#358: Prefer standard TERMINUS_MACHINE_TOKEN variable name for Pantheon tasks, actions and workflows (#1186)

Author: rabbitlair

.github/workflows/TestPantheon.yml

@@ -33,7 +33,7 @@ jobs:
 
       - uses: ./scaffold/github/actions/pantheon/setup-terminus
         with:
-          pantheon-token: ${{ secrets.PANTHEON_TERMINUS_TOKEN }}
+          terminus-token: ${{ secrets.PANTHEON_TERMINUS_TOKEN }}
 
       - name: Get site Git URL and configure SSH host
         id: gitinfo

README.md

@@ -729,7 +729,7 @@ To enable deployment of Pantheon Review Apps (Multidev environments per pull req
     - `PANTHEON_CLONE_FROM` (optional) The environment to clone from when creating multidev sites. Defaults to 'live'
     - `PANTHEON_SKIP_WIPE_MULTIDEV` (optional) Set to 'true' to skip wiping the multidev environment on each push, preserving its database state. Defaults to 'false'
 - Add the following [secrets to your GitHub repository](https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization#adding-secrets-for-a-repository):
-    - `PANTHEON_TERMINUS_TOKEN` See https://pantheon.io/docs/terminus/install#machine-token
+    - `TERMINUS_MACHINE_TOKEN` See https://pantheon.io/docs/terminus/install#machine-token (`PANTHEON_TERMINUS_TOKEN` is also accepted for backwards compatibility)
     - `SSH_PRIVATE_KEY` A private key of a user which can push to Pantheon
     - `SSH_KNOWN_HOSTS` The result of running `ssh-keyscan -H -p 2222 codeserver.dev.$PANTHEON_SITE_ID.drush.in`
     - `PANTHEON_REVIEW_USERNAME` (optional) A username for HTTP basic auth
@@ -885,7 +885,7 @@ To enable deployment of Pantheon Review Apps (Multidev environments per merge re
   - `PANTHEON_SITE_NAME` The canonical site name in Pantheon
   - `PANTHEON_SITE_ID` The Pantheon site UUID, used to construct the SSH remote URL
   - `PANTHEON_GIT_REMOTE` The Pantheon git remote URL e.g. `ssh://codeserver.dev.$PANTHEON_SITE_ID@codeserver.dev.$PANTHEON_SITE_ID.drush.in:2222/~/repository.git`
-  - `PANTHEON_TERMINUS_TOKEN` See https://pantheon.io/docs/terminus/install#machine-token (enable the _Mask variable_ checkbox)
+  - `TERMINUS_MACHINE_TOKEN` See https://pantheon.io/docs/terminus/install#machine-token (enable the _Mask variable_ checkbox). `PANTHEON_TERMINUS_TOKEN` is also accepted for backwards compatibility.
   - `SSH_PRIVATE_KEY` A private key of a user which can push to Pantheon (enable the _Mask variable_ checkbox)
   - `SSH_KNOWN_HOSTS` The result of running `ssh-keyscan -H -p 2222 codeserver.dev.$PANTHEON_SITE_ID.drush.in` (enable the _Mask variable_ checkbox)
   - `GIT_EMAIL` Email address to use for git commits
@@ -945,7 +945,7 @@ Additionally, Pantheon integration can be added:
 }
 ```
 
-This will install [Terminus](https://docs.pantheon.io/terminus) in the Tugboat environment. Add `PANTHEON_TOKEN` as a [Tugboat environment variable](https://docs.tugboatqa.com/setting-up-tugboat/select-repo-settings/#set-environment-variables) and set `PANTHEON_SITE_ID` in your `Taskfile.yml` vars. Then add a `sync:tugboat` task to fetch the database during Tugboat preview builds:
+This will install [Terminus](https://docs.pantheon.io/terminus) in the Tugboat environment. Add `TERMINUS_MACHINE_TOKEN` as a [Tugboat environment variable](https://docs.tugboatqa.com/setting-up-tugboat/select-repo-settings/#set-environment-variables) (`PANTHEON_TERMINUS_TOKEN` and `PANTHEON_TOKEN` are also accepted for backwards compatibility), and set `PANTHEON_SITE_ID` in your `Taskfile.yml` vars. Then add a `sync:tugboat` task to fetch the database during Tugboat preview builds:
 
 ```
   sync:tugboat:

scaffold/github/actions/pantheon/setup-terminus/action.yml

@@ -1,7 +1,7 @@
 name: 'Prepare Pantheon Environment'
 description: 'Sets up Terminus and authorises with Pantheon'
 inputs:
-  pantheon-token:
+  terminus-token:
     description: "Pantheon Terminus Token"
     required: true
   terminus-plugins:
@@ -11,7 +11,7 @@ runs:
   using: "composite"
   steps:
     - env:
-        INPUT_PANTHEON_TOKEN: ${{ inputs.pantheon-token }}
+        INPUT_TERMINUS_TOKEN: ${{ inputs.terminus-token }}
         INPUT_TERMINUS_PLUGINS: ${{ inputs.terminus-plugins }}
       run: |
         echo -e "Host *.drush.in\n    StrictHostKeyChecking no\n    HostkeyAlgorithms +ssh-rsa\n    PubkeyAcceptedAlgorithms +ssh-rsa" >> ~/.ssh/config
@@ -20,5 +20,5 @@ runs:
         chmod +x ~/terminus/terminus
         ln -s ~/terminus/terminus /usr/local/bin/terminus
         echo "$INPUT_TERMINUS_PLUGINS" | while read -d, plugin || [[ -n $plugin ]]; do terminus self:plugin:install $plugin; done
-        terminus auth:login --machine-token="$INPUT_PANTHEON_TOKEN"
+        terminus auth:login --machine-token="$INPUT_TERMINUS_TOKEN"
       shell: bash

scaffold/github/workflows/PantheonReviewApps.yml

@@ -52,7 +52,7 @@ jobs:
 
