Skip to content

Commit 655b5ed

Browse files
dflookdflook
authored
Merge pull request #103 from dflook/tfc-variables
Add variables and var_files support for remote operations
2 parents fdbde0f + 65b027c commit 655b5ed

File tree

10 files changed

+268
-119
lines changed

10 files changed

+268
-119
lines changed

‎.github/workflows/test-remote.yaml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,69 @@ jobs:
3333

3434
- name: Auto apply workspace
3535
uses: ./terraform-apply
36+
id: auto_apply
3637
with:
3738
path: tests/terraform-cloud
3839
workspace: ${{ github.head_ref }}-1
3940
backend_config: "token=${{ secrets.TF_API_TOKEN }}"
4041
auto_approve: true
42+
var_file: |
43+
tests/terraform-cloud/my_variable.tfvars
44+
variables: |
45+
from_variables="from_variables"
46+
47+
- name: Verify auto_apply terraform outputs
48+
run: |
49+
if [[ "${{ steps.auto_apply.outputs.default }}" != "default" ]]; then
50+
echo "::error:: Variables not set correctly"
51+
exit 1
52+
fi
53+
54+
if [[ "${{ steps.auto_apply.outputs.from_tfvars }}" != "from_tfvars" ]]; then
55+
echo "::error:: Variables not set correctly"
56+
exit 1
57+
fi
58+
59+
if [[ "${{ steps.auto_apply.outputs.from_variables }}" != "from_variables" ]]; then
60+
echo "::error:: Variables not set correctly"
61+
exit 1
62+
fi
63+
64+
- name: Check no changes
65+
uses: ./terraform-check
66+
with:
67+
path: tests/terraform-cloud
68+
workspace: ${{ github.head_ref }}-1
69+
backend_config: "token=${{ secrets.TF_API_TOKEN }}"
70+
var_file: |
71+
tests/terraform-cloud/my_variable.tfvars
72+
variables: |
73+
from_variables="from_variables"
74+
75+
- name: Check changes
76+
uses: ./terraform-check
77+
id: check
78+
continue-on-error: true
79+
with:
80+
path: tests/terraform-cloud
81+
workspace: ${{ github.head_ref }}-1
82+
backend_config: "token=${{ secrets.TF_API_TOKEN }}"
83+
var_file: |
84+
tests/terraform-cloud/my_variable.tfvars
85+
variables: |
86+
from_variables="Changed!"
87+
88+
- name: Verify changes detected
89+
run: |
90+
if [[ "${{ steps.check.outcome }}" != "failure" ]]; then
91+
echo "Check didn't fail correctly"
92+
exit 1
93+
fi
94+
95+
if [[ "${{ steps.check.outputs.failure-reason }}" != "changes-to-apply" ]]; then
96+
echo "failure-reason not set correctly"
97+
exit 1
98+
fi
4199
42100
- name: Destroy workspace
43101
uses: ./terraform-destroy-workspace
@@ -55,6 +113,10 @@ jobs:
55113
path: tests/terraform-cloud
56114
workspace: ${{ github.head_ref }}-2
57115
backend_config: "token=${{ secrets.TF_API_TOKEN }}"
116+
var_file: |
117+
tests/terraform-cloud/my_variable.tfvars
118+
variables: |
119+
from_variables="from_variables"
58120
59121
- name: Verify plan outputs
60122
run: |
@@ -70,12 +132,34 @@ jobs:
70132
71133
- name: Apply workspace
72134
uses: ./terraform-apply
135+
id: apply
73136
env:
74137
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
75138
with:
76139
path: tests/terraform-cloud
77140
workspace: ${{ github.head_ref }}-2
78141
backend_config: "token=${{ secrets.TF_API_TOKEN }}"
142+
var_file: |
143+
tests/terraform-cloud/my_variable.tfvars
144+
variables: |
145+
from_variables="from_variables"
146+
147+
- name: Verify apply terraform outputs
148+
run: |
149+
if [[ "${{ steps.apply.outputs.default }}" != "default" ]]; then
150+
echo "::error:: Variables not set correctly"
151+
exit 1
152+
fi
153+
154+
if [[ "${{ steps.apply.outputs.from_tfvars }}" != "from_tfvars" ]]; then
155+
echo "::error:: Variables not set correctly"
156+
exit 1
157+
fi
158+
159+
if [[ "${{ steps.apply.outputs.from_variables }}" != "from_variables" ]]; then
160+
echo "::error:: Variables not set correctly"
161+
exit 1
162+
fi
79163
80164
- name: Destroy the last workspace
81165
uses: ./terraform-destroy-workspace

‎image/actions.sh

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,32 @@ function set-plan-args() {
214214
export PLAN_ARGS
215215
}
216216

