Skip to content

Commit 6476be3

Browse files
dflookdflook
committed
Add support for ephemeral variables in terraform >= 1.10.0
These must be specified again when applying a saved plan, but must not be specified in earlier versions of Terraform or OpenTofu
1 parent 4d4081d commit 6476be3

File tree

6 files changed

+169
-20
lines changed

6 files changed

+169
-20
lines changed

‎.github/workflows/test-apply.yaml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -934,6 +934,7 @@ jobs:
934934
pull-requests: write
935935
env:
936936
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
937+
TERRAFORM_VERSION: "<1.10.0"
937938
steps:
938939
- name: Checkout
939940
uses: actions/checkout@v4
@@ -1430,3 +1431,100 @@ jobs:
14301431
uses: ./terraform-apply
14311432
with:
14321433
path: tests/workflows/test-apply/outputs
1434+
1435+
ephemeral:
1436+
runs-on: ubuntu-24.04
1437+
name: Apply a plan with ephemeral variables
1438+
permissions:
1439+
contents: read
1440+
pull-requests: write
1441+
env:
1442+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1443+
steps:
1444+
- name: Checkout
1445+
uses: actions/checkout@v4
1446+
with:
1447+
persist-credentials: false
1448+
1449+
- name: Plan using default ephemeral value
1450+
uses: ./terraform-plan
1451+
with:
1452+
label: test-apply ephemeral
1453+
path: tests/workflows/test-apply/ephemeral
1454+
1455+
- name: Apply using default ephemeral value
1456+
uses: ./terraform-apply
1457+
id: apply
1458+
with:
1459+
label: test-apply ephemeral
1460+
path: tests/workflows/test-apply/ephemeral
1461+
1462+
- name: Verify outputs
1463+
env:
1464+
OUTPUT_STRING: ${{ steps.apply.outputs.v }}
1465+
run: |
1466+
if [[ "$OUTPUT_STRING" != "non-ephemeral" ]]; then
1467+
echo "::error:: output s not set correctly"
1468+
exit 1
1469+
fi
1470+
1471+
##
1472+
1473+
- name: Plan using explicit ephemeral value
1474+
uses: ./terraform-plan
1475+
with:
1476+
label: test-apply ephemeral 2
1477+
path: tests/workflows/test-apply/ephemeral
1478+
variables: |
1479+
region = "eu-west-1"
1480+
mv = "hello"
1481+
1482+
- name: Apply using explicit ephemeral value
1483+
uses: ./terraform-apply
1484+
id: apply2
1485+
with:
1486+
label: test-apply ephemeral 2
1487+
path: tests/workflows/test-apply/ephemeral
1488+
variables: |
1489+
region = "eu-west-1"
1490+
mv = "hello"
1491+
1492+
- name: Verify outputs
1493+
env:
1494+
OUTPUT_STRING: ${{ steps.apply2.outputs.v }}
1495+
run: |
1496+
if [[ "$OUTPUT_STRING" != "hello" ]]; then
1497+
echo "::error:: output s not set correctly"
1498+
exit 1
1499+
fi
1500+
1501+
##
1502+
1503+
- name: Plan using explicit non-ephemeral value
1504+
uses: ./terraform-plan
1505+
with:
1506+
label: test-apply ephemeral 3
1507+
path: tests/workflows/test-apply/ephemeral
1508+
variables: |
1509+
region = "eu-west-2"
1510+
mv = "goodbye"
1511+
1512+
- name: Apply using mismatched explicit non-ephemeral value
1513+
uses: ./terraform-apply
1514+
continue-on-error: true
1515+
id: apply3
1516+
with:
1517+
label: test-apply ephemeral 3
1518+
path: tests/workflows/test-apply/ephemeral
1519+
variables: |
1520+
region = "eu-west-2"
1521+
mv = "mismatch"
1522+
1523+
- name: Check failed to apply
1524+
env:
1525+
OUTCOME: ${{ steps.apply3.outcome }}
1526+
run: |
1527+
if [[ "$OUTCOME" != "failure" ]]; then
1528+
echo "Apply did not fail correctly"
1529+
exit 1
1530+
fi

‎image/actions.sh‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,8 @@ function set-common-plan-args() {
360360
}
361361

362362
function set-variable-args() {
363+
VARIABLE_ARGS=""
364+
363365
if [[ -n "$INPUT_VAR_FILE" ]]; then
364366
for file in $(echo "$INPUT_VAR_FILE" | tr ',' '\n'); do
365367