       - uses: ./.github/actions/drainpipe/pantheon/setup-terminus
         with:
-          pantheon-token: ${{ secrets.PANTHEON_TERMINUS_TOKEN }}
+          terminus-token: ${{ secrets.TERMINUS_MACHINE_TOKEN || secrets.PANTHEON_TERMINUS_TOKEN }}
           terminus-plugins: ${{ vars.TERMINUS_PLUGINS || secrets.TERMINUS_PLUGINS }}
 
       - uses: php-actions/composer@8a65f0d3c6a1d17ca4800491a40b5756a4c164f3 # v6.1.2
@@ -69,7 +69,7 @@ jobs:
         uses: ./.github/actions/drainpipe/pantheon/review
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          terminus-token: ${{ secrets.PANTHEON_TERMINUS_TOKEN }}
+          terminus-token: ${{ secrets.TERMINUS_MACHINE_TOKEN || secrets.PANTHEON_TERMINUS_TOKEN }}
           commit-message: ${{ github.sha }}
           site-name: ${{ vars.PANTHEON_SITE_NAME || secrets.PANTHEON_SITE_NAME }}
           lock-username: ${{ secrets.PANTHEON_REVIEW_USERNAME }}

scaffold/github/workflows/PantheonReviewAppsDDEV.yml

@@ -52,7 +52,7 @@ jobs:
         uses: ./.github/actions/drainpipe/pantheon/review
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          terminus-token: ${{ secrets.PANTHEON_TERMINUS_TOKEN }}
+          terminus-token: ${{ secrets.TERMINUS_MACHINE_TOKEN || secrets.PANTHEON_TERMINUS_TOKEN }}
           commit-message: ${{ github.sha }}
           site-name: ${{ vars.PANTHEON_SITE_NAME || secrets.PANTHEON_SITE_NAME }}
           lock-username: ${{ secrets.PANTHEON_REVIEW_USERNAME }}

scaffold/gitlab/Pantheon.gitlab-ci.yml

@@ -8,4 +8,14 @@
     - chmod +x ~/terminus/terminus
     - ln -s ~/terminus/terminus /usr/local/bin/terminus
     - echo "$TERMINUS_PLUGINS" | while read -d, plugin || [[ -n $plugin ]]; do terminus self:plugin:install $plugin; done
-    - terminus auth:login --machine-token="$PANTHEON_TERMINUS_TOKEN"
+    - |
+      if [ -n "$TERMINUS_MACHINE_TOKEN" ]; then
+        _PANTHEON_AUTH_TOKEN="$TERMINUS_MACHINE_TOKEN"
+      elif [ -n "$PANTHEON_TERMINUS_TOKEN" ]; then
+        echo "WARNING: PANTHEON_TERMINUS_TOKEN is deprecated. Please use TERMINUS_MACHINE_TOKEN instead."
+        _PANTHEON_AUTH_TOKEN="$PANTHEON_TERMINUS_TOKEN"
+      else
+        echo "ERROR: No Pantheon token found. Set TERMINUS_MACHINE_TOKEN as a CI/CD variable."
+        exit 1
+      fi
+      terminus auth:login --machine-token="$_PANTHEON_AUTH_TOKEN"

tasks/pantheon.yml

@@ -5,10 +5,22 @@ tasks:
     desc: "Authenticates with Pantheon"
     silent: true
     cmds:
-      - if [ -z "$PANTHEON_TOKEN" ]; then echo "❌ PANTHEON_TOKEN is not set. Add it to ~/.ddev/global_config.yaml (web-environment) or your project .env file."; exit 1; fi
-      - echo "⚡ Authorizing with Pantheon..."
-      - terminus auth:login --machine-token="$PANTHEON_TOKEN" >/dev/null 2>&1 || { echo "❌ Authentication failed. Check PANTHEON_TOKEN in ~/.ddev/global_config.yaml or your project .env file."; exit 1; }
-      - echo "✅ Authentication successful."
+      - |
+        if [ -n "$TERMINUS_MACHINE_TOKEN" ]; then
+          _PANTHEON_AUTH_TOKEN="$TERMINUS_MACHINE_TOKEN"
+        elif [ -n "$PANTHEON_TERMINUS_TOKEN" ]; then
+          echo "⚠️  PANTHEON_TERMINUS_TOKEN is deprecated. Please use TERMINUS_MACHINE_TOKEN instead."
+          _PANTHEON_AUTH_TOKEN="$PANTHEON_TERMINUS_TOKEN"
+        elif [ -n "$PANTHEON_TOKEN" ]; then
+          echo "⚠️  PANTHEON_TOKEN is deprecated. Please use TERMINUS_MACHINE_TOKEN instead."
+          _PANTHEON_AUTH_TOKEN="$PANTHEON_TOKEN"
+        else
+          echo "❌ No Pantheon token found. Set TERMINUS_MACHINE_TOKEN in ~/.ddev/global_config.yaml (web-environment) or your project .env file."
+          exit 1
+        fi
+        echo "⚡ Authorizing with Pantheon..."
+        terminus auth:login --machine-token="$_PANTHEON_AUTH_TOKEN" >/dev/null 2>&1 || { echo "❌ Authentication failed. Check your Pantheon token in ~/.ddev/global_config.yaml or your project .env file."; exit 1; }
+        echo "✅ Authentication successful."
 
   fetch-db:
     desc: "Fetches a database from Pantheon"