   cleanup_policy_dry_run = each.value.cleanup_policy_dry_run
   labels                 = merge(var.default_labels, var.additional_labels, each.value.labels)
 
-    dynamic "cleanup_policies" {
+  vulnerability_scanning_config {
+    enablement_config       = each.value.vulnerability_scanning_enabled ? "INHERITED" : "DISABLED"
+  }
+  
+  dynamic "cleanup_policies" {
     for_each = each.value.cleanup_policies
     content {
       id     = cleanup_policies.key
diff --git a/variables.tf b/variables.tf
@@ -22,6 +22,7 @@ variable "repositories" {
     description                     = string
     format                          = optional(string, "DOCKER")
     mode                            = optional(string, "STANDARD_REPOSITORY")
+    vulnerability_scanning_enabled = optional(bool, false)
     cleanup_policy_dry_run          = optional(bool, true)
     cleanup_policies_enable_default = optional(bool, true)
     cleanup_policies = optional(map(object({
diff --git a/versions.tf b/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5.26.0"
+      version = ">= 6.15.0"
     }
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@ terraform {`
`4`	`4`	`required_providers {`
`5`	`5`	`google = {`
`6`	`6`	`source = "hashicorp/google"`
`7`		`- version = ">= 5.26.0"`
	`7`	`+ version = ">= 6.15.0"`
`8`	`8`	`}`
`9`	`9`	`}`
`10`	`10`	`}`