You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+19-2Lines changed: 19 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,7 @@ These actions can be used to easily perform [Terraform](https://www.terraform.io
8
8
Currently, there is just experimental support for OpenTofu, see [here](https://github.com/dflook/terraform-github-actions/blob/main/CHANGELOG.md#1370---2023-10-29)
9
9
10
10
## Actions
11
+
11
12
See the documentation for the available actions:
12
13
13
14
| Terraform | OpenTofu |
@@ -28,6 +29,7 @@ See the documentation for the available actions:
These actions can be added as steps to your own workflow files.
32
34
GitHub reads workflow files from `.github/workflows/` within your repository.
33
35
See the [Workflow documentation](https://docs.github.com/en/actions/configuring-and-managing-workflows/configuring-a-workflow#about-workflows) for details on writing workflows.
@@ -42,15 +44,17 @@ Fortunately, GitHub has a well established method for requiring human reviews of
42
44
We can use PRs to safely plan and apply infrastructure changes.
<img src="terraform-apply/planapply.gif" width="960" alt="A video showing a PR being created, a plan being generated, the plan being reviewed, and the plan being applied.">
46
48
</p>
47
49
48
50
You can make GitHub enforce this using branch protection, see the [dflook/terraform-apply](terraform-apply) action for details.
49
51
50
52
In this example we use two workflows:
51
53
52
54
#### plan.yaml
55
+
53
56
This workflow runs on changes to a PR branch. It generates a Terraform plan and attaches it to the PR as a comment.
57
+
54
58
```yaml
55
59
name: Create terraform plan
56
60
@@ -77,7 +81,9 @@ jobs:
77
81
```
78
82
79
83
#### apply.yaml
84
+
80
85
This workflow runs when the PR is merged into the main branch, and applies the planned changes.
86
+
81
87
```yaml
82
88
name: Apply terraform plan
83
89
@@ -107,16 +113,18 @@ jobs:
107
113
```
108
114
109
115
### Linting
116
+
110
117
This workflow runs on every push to non-main branches and checks the terraform configuration is valid.
111
118
For extra strictness, we check the files are in the canonical format.
<img src="terraform-validate/validate.png" width="1000" alt="A screenshot showing the output of the terraform validate action.">
115
122
</p>
116
123
117
124
This can be used to check for correctness before merging.
118
125
119
126
#### lint.yaml
127
+
120
128
```yaml
121
129
name: Lint
122
130
@@ -159,6 +167,7 @@ This can be used to detect manual or misapplied changes before they become a pro
159
167
If there are any unexpected changes, the workflow will fail.
160
168
161
169
#### drift.yaml
170
+
162
171
```yaml
163
172
name: Check for infrastructure drift
164
173
@@ -181,12 +190,14 @@ jobs:
181
190
```
182
191
183
192
### Scheduled infrastructure updates
193
+
184
194
There may be times when you expect Terraform to plan updates without any changes to your configuration files.
185
195
Your configuration could be consuming secrets from elsewhere, or renewing certificates every few months.
186
196
187
197
This example workflow runs every morning and applies any outstanding changes to those specific resources.
188
198
189
199
#### rotate-certs.yaml
200
+
190
201
```yaml
191
202
name: Rotate TLS certificates
192
203
@@ -213,9 +224,11 @@ jobs:
213
224
```
214
225
215
226
### Automatically fixing formatting
227
+
216
228
Perhaps you don't want to spend engineer time making formatting changes. This workflow will automatically create or update a PR that fixes any formatting issues.
217
229
218
230
#### fmt.yaml
231
+
219
232
```yaml
220
233
name: Check terraform file formatting
221
234
@@ -247,12 +260,14 @@ jobs:
247
260
```
248
261
249
262
### Ephemeral test environments
263
+
250
264
Testing of software changes often requires some supporting infrastructure, like databases, DNS records, compute environments etc.
251
265
We can use these actions to create dedicated resources for each PR which is used to run tests.
252
266
253
267
There are two workflows:
254
268
255
269
#### integration-test.yaml
270
+
256
271
This workflow runs with every change to a PR.
257
272
258
273
It deploys the testing infrastructure using a Terraform workspace dedicated to this branch, then runs integration tests against the new infrastructure.
@@ -290,7 +305,9 @@ jobs:
290
305
```
291
306
292
307
#### integration-test-cleanup.yaml
308
+
293
309
This workflow runs when a PR is closed and destroys any testing infrastructure that is no longer needed.
