chore(deps): update terraform zitadel to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
zitadel (source)	required_provider	major	2.12.8 → 3.3.0

---

Release Notes

zitadel/terraform-provider-zitadel (zitadel)

v3.3.0

Compare Source

Features

• ephemeral resources for state-free secret generation (#​416) (83d38c7), closes #​413

v3.2.2

Compare Source

Bug Fixes

• support access_token, jwt_file and system_api for asset uploads (8f4c2c8), closes #​411

v3.2.1

Compare Source

Bug Fixes

• deprecate unsupported fields on SMS OTP message text resources (#​414) (674a27f)

v3.2.0

Compare Source

Features

• action_target_public_key: support activating public key on create (#​409) (25328fe), closes #​408

v3.1.0

Compare Source

Features

• add project_v2 and application_v2 resources backed by the v2 APIs (#​407) (6371ca5)

v3.0.0

Compare Source

• fix!: make user-provided secrets write-only (#​406) (ee4f8cc), closes #​404

BREAKING CHANGES

• secrets are no longer stored in state, write-only attributes require Terraform 1.11+, and client_secret, private_key and bind_password are removed from the affected datasources.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Terraform Plan

Shared

✅ 1password/account — No changes

✅ 1password/futo-account — No changes

❌ bunny/futo-account — Error

│ Error: Error acquiring the state lock
│ 
│ Error message: Workspace is already locked: default
│ Lock Info:
│   ID:        1ad80d6b-af7e-3de0-30d5-e00fe8a6e493
│   Path:      

⚠️ cloudflare/account — Plan: 0 to add, 1 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # cloudflare_record.immich_store_mx_support_10 will be updated in-place
  ~ resource "cloudflare_record" "immich_store_mx_support_10" {
        id              = "87faea50a0f5cf002c7d11f8bc59ec23"
        name            = "support"
        tags            = []
        # (12 unchanged attributes hidden)
      - data {
          - algorithm      = 0 -> null
          - altitude       = 0 -> null
          - digest_type    = 0 -> null
          - key_tag        = 0 -> null
          - lat_degrees    = 0 -> null
          - lat_minutes    = 0 -> null
          - lat_seconds    = 0 -> null
          - long_degrees   = 0 -> null
          - long_minutes   = 0 -> null
          - long_seconds   = 0 -> null
          - matching_type  = 0 -> null
          - order          = 0 -> null
          - port           = 0 -> null
          - precision_horz = 0 -> null
          - precision_vert = 0 -> null
          - preference     = 0 -> null
          - priority       = 10 -> null
          - protocol       = 0 -> null
          - selector       = 0 -> null
          - size           = 0 -> null
          - target         = "mx1.improvmx.com" -> null
          - type           = 0 -> null
          - usage          = 0 -> null
          - weight         = 0 -> null
        }
    }
Plan: 0 to add, 1 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

✅ cloudflare/api-keys — No changes

⚠️ cloudflare/futo-account — Plan: 0 to add, 1 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # cloudflare_dns_record.futo_cloud_mx_root_10 will be updated in-place
  ~ resource "cloudflare_dns_record" "futo_cloud_mx_root_10" {
      - data        = {
          - priority = 10 -> null
          - target   = "in1-smtp.messagingengine.com" -> null
        } -> null
        id          = "b63520f1a964f27b9d2f30e4a0916949"
      ~ modified_on = "2026-06-30T18:19:42Z" -> (known after apply)
        name        = "futo.cloud"
        tags        = []
        # (10 unchanged attributes hidden)
    }
Plan: 0 to add, 1 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