@@ -368,32 +370,46 @@ function set-variable-args() {
368370
exit 1
369371
fi
370372

371-
PLAN_ARGS="$PLAN_ARGS -var-file=$(relative_to "$INPUT_PATH" "$file")"
373+
VARIABLE_ARGS="$VARIABLE_ARGS -var-file=$(relative_to "$INPUT_PATH" "$file")"
372374
done
373375
fi
374376

375377
if [[ -n "$INPUT_VARIABLES" ]]; then
376378
echo "$INPUT_VARIABLES" >"$STEP_TMP_DIR/variables.tfvars"
377-
PLAN_ARGS="$PLAN_ARGS -var-file=$STEP_TMP_DIR/variables.tfvars"
379+
VARIABLE_ARGS="$VARIABLE_ARGS -var-file=$STEP_TMP_DIR/variables.tfvars"
378380
fi
379381
}
380382

381-
function set-plan-args() {
382-
set-common-plan-args
383+
function set-deprecated-var-args() {
384+
DEPRECATED_VAR_ARGS=""
383385

384386
if [[ -n "$INPUT_VAR" ]]; then
385387
for var in $(echo "$INPUT_VAR" | tr ',' '\n'); do
386-
PLAN_ARGS="$PLAN_ARGS -var $var"
388+
DEPRECATED_VAR_ARGS="$DEPRECATED_VAR_ARGS -var $var"
387389
done
388390
fi
391+
}
389392

393+
function masked-deprecated-vars() {
394+
if [[ -n "$DEPRECATED_VAR_ARGS" ]]; then
395+
echo "-var <masked>"
396+
else
397+
echo ""
398+
fi
399+
}
400+
401+
function set-plan-args() {
402+
set-common-plan-args
403+
set-deprecated-var-args
390404
set-variable-args
391405

392406
export PLAN_ARGS
393407
}
394408

395409
function set-remote-plan-args() {
396410
set-common-plan-args
411+
VARIABLE_ARGS=""
412+
DEPRECATED_VAR_ARGS=""
397413

398414
local AUTO_TFVARS_COUNTER=0
399415

@@ -466,11 +482,11 @@ function plan() {
466482
fi
467483

468484
# shellcheck disable=SC2086
469-
debug_log $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG '$PLAN_ARGS' # don't expand PLAN_ARGS
485+
debug_log $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
470486

471487
set +e
472488
# shellcheck disable=SC2086
473-
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS) \
489+
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS $DEPRECATED_VAR_ARGS $VARIABLE_ARGS ) \
474490
2>"$STEP_TMP_DIR/terraform_plan.stderr" \
475491
| $TFMASK \
476492
| tee /dev/fd/3 "$STEP_TMP_DIR/terraform_plan.stdout" \
@@ -494,11 +510,11 @@ function plan() {
494510

495511
function destroy() {
496512
# shellcheck disable=SC2086
497-
debug_log $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS
513+
debug_log $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
498514

499515
set +e
500516
# shellcheck disable=SC2086
501-
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS) \
517+
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME destroy -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $DEPRECATED_VAR_ARGS $VARIABLE_ARGS) \
502518
2>"$STEP_TMP_DIR/terraform_destroy.stderr" \
503519
| tee /dev/fd/3 \
504520
>"$STEP_TMP_DIR/terraform_destroy.stdout"

‎image/entrypoints/apply.sh‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,23 +32,33 @@ function apply() {
3232
set +e
3333
if [[ -n "$PLAN_OUT" ]]; then
3434