Copy file name to clipboardExpand all lines: docs-gen/actions/apply.py
+14-11Lines changed: 14 additions & 11 deletions
Original file line number
Diff line number
Diff line change
@@ -41,10 +41,12 @@
41
41
You can instead set `auto_approve: true` which will generate a plan and apply it immediately, without looking for a plan attached to a PR.
42
42
43
43
## Demo
44
-
This a demo of the process for apply a $ProductName change using the [`dflook/$ToolName-plan`](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-plan) and [`dflook/$ToolName-apply`](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-apply) actions.
44
+
45
+
This a demo of the process for apply a $ProductName change using the [`dflook/$ToolName-plan`](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-plan)
46
+
and [`dflook/$ToolName-apply`](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-apply) actions.
45
47
46
48
<p align="center">
47
-
<img src="planapply.gif" width="1000">
49
+
<img src="planapply.gif" width="1000" alt="An example of the plan and apply actions">
48
50
</p>
49
51
50
52
## GitHub
@@ -93,7 +95,7 @@
93
95
94
96
- `apply-failed` - The Terraform apply operation failed.
95
97
- `plan-changed` - The approved plan is no longer accurate, so the apply will not be attempted.
96
-
- `state-locked` - The Terraform state lock could not be obtained because it was already locked.
98
+
- `state-locked` - The Terraform state lock could not be obtained because it was already locked.
97
99
98
100
If the job fails for any other reason this will not be set.
99
101
This can be used with the Actions expression syntax to conditionally run steps.
@@ -105,7 +107,7 @@
105
107
],
106
108
environment_variables=[
107
109
dataclasses.replace(GITHUB_TOKEN, description='''
108
-
The GitHub authorization token to use to fetch an approved plan from a PR.
110
+
The GitHub authorization token to use to fetch an approved plan from a PR.
109
111
This must belong to the same user/app as the token used by the [$ToolName-plan](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-plan) action.
110
112
'''+GITHUB_TOKEN.description),
111
113
TERRAFORM_ACTIONS_GITHUB_TOKEN,
@@ -120,13 +122,13 @@
120
122
121
123
When applying a plan from a PR comment (`auto_approve` is the default of `false`), the workflow can be triggered by the following events:
122
124
123
-
- pull_request
124
-
- pull_request_review_comment
125
-
- pull_request_target
126
-
- pull_request_review
127
-
- issue_comment, if the comment is on a PR (see below)
128
-
- push, if the pushed commit came from a PR (see below)
129
-
- repository_dispatch, if the client payload includes the pull_request url (see below)
125
+
* pull_request
126
+
* pull_request_review_comment
127
+
* pull_request_target
128
+
* pull_request_review
129
+
* issue_comment, if the comment is on a PR (see below)
130
+
* push, if the pushed commit came from a PR (see below)
131
+
* repository_dispatch, if the client payload includes the pull_request url (see below)
130
132
131
133
When `auto_approve` is set to `true`, the workflow can be triggered by any event.
132
134
@@ -165,6 +167,7 @@
165
167
This event can be used to trigger a workflow from another workflow. The client payload must include the pull_request api url of where the plan PR comment can be found.
Copy file name to clipboardExpand all lines: docs-gen/actions/destroy.py
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@
22
22
'''
23
23
:warning: This action uses the `$ToolName destroy` command to immediately destroy all resources in a $ProductName workspace.
24
24
25
-
To generate a plan that can be reviewed you can instead use the [dflook/$ToolName-plan](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-plan)
25
+
To generate a plan that can be reviewed you can instead use the [dflook/$ToolName-plan](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-plan)
26
26
and [dflook/$ToolName-apply](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-plan) actions with the `destroy` input set to `true`.
27
27
''',
28
28
meta_description='Destroys all resources in a $ProductName workspace',
@@ -41,7 +41,7 @@
41
41
When the job outcome is `failure`, this output may be set. The value may be one of:
42
42
43
43
- `destroy-failed` - The $ProductName destroy operation failed.
44
-
- `state-locked` - The $ProductName state lock could not be obtained because it was already locked.
44
+
- `state-locked` - The $ProductName state lock could not be obtained because it was already locked.
45
45
46
46
If the job fails for any other reason this will not be set.
47
47
This can be used with the Actions expression syntax to conditionally run a steps.
