Fix -var precedence

Better logging of -var flags.
Fixes diff output

Author: dflook

.github/workflows/test-apply.yaml

@@ -1007,6 +1007,7 @@ jobs:
       - name: Apply
         uses: ./terraform-apply
         id: apply
+        continue-on-error: true
         with:
           label: test-apply deprecated_var_terraform_1_10
           path: tests/workflows/test-apply/deprecated_var

image/actions.sh

@@ -390,6 +390,14 @@ function set-deprecated-var-args() {
     fi
 }
 
+function masked-deprecated-vars() {
+  if [[ -n "$DEPRECATED_VAR_ARGS" ]]; then
+    echo "-var <masked>"
+  else
+    echo ""
+  fi
+}
+
 function set-plan-args() {
     set-common-plan-args
     set-deprecated-var-args
@@ -474,11 +482,11 @@ function plan() {
     fi
 
     # shellcheck disable=SC2086
-    debug_log $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS $VARIABLE_ARGS '$DEPRECATED_VAR_ARGS'  # don't expand deprecated var args
+    debug_log $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
 
     set +e
     # shellcheck disable=SC2086
-    (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS $VARIABLE_ARGS $DEPRECATED_VAR_ARGS) \
+    (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS $DEPRECATED_VAR_ARGS $VARIABLE_ARGS ) \
         2>"$STEP_TMP_DIR/terraform_plan.stderr" \
         | $TFMASK \
         | tee /dev/fd/3 "$STEP_TMP_DIR/terraform_plan.stdout" \
@@ -502,11 +510,11 @@ function plan() {
 
 function destroy() {
     # shellcheck disable=SC2086
-    debug_log $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $VARIABLE_ARGS '$DEPRECATED_VAR_ARGS'  # don't expand deprecated var args
+    debug_log $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
 
     set +e
     # shellcheck disable=SC2086
-    (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $VARIABLE_ARGS $DEPRECATED_VAR_ARGS) \
+    (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $DEPRECATED_VAR_ARGS $VARIABLE_ARGS) \
         2>"$STEP_TMP_DIR/terraform_destroy.stderr" \
         | tee /dev/fd/3 \
             >"$STEP_TMP_DIR/terraform_destroy.stdout"

image/entrypoints/apply.sh

@@ -56,9 +56,9 @@ function apply() {
         # Instead we need to do an auto approved apply using the arguments we would normally use for the plan
 
         # shellcheck disable=SC2086,SC2016
-        debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $VARIABLE_ARGS '$DEPRECATED_VAR_ARGS'  # don't expand deprecated var args
+        debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
         # shellcheck disable=SC2086
-        (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $VARIABLE_ARGS $DEPRECATED_VAR_ARGS) \
+        (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $DEPRECATED_VAR_ARGS $VARIABLE_ARGS) \
             2>"$STEP_TMP_DIR/terraform_apply.stderr" \
             | $TFMASK \
             | tee "$STEP_TMP_DIR/terraform_apply.stdout"

image/src/github_pr_comment/__main__.py

@@ -642,8 +642,6 @@ def main() -> int:
 
             debug(f'diff {proposed_plan_path} {approved_plan_path}')
             diff_complete = subprocess.run(['diff', proposed_plan_path, approved_plan_path], check=False, capture_output=True, encoding='utf-8')
-            sys.stdout.write(diff_complete.stdout)
-            sys.stderr.write(diff_complete.stderr)
 
             if diff_complete.returncode != 0:
                 sys.stdout.write("""Performing diff between the pull request plan and the plan generated at execution time.
@@ -652,6 +650,9 @@ def main() -> int:
 Plan differences:
 """)
 
+            sys.stdout.write(diff_complete.stdout)
+            sys.stderr.write(diff_complete.stderr)
+
             if comment.headers.get('plan_text_format', 'text').endswith('trunc'):
                 sys.stdout.write('\nThe plan text was too large for a PR comment, not all differences may be shown here.')