Skip to content

Latest commit

 

History

History
88 lines (77 loc) · 3.97 KB

README.md

File metadata and controls

88 lines (77 loc) · 3.97 KB
Raw

Terraform Plan GitHub Action

Runs terraform plan on your project and posts a comment with the changes on a Pull Request (PR). It runs the following commands:

terraform init
terraform validate
terraform fmt --check
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan

This action does not install Terraform or Terragrunt, but can be installed using Terraform tools setup action. You can see how it's used in the pr-test.yaml workflow.

Settings

Use the following to control the action:

Setting Description Default
allow-failure Allow the action to fail false
comment Add comment with changes to the PR true
comment-delete Delete previous comments made by the bot on the PR false
comment-title The title to give the PR comment Plan changes
conftest-character-limit Character limit for Conftest output 2000
conftest-checks Location of custom conftest check definitions git::https://github.com/cds-snc/opa_checks.git//aws_terraform
directory Directory with the *.tf files to validate .
github-token GitHub Token used to add comment to PR (required to add comments).
plan-character-limit Character limit for Terraform plan output 30000
terraform-init Custom Terraform init args
terragrunt Use Terragrunt instead of Terraform false
skip-conftest Skip the Conftest step false
skip-fmt Skip the Terraform format check false
skip-plan Skip the Terraform plan for projects without a remote state false

Examples

# Setup Terraform, Terragrunt, and Conftest
- name: Setup terraform tools
  uses: cds-snc/terraform-tools-setup@v1

# Run Terraform plan and add a comment with changes on the PR
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}

# Use Terragrunt, allow failure and set a custom PR comment title
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    allow-failure: true
    comment-title: Custom comment title
    github-token: ${{ secrets.GITHUB_TOKEN }}
    terragrunt: true

# Run on a sub project folder, deleting previous PR comments made by the action
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    directory: ./infra
    comment-delete: true
    github-token: ${{ secrets.GITHUB_TOKEN }}

# Run Terraform plan with no PR comment
# Plan will still availabe in the workflow logs
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    add-comment: false

# Run Terraform plan custom Terraform init args
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    terraform-init: |
      -backend-config="bucket=your-state-bucket-name"
      -backend-config="region=ca-central-1"

Contributing

To setup your local dev environment:

npm install
npm run prepare

Husky provides a pre-commit hook that builds the dist/index.js used by the action. To test locally, nektos/act works well.

Policy

Open Policy Agent is used to check the terraform plan for changes. Policies are written in Rego and then compiled into a WebAssembly module using npm run policy.