Versions
The Data and ETL Blueprint pins the same tools as the AWS Baseline (OpenTofu 1.12.6, Terragrunt 1.1.5, AWS provider ~> 6.65), runs the ETL job on Glue 4.0 and the trigger on Python 3.12. Every registry module, pre-commit hook and GitHub Action is pinned to an exact version in the code, so a plan or a build means the same thing on every machine.
Where the pins live
root.hcl pins OpenTofu, Terragrunt and the AWS provider for every unit. No ETL module carries its own version file, so every unit uses exactly those pins; a guard script checks this in pre-commit and in the plan workflow.
Tools and providers
| Component | Version |
|---|---|
| OpenTofu | 1.12.6 (up to, not including, 2.0.0) |
| Terragrunt | 1.1.5 or later |
| AWS provider | ~> 6.65 |
The plan and apply workflows install exactly OpenTofu 1.12.6 and Terragrunt 1.1.5.
Platform versions
| Component | Version |
|---|---|
| AWS Glue | 4.0, glueetl command, Python 3 |
| Lambda base image | public.ecr.aws/lambda/python:3.12 |
| Lambda package | Container image |
Registry modules
| Module | Version | Used for |
|---|---|---|
terraform-aws-modules/s3-bucket/aws | 5.16.1 | The three data lake buckets |
terraform-aws-modules/lambda/aws | 8.8.2 | The Lambda trigger, its role and log group |
The catalog, Glue job, Lake Formation and security group modules use AWS provider resources directly.
Application runtime
| Component | Version |
|---|---|
| Python | >= 3.12 (pyproject.toml), 3.12 in CI |
| boto3 in the Lambda image | >= 1.35.0 |
| PySpark for local tests | 3.5.4 |
| Ruff target | py312, line length 120 |
Pre-commit hooks
| Hook source | Version | Repository |
|---|---|---|
pre-commit/pre-commit-hooks | v6.0.0 | Both |
tofuutils/pre-commit-opentofu | v2.4.2 | Infrastructure |
antonbabenko/pre-commit-terraform | v1.109.1 | Infrastructure |
bridgecrewio/checkov | 3.3.19 | Both |
astral-sh/ruff-pre-commit | v0.16.8 | Code |
GitHub Actions
| Action | Version |
|---|---|
actions/checkout | v7.0.1 |
actions/setup-python | v7.0.0 |
aws-actions/configure-aws-credentials | v6.3.0 |
aws-actions/amazon-ecr-login | v2.1.7 |
docker/build-push-action | v7.4.0 |
aquasecurity/trivy-action | v0.36.0 |
opentofu/setup-opentofu | v2.0.2 |
gruntwork-io/terragrunt-action | v3.4.1 |
actions/upload-artifact | v7.0.1 |
actions/github-script | v9.0.0 |
Each is referenced by its full commit SHA with the version in a comment, so a moved tag cannot change what runs.
How versions change
A version change is its own pull request. For the infrastructure it is planned against all three stages before it merges; for the code it goes through the normal build and release path. The policy is on the versioning policy page, and the versions across all BuiltForProd repositories are in the release notes.