Scalr.io

Features

Scalr OIDC Authentication

Scalr now supports OpenID Connect (OIDC), allowing users to authenticate to the Scalr API using ID tokens from providers like GitHub, GitLab, AWS, Azure, and others. This removes the need for static personal or service account tokens and simplifies access management. See the docs on this here.(May 13th, 2025/8.200.0)

Avoid State Updates by Unmerged PRs

Want to ensure that Terraform state modifications are only applied from the main workspace branch or a verified PR, preventing accidental overwrites or conflicts caused by unmerged changes?

Scalr now safeguards your Terraform state from unintended modifications with branch awareness. Scalr displays warnings when changes are attempted from branches with unmerged pull requests, and automatically prevents auto-apply operations when the state-generating branch differs from your run's configuration branch. This ensures state modifications only occur from your main workspace branch or properly verified pull requests, preventing accidental overwrites and conflicts.

No extra configuration in Scalr is needed to trigger these warnings. This workflow applies to those who apply before merging. (May 13th, 2025/8.200.0)

PR Comment Approvals for Runs

Streamline your workflow with new GitHub and Azure DevOps PR comment commands /scalr approve and /scalr decline that let you manage run approvals directly from pull requests. This feature supports both bulk and specific workspace approvals, with optional reason documentation using the -reason argument. Users must share the same email address in both the VCS provider and Scalr and have runs:apply permission to use these commands. See more here. (May 6th, 2025/8.199.0)

Cross-Environment Run Triggers and State Sharing

Need to trigger runs and share state with workspaces in different environments? Federated environment access in Scalr enables users to create dependencies between workspaces across different environments. This functionality enables teams to set up run triggers, where the successful execution in one workspace automatically initiates runs in dependent workspaces in other environments. It also facilitates state sharing, where outputs from one workspace can be used as inputs in another. By granting controlled access between environments, federated environments streamline cross-environment workflows while maintaining appropriate security boundaries. See the docs on this here. (May 1st, 2025/8.198.0)

Improvements

Default Agent Pools

Scalr now allows administrators to set a default agent pool at the account level. When set, all new workspaces will inherit the pool unless overridden at the workspace level. This eliminates the need to assign agent pools to each workspace manually.

Existing workspaces remain unaffected unless explicitly changed. To use this feature, set the default agent pool through the agent pool management UI with the agent-pools:update permission:

(May 27nd, 2025/8.204.0)

Choose a Commit Strategy

Scalr now allows administrators to select commit strategies in the VCS provider settings to determine when runs should be triggered. The default base commit strategy compares the latest head commit with the base branch commit, while the newly available previous commit strategy compares the latest head commit with the previous head commit.

This enhancement reduces unnecessary runs triggered by unrelated file changes in pull requests, giving administrators better control over change detection to improve run relevance and reduce noise.

Existing setups will continue to operate with the current base commit strategy as the default behavior. Administrators have the option to switch to the previous commit strategy through VCS settings if it better aligns with their specific workflow requirements. See the docs here. (May 22nd, 2025/8.203.0)

Automatic Base Branch Merge Before Run Execution

Scalr has introduced a new optional feature for VCS-driven workspaces that automatically merges the base branch into the head branch before triggering a run. This enhancement ensures that runs are always executed against the latest code in the base branch, providing more accurate and reliable results.

This improvement addresses a common pain point where runs could previously be executed against outdated head branches, potentially leading to false-positive results or failed applies after merging.

To implement this feature, enable the auto-merge option when configuring a VCS. (May 20th, 2025/8.202.0)

Support for PR Comment Approval on Closed Pull Requests

Scalr now processes "/scalr approve" and "/scalr decline" comments even when pull requests are closed. This enhancement eliminates the need to reopen PRs to approve or decline runs.

This update requires no changes to existing setups and works automatically if pull request comments are enabled. (May 20th, 2025/8.202.0)

Improved Access Control for Discarding Runs

Scalr has enhanced its permission system to allow users to discard runs in both Apply Approval and Policy Override stages using either the runs:apply or runs:cancel permission. Previously, runs:apply was the only option, so now admins have more granular permissions for discarding runs.

