|
1 | 1 | # Terraform GitHub Actions |
2 | | -These official Terraform GitHub Actions allow you to run `terraform fmt`, `validate`, `plan` and `apply` on your pull requests to help you review, validate and apply Terraform changes. |
3 | 2 |
|
4 | | -## Getting Started |
5 | | -To get started, check out our documentation: [https://www.terraform.io/docs/github-actions/getting-started/](https://www.terraform.io/docs/github-actions/getting-started/). |
| 3 | +Terraform GitHub Actions allow you to execute Terraform commands within GitHub Actions. |
6 | 4 |
|
7 | | -## Actions |
| 5 | +The output of the actions can be viewed from the Actions tab in the main repository view. If the actions are executed on a pull request event, a comment may be posted on the pull request. |
8 | 6 |
|
9 | | -### Fmt Action |
10 | | -Runs `terraform fmt` and comments back if any files are not formatted correctly. |
11 | | -<img src="./assets/fmt.png" alt="Terraform Fmt Action" width="80%" /> |
| 7 | +Terraform GitHub Actions are a single GitHub Action that executes different Terraform subcommands depending on the content of the GitHub Actions YAML file. |
12 | 8 |
|
13 | | -### Validate Action |
14 | | -Runs `terraform validate` and comments back on error. |
15 | | -<img src="./assets/validate.png" alt="Terraform Validate Action" width="80%" /> |
| 9 | +## Success Criteria |
16 | 10 |
|
17 | | -### Plan Action |
18 | | -Runs `terraform plan` and comments back with the output. |
19 | | -<img src="./assets/plan.png" alt="Terraform Plan Action" width="80%" /> |
| 11 | +An exit code of `0` is considered a successful execution. |
20 | 12 |
|
21 | | -### Apply Action |
22 | | -Runs `terraform apply` and comments back with the output. |
23 | | -<img src="./assets/apply.png" alt="Terraform Apply Action" width="80%" /> |
| 13 | +## Usage |
| 14 | + |
| 15 | +The most common workflow is to run `terraform fmt`, `terraform init`, `terraform validate`, and `terraform plan` on all of the Terraform files in the root of the repository when a pull request is opened or updated. A comment will be posted to the pull request depending on the output of the Terraform subcommand being executed. This workflow can be configured by adding the following content to the GitHub Actions workflow YAML file. |
| 16 | + |
| 17 | +```yaml |
| 18 | +name: 'Terraform GitHub Actions' |
| 19 | +on: |
| 20 | + - pull_request |
| 21 | +jobs: |
| 22 | + terraform: |
| 23 | + name: 'Terraform' |
| 24 | + runs-on: ubuntu-latest |
| 25 | + steps: |
| 26 | + - name: 'Checkout' |
| 27 | + uses: actions/checkout@master |
| 28 | + - name: 'Terraform Format' |
| 29 | + uses: hashicorp/terraform-github-actions@master |
| 30 | + with: |
| 31 | + tf_actions_version: 0.12.13 |
| 32 | + tf_actions_subcommand: 'fmt' |
| 33 | + tf_actions_working_dir: '.' |
| 34 | + tf_actions_comment: true |
| 35 | + env: |
| 36 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 37 | + - name: 'Terraform Init' |
| 38 | + uses: hashicorp/terraform-github-actions@master |
| 39 | + with: |
| 40 | + tf_actions_version: 0.12.13 |
| 41 | + tf_actions_subcommand: 'init' |
| 42 | + tf_actions_working_dir: '.' |
| 43 | + tf_actions_comment: true |
| 44 | + env: |
| 45 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 46 | + - name: 'Terraform Validate' |
| 47 | + uses: hashicorp/terraform-github-actions@master |
| 48 | + with: |
| 49 | + tf_actions_version: 0.12.13 |
| 50 | + tf_actions_subcommand: 'validate' |
| 51 | + tf_actions_working_dir: '.' |
| 52 | + tf_actions_comment: true |
| 53 | + env: |
| 54 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 55 | + - name: 'Terraform Plan' |
| 56 | + uses: hashicorp/terraform-github-actions@master |
| 57 | + with: |
| 58 | + tf_actions_version: 0.12.13 |
| 59 | + tf_actions_subcommand: 'plan' |
| 60 | + tf_actions_working_dir: '.' |
| 61 | + tf_actions_comment: true |
| 62 | + env: |
| 63 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 64 | +``` |
| 65 | +
|
| 66 | +This was a simplified example showing the basic features of these Terraform GitHub Actions. Please refer to the examples within the `examples` directory for other common workflows. |
| 67 | + |
| 68 | +## Inputs |
| 69 | + |
| 70 | +Inputs configure Terraform GitHub Actions to perform different actions. |
| 71 | + |
| 72 | +* `tf_actions_version` - (Required) The Terraform version to install and execute. |
| 73 | +* `tf_actions_subcommand` - (Required) The Terraform subcommand to execute. Valid values are `fmt`, `init`, `validate`, `plan`, and `apply`. |
| 74 | +* `tf_actions_working_dir` - (Optional) The working directory to change into before executing Terraform subcommands. Defaults to `.` which means use the root of the GitHub repository. |
| 75 | +* `tf_actions_comment` - (Optional) Whether or not to comment on GitHub pull requests. Defaults to `true`. |
| 76 | + |
| 77 | +## Outputs |
| 78 | + |
| 79 | +Outputs are used to pass information to subsequent GitHub Actions steps. |
| 80 | + |
| 81 | +* `tf_actions_plan_has_changes` - Whether or not the Terraform plan contained changes. |
| 82 | +* `tf_actions_output` - The Terraform outputs in JSON format. |
| 83 | + |
| 84 | +## Secrets |
| 85 | + |
| 86 | +Secrets are similar to inputs except that they are encrypted and only used by GitHub Actions. It's a convenient way to keep sensitive data out of the GitHub Actions workflow YAML file. |
| 87 | + |
| 88 | +* `GITHUB_TOKEN` - (Optional) The GitHub API token used to post comments to pull requests. Not required if the `tf_actions_comment` input is set to `false`. |
| 89 | + |
| 90 | +Other secrets may be needed to authenticate with Terraform backends and providers. |
| 91 | + |
| 92 | +**WARNING:** These secrets could be exposed if the action is executed on a malicious Terraform file. To avoid this, it is recommended not to use these Terraform GitHub Actions on repositories where untrusted users can submit pull requests. |
| 93 | + |
| 94 | +## Environment Variables |
| 95 | + |
| 96 | +Environment variables are exported in the environment where the Terraform GitHub Actions are executed. This allows a user to modify the behavior of certain GitHub Actions. |
| 97 | + |
| 98 | +The usual [Terraform environment variables](https://www.terraform.io/docs/commands/environment-variables.html) are supported. Here are a few of the more commonly used environment variables. |
| 99 | + |
| 100 | +* [`TF_LOG`](https://www.terraform.io/docs/commands/environment-variables.html#tf_log) |
| 101 | +* [`TF_VAR_name`](https://www.terraform.io/docs/commands/environment-variables.html#tf_var_name) |
| 102 | +* [`TF_CLI_ARGS`](https://www.terraform.io/docs/commands/environment-variables.html#tf_cli_args-and-tf_cli_args_name) |
| 103 | +* [`TF_CLI_ARGS_name`](https://www.terraform.io/docs/commands/environment-variables.html#tf_cli_args-and-tf_cli_args_name) |
| 104 | +* `TF_WORKSPACE` |
| 105 | + |
| 106 | +Other environment variables may be configured to pass data into Terraform. If the data is sensitive, consider using [secrets](#secrets) instead. |
0 commit comments