List of $ProductName backend config values, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
24
+
List of $ProductName backend config values, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
25
25
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
List of $ProductName backend config files to use, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
28
+
List of $ProductName backend config files to use, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
29
29
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
30
30
Paths should be relative to the GitHub Actions workspace
List of $ProductName backend config values, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
28
+
List of $ProductName backend config values, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
29
29
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
List of $ProductName backend config files to use, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
32
+
List of $ProductName backend config files to use, one per line. This is used for discovering the $ProductName version to use, if the version is not otherwise specified.
33
33
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
34
34
Paths should be relative to the GitHub Actions workspace
Copy file name to clipboardExpand all lines: docs-gen/actions/plan.py
+14-12Lines changed: 14 additions & 12 deletions
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@
36
36
If the triggering event relates to a PR it will add a comment on the PR containing the generated plan.
37
37
38
38
<p align="center">
39
-
<img src="plan.png" width="600">
39
+
<img src="plan.png" width="600" alt="An example of a PR comment created by the action">
40
40
</p>
41
41
42
42
The `GITHUB_TOKEN` environment variable must be set for the PR comment to be added.
@@ -87,13 +87,13 @@
87
87
88
88
When adding the plan to a PR comment (`add_github_comment` is not `false`), the workflow can be triggered by the following events:
89
89
90
-
- pull_request
91
-
- pull_request_review_comment
92
-
- pull_request_target
93
-
- pull_request_review
94
-
- issue_comment, if the comment is on a PR (see below)
95
-
- push, if the pushed commit came from a PR (see below)
96
-
- repository_dispatch, if the client payload includes the pull_request url (see below)
90
+
* pull_request
91
+
* pull_request_review_comment
92
+
* pull_request_target
93
+
* pull_request_review
94
+
* issue_comment, if the comment is on a PR (see below)
95
+
* push, if the pushed commit came from a PR (see below)
96
+
* repository_dispatch, if the client payload includes the pull_request url (see below)
97
97
98
98
When `add_github_comment` is set to `false`, the workflow can be triggered by any event.
99
99
@@ -132,6 +132,7 @@
132
132
This event can be used to trigger a workflow from another workflow. The client payload must include the pull_request api url of where the plan PR comment should be added.
133
133
134
134
A minimal example payload looks like:
135
+
135
136
```json
136
137
{
137
138
"pull_request": {
@@ -175,10 +176,11 @@
175
176
### A full example of inputs
176
177
177
178
This example workflow demonstrates most of the available inputs:
178
-
- The environment variables are set at the workflow level.
179
-
- The PR comment will be labelled `production`, and the plan will use the `prod` workspace.
180
-
- Variables are read from `env/prod.tfvars`, with `turbo_mode` overridden to `true`.
181
-
- The backend config is taken from `env/prod.backend`, and the token is set from a secret.
179
+
180
+
* The environment variables are set at the workflow level.
181
+
* The PR comment will be labelled `production`, and the plan will use the `prod` workspace.
182
+
* Variables are read from `env/prod.tfvars`, with `turbo_mode` overridden to `true`.
183
+
* The backend config is taken from `env/prod.backend`, and the token is set from a secret.
Copy file name to clipboardExpand all lines: docs-gen/actions/validate.py
+4-4Lines changed: 4 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@
13
13
fromoutputs.failure_reasonimportfailure_reason
14
14
15
15
backend_reason='''
16
-
This is used for discovering the $ProductName version to use, if not otherwise specified.
16
+
This is used for discovering the $ProductName version to use, if not otherwise specified.
17
17
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
18
18
'''.strip()
19
19
@@ -26,7 +26,7 @@
26
26
Failing GitHub checks will be added for any problems found.
27
27
28
28
<p align="center">
29
-
<img src="validate.png" width="1000">
29
+
<img src="validate.png" width="1000" alt="An example of a failed validation check">
30
30
</p>
31
31
32
32
If the $ProductName configuration is not valid, the build is failed.
@@ -37,8 +37,8 @@
37
37
dataclasses.replace(workspace, description='''
38
38
$ProductName workspace to use for the `terraform.workspace` value while validating. Note that for remote operations in a cloud backend, this is always `default`.
39
39
40
-
Also used for discovering the $ProductName version to use, if not otherwise specified.
41
-
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
40
+
Also used for discovering the $ProductName version to use, if not otherwise specified.
41
+
See [dflook/$ToolName-version](https://github.com/dflook/terraform-github-actions/tree/main/$ToolName-version#$ToolName-version-action) for details.
0 commit comments