No configuration changes are required for existing setups, as workflows relying on runs:apply will continue to function normally. Teams can immediately begin granting the more targeted runs:cancel permission instead, enabling improved security through granular access control. (May 20th, 2025/8.202.0)

Show All Outputs

There is an improved workspace outputs experience with a new "Show all" option that opens a modal displaying all workspace outputs, not just those from the latest run. This improvement addresses a previous limitation where outputs were only visible when navigating to individual runs, and no outputs would appear if the latest run had no output changes. (May 20th, 2025/8.202.0)

Slack Notifications for Drift Detection

Scalr now supports Slack notifications for infrastructure drift detection. When drift is detected, you'll receive instant alerts in your configured Slack channel. To enable this feature, navigate to Settings → Integrations → Slack and activate the new "Drift Detected" event. See more here. (May 13th, 2025/8.200.0)

New OPA Input: AzureDevOps Merge Error Attribute

Added a new merge_error attribute to the policy input for Azure DevOps that provides visibility into potential merge blockers. This attribute captures values from the Azure DevOps merge_status field. This helps teams proactively identify and address merge issues before running an apply.

Sample tfrun data:

"pull_request": {

"author": "user",

"merged_by": null,

"merge_error": "blocked"

}

See an example policy here.

(May 13th, 2025/8.200.0)

New OPA Input: Github Merge Error Attribute

Added a new merge_error attribute to the policy input for GitHub and GitHub Enterprise integrations that provides visibility into potential merge blockers. This attribute captures values from GitHub's mergeable_state field when it contains 'dirty', 'unknown', 'blocked', or 'behind' statuses, while remaining empty for 'clean', 'unstable', and 'has_hooks' states. This helps teams proactively identify and address merge issues before running an apply.

Sample tfrun data:

"pull_request": {

"author": "user",

"merged_by": null,

"merge_error": "blocked"

}

See an example policy here.

(May 6th, 2025/8.199.0)

Select Storage Profile Per Environment

Scalr now allows users to select a storage profile (AWS S3, GCP, or AzureRM) when creating or updating environments via UI, in addition to the existing API support. If no profile is selected, the default account-level profile will be used. (May 13th, 2025/8.200.0)

Storage Profiles: Azure

Scalr now supports creating and managing Azure storage profiles, expanding multi-cloud support alongside AWS and GCP. Users with the appropriate permissions can configure Azure-based storage by providing the storage account, container, and OIDC credentials (Tenant ID, Client ID, Audience). This enables organizations to store data within their own Azure subscription, helping meet data residency requirements. See more here. (May 6th, 2025/8.199.0)

Download OPA Reports

We've added the ability to download Policy reports and Impact analysis of OPA policy groups in CSV format. This streamlined export function makes it significantly easier to review, share, and audit your policy statuses.

Access this feature through the policy reports or policy impact analysis tabs:

(May 1st, 2025/8.198.0)

Storage Profiles CRUD Added to the UI

Scalr now supports adding custom AWS S3 and GCP storage profiles via the UI, complementing the previously released Public API. Users with the appropriate permissions can configure storage profiles to align with organizational policies and store Terraform-related data in their buckets. The Scalr GCP profile remains available and cannot be modified or deleted. (May 1st, 2025/8.198.0)

Export SCALR_RUN_CONTENT_ROOT environment variable

The SCALR_RUN_CONTENT_ROOT variable is now exported during the run. This allows users to reference the absolute path to the root of the workspace code for use in custom scripts or tooling within the run lifecycle. (May 1st, 2025/8.198.0)

Defects

Fixed issue where terraform/opentofu variable files were not loaded during the init phase. (May 6th, 2025/8.199.0)
When updating a GCP storage profile, the system will no longer send empty or null Google credentials if only the name is changed, ensuring smoother updates without errors. (May 6th, 2025/8.199.0)
If an invalid JSON key file is uploaded when creating a new Google Cloud storage profile, a clear and persistent error message will now be displayed under the JSON key section. (May 6th, 2025/8.199.0)
Fixed an issue where removing the session duration from a Service Account’s Assume Policy caused an internal server error. Now, if the value is removed, the default (3600 seconds) or previously saved value is used automatically. (May 6th, 2025/8.199.0)
Fixed dropdown positioning in the "Publish Module" modal when selecting the module root directory for nested repositories. (May 1st, 2025/8.198.0)
PR visibility now updates correctly in a workspace when the base branches in the repo are changed. This fix improves the consistency between VCS and workspace PR management, ensuring that users see the correct PRs associated with their selected base branch. (May 1st, 2025/8.198.0)
Fixed the inconsistent behavior of the 'Create Connection' button in the Infracost and DataDog integration settings form. (May 1st, 2025/8.198.0)
Fixed an issue where run triggers and state consumers were not removed after federated access was revoked in cross-environment configurations. (May 13th, 2025/8.200.0)
Fixed an issue where the Run Dashboard displayed "Locked by deleted user" for runs that were locked by a service account. (May 13th, 2025/8.200.0)
Fixed an issue where changing the AWS plan in billing management caused an issue. (May 13th, 2025/8.200.0)
Fixed an issue where the software version was not updated when creating a workspace without the var-files attribute. (May 19th, 2025/8.201.0)
Fixed an issue where logging in did not redirect to the originally requested page. (May 19th, 2025/8.201.0)
Fixed an issue where the AWS Marketplace setup URL redirected to Scalr.io without an active browser session. (May 19th, 2025/8.201.0)
Fixed issue where users were taken to a 404 page after creating an assume policy for a service account in IAM. (May 20th, 2025/8.202.0)
Fixed an issue in the OPA integration settings where pagination did not switch to the next page; instead, more content was loaded at the bottom of the current page. (May 22nd, 2025/8.203.0)
Fixed issue where the State Version view displayed the current state for each previous version instead of the correct historical state. (May 29th, 2025/8.205.0)
Fixed an issue where Checkov results (passed/failed/skipped checks) were missing from the CLI output of tofu plan. (May 29th, 2025/8.205.0)