35+
# With Terrraform >= 1.10 Ephemeral variables must be specified again in the apply command.
36+
# Non-ephemeral variables may be specified again, but may not be different from the plan.
37+
# Terraform < 1.1.0 must not specify any variables when applying a saved plan.
38+
39+
SAVED_PLAN_VARIABLES=""
40+
if [[ "$TOOL_PRODUCT_NAME" == "Terraform" ]] && test-terraform-version ">=" "1.10.0"; then
41+
SAVED_PLAN_VARIABLES="$VARIABLE_ARGS"
42+
fi
43+
3544
# shellcheck disable=SC2086
36-
debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT
45+
debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -lock-timeout=300s $PARALLEL_ARG $SAVED_PLAN_VARIABLES $PLAN_OUT
3746
# shellcheck disable=SC2086
38-
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME apply -input=false -no-color -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT) \
47+
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME apply -input=false -no-color -lock-timeout=300s $PARALLEL_ARG $SAVED_PLAN_VARIABLES $PLAN_OUT) \
3948
2>"$STEP_TMP_DIR/terraform_apply.stderr" \
4049
| $TFMASK \
4150
| tee "$STEP_TMP_DIR/terraform_apply.stdout"
4251
APPLY_EXIT=${PIPESTATUS[0]}
4352
>&2 cat "$STEP_TMP_DIR/terraform_apply.stderr"
53+
4454
else
4555
# There is no plan file to apply, since the remote backend can't produce them.
4656
# Instead we need to do an auto approved apply using the arguments we would normally use for the plan
4757

58+
# shellcheck disable=SC2086,SC2016
59+
debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
4860
# shellcheck disable=SC2086
49-
debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG '$PLAN_ARGS' # don't expand plan args
50-
# shellcheck disable=SC2086
51-
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS) \
61+
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS $DEPRECATED_VAR_ARGS $VARIABLE_ARGS) \
5262
2>"$STEP_TMP_DIR/terraform_apply.stderr" \
5363
| $TFMASK \
5464
| tee "$STEP_TMP_DIR/terraform_apply.stdout"
@@ -95,7 +105,7 @@ if [[ "$INPUT_PLAN_PATH" != "" ]]; then
95105
exit 1
96106
fi
97107

98-
PLAN_OUT=$(realpath $INPUT_PLAN_PATH)
108+
PLAN_OUT=$(realpath "$INPUT_PLAN_PATH")
99109
PLAN_EXIT=2
100110
else
101111
plan

‎image/entrypoints/test.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,11 @@ function set-test-args() {
3030

3131
function test() {
3232

33-
debug_log $TOOL_COMMAND_NAME test -no-color $TEST_ARGS '$PLAN_ARGS' # don't expand PLAN_ARGS
33+
debug_log $TOOL_COMMAND_NAME test -no-color $TEST_ARGS $VARIABLE_ARGS
3434

3535
set +e
3636
# shellcheck disable=SC2086
37-
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME test -no-color $TEST_ARGS $PLAN_ARGS) \
37+
(cd "$INPUT_PATH" && $TOOL_COMMAND_NAME test -no-color $TEST_ARGS $VARIABLE_ARGS) \
3838
2>"$STEP_TMP_DIR/terraform_test.stderr" \
3939
| tee /dev/fd/3 \
4040
>"$STEP_TMP_DIR/terraform_test.stdout"
@@ -59,7 +59,6 @@ function test() {
5959
}
6060

6161
set-test-args
62-
PLAN_ARGS=""
6362
set-variable-args
6463

6564
test

‎image/src/github_pr_comment/__main__.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -642,8 +642,6 @@ def main() -> int:
642642

643643
debug(f'diff {proposed_plan_path} {approved_plan_path}')
644644
diff_complete = subprocess.run(['diff', proposed_plan_path, approved_plan_path], check=False, capture_output=True, encoding='utf-8')
645-
sys.stdout.write(diff_complete.stdout)
646-
sys.stderr.write(diff_complete.stderr)
647645

648646
if diff_complete.returncode != 0:
649647
sys.stdout.write("""Performing diff between the pull request plan and the plan generated at execution time.
@@ -652,6 +650,9 @@ def main() -> int:
652650
Plan differences:
653651
""")
654652

653+
sys.stdout.write(diff_complete.stdout)
654+
sys.stderr.write(diff_complete.stderr)
655+
655656
if comment.headers.get('plan_text_format', 'text').endswith('trunc'):
656657
sys.stdout.write('\nThe plan text was too large for a PR comment, not all differences may be shown here.')
657658

‎tests/workflows/test-apply/ephemeral/main.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
variable "region" {
2+
type = string
3+
default = "eu-west-2"
4+
}
5+
6+
variable "mv" {
7+
type = string
8+
default = "non-ephemeral"
9+
}
10+
11+
provider "aws" {
12+
region = var.region
13+
}
14+
15+
output "v" {
16+
value = var.mv
17+
}
18+
19+
resource "random_string" "add" {
20+
length = 5
21+
}
22+
23+
terraform {
24+
required_version = ">=1.10"
25+
}

0 commit comments

Comments
 (0)