217+
function set-remote-plan-args() {
218+
PLAN_ARGS=""
219+
220+
if [[ "$INPUT_PARALLELISM" -ne 0 ]]; then
221+
PLAN_ARGS="$PLAN_ARGS -parallelism=$INPUT_PARALLELISM"
222+
fi
223+
224+
local AUTO_TFVARS_COUNTER=0
225+
226+
if [[ -n "$INPUT_VAR_FILE" ]]; then
227+
for file in $(echo "$INPUT_VAR_FILE" | tr ',' '\n'); do
228+
cp "$file" "$INPUT_PATH/zzzz-dflook-terraform-github-actions-$AUTO_TFVARS_COUNTER.auto.tfvars"
229+
AUTO_TFVARS_COUNTER=$(( AUTO_TFVARS_COUNTER + 1 ))
230+
done
231+
fi
232+
233+
if [[ -n "$INPUT_VARIABLES" ]]; then
234+
echo "$INPUT_VARIABLES" >"$STEP_TMP_DIR/variables.tfvars"
235+
cp "$STEP_TMP_DIR/variables.tfvars" "$INPUT_PATH/zzzz-dflook-terraform-github-actions-$AUTO_TFVARS_COUNTER.auto.tfvars"
236+
fi
237+
238+
debug_cmd ls -la "$INPUT_PATH"
239+
240+
export PLAN_ARGS
241+
}
242+
217243
function output() {
218244
(cd "$INPUT_PATH" && terraform output -json | convert_output)
219245
}
@@ -243,6 +269,28 @@ function write_credentials() {
243269
debug_cmd git config --list
244270
}
245271

272+
function plan() {
273+
274+
local PLAN_OUT_ARG
275+
if [[ -n "$PLAN_OUT" ]]; then
276+
PLAN_OUT_ARG="-out=$PLAN_OUT"
277+
else
278+
PLAN_OUT_ARG=""
279+
fi
280+
281+
set +e
282+
# shellcheck disable=SC2086
283+
(cd "$INPUT_PATH" && terraform plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PLAN_OUT_ARG $PLAN_ARGS) \
284+
2>"$STEP_TMP_DIR/terraform_plan.stderr" \
285+
| $TFMASK \
286+
| tee /dev/fd/3 \
287+
| compact_plan \
288+
>"$STEP_TMP_DIR/plan.txt"
289+
290+
PLAN_EXIT=${PIPESTATUS[0]}
291+
set -e
292+
}
293+
246294
# Every file written to disk should use one of these directories
247295
readonly STEP_TMP_DIR="/tmp"
248296
readonly JOB_TMP_DIR="$HOME/.dflook-terraform-github-actions"

‎image/entrypoints/apply.sh

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -23,28 +23,6 @@ fi
2323

2424
exec 3>&1
2525

26-
function plan() {
27-
28-
local PLAN_OUT_ARG
29-
if [[ -n "$PLAN_OUT" ]]; then
30-
PLAN_OUT_ARG="-out=$PLAN_OUT"
31-
else
32-
PLAN_OUT_ARG=""
33-
fi
34-
35-
set +e
36-
# shellcheck disable=SC2086
37-
(cd "$INPUT_PATH" && terraform plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PLAN_OUT_ARG $PLAN_ARGS) \
38-
2>"$STEP_TMP_DIR/terraform_plan.stderr" \
39-
| $TFMASK \
40-
| tee /dev/fd/3 \
41-
| compact_plan \
42-
>"$STEP_TMP_DIR/plan.txt"
43-
44-
PLAN_EXIT=${PIPESTATUS[0]}
45-
set -e
46-
}
47-
4826
function apply() {
4927

5028
set +e
@@ -53,6 +31,8 @@ function apply() {
5331
local APPLY_EXIT=${PIPESTATUS[0]}
5432
set -e
5533

34+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
35+
5636
if [[ $APPLY_EXIT -eq 0 ]]; then
5737
update_status "Plan applied in $(job_markdown_ref)"
5838
else
@@ -68,6 +48,7 @@ plan
6848

6949
if [[ $PLAN_EXIT -eq 1 ]]; then
7050
if grep -q "Saving a generated plan is currently not supported" "$STEP_TMP_DIR/terraform_plan.stderr"; then
51+
set-remote-plan-args
7152
PLAN_OUT=""
7253

7354
if [[ "$INPUT_AUTO_APPROVE" == "true" ]]; then
@@ -80,6 +61,7 @@ if [[ $PLAN_EXIT -eq 1 ]]; then
8061
fi
8162

8263
if [[ $PLAN_EXIT -eq 1 ]]; then
64+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
8365
cat "$STEP_TMP_DIR/terraform_plan.stderr"
8466

8567
update_status "Error applying plan in $(job_markdown_ref)"
@@ -95,18 +77,22 @@ if [[ "$INPUT_AUTO_APPROVE" == "true" || $PLAN_EXIT -eq 0 ]]; then
9577
else
9678