Scalr Agent

New

0.47.0 (May 30th, 2025)

Host Shell Variables Now Propagated to Agent

Scalr Agent's Local Driver automatically propagates host shell environment variables into the run shell environment, eliminating the previous isolation that made customization difficult in stateless or containerized setups. Existing setups require no changes, though SCALR_* variables remain isolated by design and won't be propagated. To use this feature, simply upgrade your agent-local Kubernetes chart to the latest version, and the host environment variables will automatically become available in your run shell environment.

Support for Custom .terraformrc Files

Add the SCALR_TERRAFORM_RC shell variable in a workspace to use a custom .terraformrc file. The value of the variable should be the contents you would normally put in the custom .terraformrc file. This enables direct configuration of Terraform CLI settings, including credentials, plugin caching, and proxy configurations for private module registry access and enhanced security.

0.45.0 (May 15th, 2025)

All updates below are optional and do not impact existing deployments.

We've implemented the new local driver, allowing Scalr Agent to run tasks without isolation and removing the need for Docker or Kubernetes. When enabled, tasks execute directly in the agent's environment.

To use the local driver:

Start the agent with the --local flag, or
Set the SCALR_DRIVER=local configuration option

This is ideal for:

Serverless environments
Scenarios where you prefer not to grant Docker socket access
Environments where you manage orchestration independently

For best results with the local driver, use Single Mode or set SCALR_AGENT_CONCURRENCY to 1 to ensure sequential execution of run stages. To enable Single Mode, run the agent with the --single command-line flag or with SCALR_SINGLE=1 config option.

We've improved the --url/SCALR_URL configuration handling. This configuration is now optional as the Scalr API endpoint can be automatically extracted from the token payload. We still recommend explicitly setting the URL for long-lived services to prevent issues if your account is renamed.

Improvements

0.47.0 (May 20th, 2025)

The $SCALR_AGENT_ENV environment variable was introduced to customize the Run environment through workspace custom hook scripts.

0.46.0 (May 20th, 2025)

Bumped the versions of xz and pip.

0.45.0 (May 15th, 2025)

VCS agents no longer require a Docker socket
In Single Mode, the agent will now wait for new incoming tasks instead of immediately exiting when the task queue is empty.
We've modified the exec-loop logging format and communication pipelines with the container entrypoint. The entrypoint now shares logs and exit codes via the filesystem instead of relying on Docker or Kubernetes logging drivers.
Added detailed logging and tracing coverage for Checkov, Infracost, and OPA policy tasks.
Performance improvements for OPA policy tasks, the exec-loop entrypoint shell script, and log streaming of run stages.

Defects

Fixed an issue where the agent was not using the memory limit settings from the agent config file. (0.44.4)
Fixed an issue where var files were not loading during the init phase. (0.44.4)
Fixed an issue where Agent Workers stopped accepting incoming agent tasks due to problems tracking the resourceVersion while listening to the Pods event stream. The resourceVersion is now reset to 0 after 5 unsuccessful attempts to reconnect to the event stream. (0.46.0)
Fixed an issue where commands failed with unexpected exit code 93. (0.46.0)
Fixed an issue where commands did not complete within 10 seconds. (0.46.0)
Fixed an issue where the formatting check integration could fail with exit code 1 and report an empty list of improperly formatted files. (0.47.0)
Fixed compatibility issues on NFS-backed storage. Previously, runs could get stuck during the initialization phase on Kubernetes agents using storage like AWS EFS. The container task entry point will now avoid using filesystem FIFO pipes to maintain compatibility with network filesystems, which have limited support for these features. The solution has been tested on NFSv4.1. (0.47.0)

Scalr Provider

Added

Attribute added to the scalr_environment resource and datasource: new attribute federated_environments(3.2.0)