✅ cloudflare/futo-api-keys — No changes

✅ docker/org — No changes

⚠️ github/org — Plan: 0 to add, 4 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # github_repository_collaborators.repo_collaborators["immich"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "455229168"
      ~ invitation_ids = {
          - "koen-futo"  = "286515056"
          - "martabal"   = "284848949"
          - "martyfuhry" = "284848968"
          - "matthinc"   = "284848954"
          - "sudoicezen" = "284848972"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (59 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["static-pages"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "822727374"
      ~ invitation_ids = {
          - "PixelJonas" = "284848947"
          - "fyfrey"     = "284848959"
          - "kennyfuto"  = "288622006"
          - "koen-futo"  = "286515046"
          - "martabal"   = "284848951"
          - "martyfuhry" = "284848969"
          - "matthinc"   = "284848955"
          - "orhan98"    = "315880176"
          - "sudoicezen" = "284848974"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["test-assets"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "697157116"
      ~ invitation_ids = {
          - "PixelJonas" = "284848946"
          - "fyfrey"     = "284848960"
          - "kennyfuto"  = "288622000"
          - "koen-futo"  = "286515048"
          - "martabal"   = "284848952"
          - "martyfuhry" = "284848970"
          - "matthinc"   = "284848956"
          - "orhan98"    = "315880175"
          - "staticdog"  = "320859393"
          - "sudoicezen" = "284848973"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["walkrs"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "1156754889"
      ~ invitation_ids = {
          - "C-Otto"          = "307331486"
          - "PixelJonas"      = "307331438"
          - "adamantike"      = "307331464"
          - "dahool"          = "307331471"
          - "ddshd"           = "307331444"
          - "fyfrey"          = "307331463"
          - "github-cli"      = "307331445"
          - "jbaez"           = "307331428"
          - "kennyfuto"       = "307331447"
          - "koen-futo"       = "307331458"
          - "martabal"        = "307331390"
          - "martyfuhry"      = "307331483"
          - "matthinc"        = "307331420"
          - "michelheusschen" = "307331480"
          - "midzelis"        = "309034718"
          - "orhan98"         = "315880173"
          - "samholton"       = "307331386"
          - "schuhbacca"      = "307331432"
          - "skatsubo"        = "307331414"
          - "staticdog"       = "320859390"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
Plan: 0 to add, 4 to change, 0 to destroy.
╷
│ Warning: Argument is deprecated
│ 
│   with github_repository.repositories["yucca-slop"],
│   on repositories.tf line 173, in resource "github_repository" "repositories":
│  173:   vulnerability_alerts      = !each.value.archived
│ 
│ Use the github_repository_vulnerability_alerts resource instead. This field
│ will be removed in a future version.
│ 
│ (and 24 more similar warnings elsewhere)
╵
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

✅ github/secrets — No changes

✅ github/webhooks — No changes

✅ netbird/account — No changes

⚠️ zitadel/cloud — Plan: 0 to add, 2 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # zitadel_idp_github.github will be updated in-place
  ~ resource "zitadel_idp_github" "github" {
      ~ client_secret       = (write-only attribute)
      + client_secret_hash  = (sensitive value)
        id                  = "364798781687881168"
        name                = "GitHub"
        # (7 unchanged attributes hidden)
    }
  # zitadel_idp_gitlab_self_hosted.gitlab will be updated in-place
  ~ resource "zitadel_idp_gitlab_self_hosted" "gitlab" {
      ~ client_secret       = (write-only attribute)
      + client_secret_hash  = (sensitive value)
        id                  = "366545809833012958"
        name                = "FUTO GitLab"
        # (8 unchanged attributes hidden)
    }
Plan: 0 to add, 2 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

⚠️ zitadel/self-hosted — Plan: 0 to add, 1 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # zitadel_idp_github.github will be updated in-place
  ~ resource "zitadel_idp_github" "github" {
      ~ client_secret       = (write-only attribute)
      + client_secret_hash  = (sensitive value)
        id                  = "323182965448245271"
        name                = "GitHub"
        # (7 unchanged attributes hidden)
    }
Plan: 0 to add, 1 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

Scoped (dev)

⚠️ No modules detected in plan output — the output format may have changed.

Scoped (prod)

⚠️ No modules detected in plan output — the output format may have changed.

Scoped (staging — zitadel customer)

⚠️ No modules detected in plan output — the output format may have changed.