9779
if [[ "$GITHUB_EVENT_NAME" != "push" && "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "issue_comment" && "$GITHUB_EVENT_NAME" != "pull_request_review_comment" && "$GITHUB_EVENT_NAME" != "pull_request_target" && "$GITHUB_EVENT_NAME" != "pull_request_review" ]]; then
80+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
9881
echo "Could not fetch plan from the PR - $GITHUB_EVENT_NAME event does not relate to a pull request. You can generate and apply a plan automatically by setting the auto_approve input to 'true'"
9982
exit 1
10083
fi
10184

10285
if [[ ! -v GITHUB_TOKEN ]]; then
86+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
10387
echo "GITHUB_TOKEN environment variable must be set to get plan approval from a PR"
10488
echo "Either set the GITHUB_TOKEN environment variable or automatically approve by setting the auto_approve input to 'true'"
10589
echo "See https://github.com/dflook/terraform-github-actions/ for details."
10690
exit 1
10791
fi
10892

10993
if ! github_pr_comment get "$STEP_TMP_DIR/approved-plan.txt" 2>"$STEP_TMP_DIR/github_pr_comment.stderr"; then
94+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
95+
11096
debug_file "$STEP_TMP_DIR/github_pr_comment.stderr"
11197
echo "Plan not found on PR"
11298
echo "Generate the plan first using the dflook/terraform-plan action. Alternatively set the auto_approve input to 'true'"
@@ -119,6 +105,8 @@ else
119105
if plan_cmp "$STEP_TMP_DIR/plan.txt" "$STEP_TMP_DIR/approved-plan.txt"; then
120106
apply
121107
else
108+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
109+
122110
echo "Not applying the plan - it has changed from the plan on the PR"
123111
echo "The plan on the PR must be up to date. Alternatively, set the auto_approve input to 'true' to apply outdated plans"
124112
update_status "Plan not applied in $(job_markdown_ref) (Plan has changed)"

‎image/entrypoints/check.sh

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,27 @@ init-backend
99
select-workspace
1010
set-plan-args
1111

12-
set +e
13-
# shellcheck disable=SC2086
14-
(cd "$INPUT_PATH" && terraform plan -input=false -detailed-exitcode -lock-timeout=300s $PLAN_ARGS) \
15-
| $TFMASK
12+
PLAN_OUT="$STEP_TMP_DIR/plan.out"
1613

17-
readonly TF_EXIT=${PIPESTATUS[0]}
18-
set -e
14+
exec 3>&1
1915

20-
if [[ $TF_EXIT -eq 1 ]]; then
16+
plan
17+
18+
if [[ $PLAN_EXIT -eq 1 ]]; then
19+
if grep -q "Saving a generated plan is currently not supported" "$STEP_TMP_DIR/terraform_plan.stderr"; then
20+
# This terraform module is using the remote backend, which is deficient.
21+
set-remote-plan-args
22+
PLAN_OUT=""
23+
plan
24+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
25+
fi
26+
fi
27+
28+
if [[ $PLAN_EXIT -eq 1 ]]; then
2129
echo "Error running terraform"
2230
exit 1
2331

24-
elif [[ $TF_EXIT -eq 2 ]]; then
32+
elif [[ $PLAN_EXIT -eq 2 ]]; then
2533

2634
echo "Changes detected!"
2735
set_output failure-reason changes-to-apply

‎image/entrypoints/plan.sh

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,36 +13,17 @@ PLAN_OUT="$STEP_TMP_DIR/plan.out"
1313

1414
exec 3>&1
1515

16-
function plan() {
17-
18-
local PLAN_OUT_ARG
19-
if [[ -n "$PLAN_OUT" ]]; then
20-
PLAN_OUT_ARG="-out=$PLAN_OUT"
21-
else
22-
PLAN_OUT_ARG=""
23-
fi
24-
25-
set +e
26-
# shellcheck disable=SC2086
27-
(cd "$INPUT_PATH" && terraform plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PLAN_OUT_ARG $PLAN_ARGS) \
28-
2>"$STEP_TMP_DIR/terraform_plan.stderr" \
29-
| $TFMASK \
30-
| tee /dev/fd/3 \
31-
| compact_plan \
32-
>"$STEP_TMP_DIR/plan.txt"
33-
34-
PLAN_EXIT=${PIPESTATUS[0]}
35-
set -e
36-
}
37-
3816
### Generate a plan
3917

4018
plan
4119

4220
if [[ $PLAN_EXIT -eq 1 ]]; then
4321
if grep -q "Saving a generated plan is currently not supported" "$STEP_TMP_DIR/terraform_plan.stderr"; then
22+
# This terraform module is using the remote backend, which is deficient.
23+
set-remote-plan-args
4424
PLAN_OUT=""
4525
plan
26+
find "$INPUT_PATH" -regex '.*/zzzz-dflook-terraform-github-actions-[0-9]+\.auto\.tfvars' -delete
4627
fi
4728
fi
4829

0 commit comments

Comments
 (0)