From 219c8f718edeab60e2823c0363358bb7fed09d28 Mon Sep 17 00:00:00 2001
From: Jamie Tanna <jamie.tanna@mend.io>
Date: Wed, 16 Sep 2026 12:28:57 +0100
Subject: [PATCH] fix(manager/github-actions): treat Terraform/OpenTofu
 versions as constraints

While looking at the fix for `actions/setup-java`, we noticed that
`hashicorp/setup-terraform` and `opentofu/setup-opentofu` may also be
affected, as both note:

> Instead of a full version string, you can also specify a constraint
> string (see Semver Ranges for available range specifications).

As these fall back to `semver-coerced`, which coerces `~1.1.0` to
`1.1.0`, Renovate then raises a PR rewriting the constraint into a full
version, which isn't the intent.

We can use `npm` versioning, which handles the constraint strings the
Actions document, and leaves `latest` alone as a value we have no
version to bump it to.

Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
---
 .../manager/github-actions/extract.spec.ts    | 38 +++++++++++++++++++
 .../known-actions/github-releases.ts          |  6 +++
 2 files changed, 44 insertions(+)

diff --git a/lib/modules/manager/github-actions/extract.spec.ts b/lib/modules/manager/github-actions/extract.spec.ts
index 0f59863036..c6d7bfde62 100644
--- a/lib/modules/manager/github-actions/extract.spec.ts
+++ b/lib/modules/manager/github-actions/extract.spec.ts
@@ -3788,6 +3788,24 @@ describe('modules/manager/github-actions/extract', () => {
           depName: 'terraform',
           depType: 'uses-with',
           packageName: 'hashicorp/terraform',
+          versioning: 'npm',
+        },
+      ],
+    },
+    {
+      // a constraint string is a range, not a pinned version
+      step: {
+        uses: 'hashicorp/setup-terraform@v3',
+        with: { terraform_version: '~1.13.0' },
+      },
+      expected: [
+        {
+          currentValue: '~1.13.0',
+          datasource: 'github-releases',
+          depName: 'terraform',
+          depType: 'uses-with',
+          packageName: 'hashicorp/terraform',
+          versioning: 'npm',
         },
       ],
     },
@@ -3804,6 +3822,7 @@ describe('modules/manager/github-actions/extract', () => {
           depName: 'terraform',
           depType: 'uses-with',
           packageName: 'hashicorp/terraform',
+          versioning: 'npm',
         },
       ],
     },
@@ -3852,6 +3871,24 @@ describe('modules/manager/github-actions/extract', () => {
           depName: 'opentofu',
           depType: 'uses-with',
           packageName: 'opentofu/opentofu',
+          versioning: 'npm',
+        },
+      ],
+    },
+    {
+      // a constraint string is a range, not a pinned version
+      step: {
+        uses: 'opentofu/setup-opentofu@v1',
+        with: { tofu_version: '<1.9.0' },
+      },
+      expected: [
+        {
+          currentValue: '<1.9.0',
+          datasource: 'github-releases',
+          depName: 'opentofu',
+          depType: 'uses-with',
+          packageName: 'opentofu/opentofu',
+          versioning: 'npm',
         },
       ],
     },
@@ -3868,6 +3905,7 @@ describe('modules/manager/github-actions/extract', () => {
           depName: 'opentofu',
           depType: 'uses-with',
           packageName: 'opentofu/opentofu',
+          versioning: 'npm',
         },
       ],
     },
diff --git a/lib/modules/manager/github-actions/known-actions/github-releases.ts b/lib/modules/manager/github-actions/known-actions/github-releases.ts
index 971cd3d675..b2b261831d 100644
--- a/lib/modules/manager/github-actions/known-actions/github-releases.ts
+++ b/lib/modules/manager/github-actions/known-actions/github-releases.ts
@@ -166,6 +166,9 @@ export const githubReleasesActions: Record<string, KnownActionConfig> = {
     datasource: GithubReleasesDatasource.id,
     depName: 'terraform',
     packageName: 'hashicorp/terraform',
+    // `terraform_version` may be a constraint string (e.g. `<1.2.0`,
+    // `~1.1.0`) rather than a full version
+    versioning: npmVersioning.id,
     withSchema: valSchema('terraform_version'),
   },
   // https://github.com/helm/chart-releaser-action
@@ -224,6 +227,9 @@ export const githubReleasesActions: Record<string, KnownActionConfig> = {
     datasource: GithubReleasesDatasource.id,
     depName: 'opentofu',
     packageName: 'opentofu/opentofu',
+    // as with `hashicorp/setup-terraform` above, `tofu_version` may be a
+    // constraint string rather than a full version
+    versioning: npmVersioning.id,
     withSchema: valSchema('tofu_version'),
   },
   // https://github.com/peaceiris/actions-hugo