Skip to content

Commit b3d1122

Browse files
rdharrdhar
authored
docs: plan-file download and tflint workflow examples (#363)
* expand command input description Signed-off-by: Rishav Dhar <[email protected]> * enforce command input for initial steps Signed-off-by: Rishav Dhar <[email protected]> * as above Signed-off-by: Rishav Dhar <[email protected]> * limit tests Signed-off-by: Rishav Dhar <[email protected]> * use placeholder hostname for gh cli Signed-off-by: Rishav Dhar <[email protected]> * inputs.command description wording Signed-off-by: Rishav Dhar <[email protected]> * test init only Signed-off-by: Rishav Dhar <[email protected]> * empty command input Signed-off-by: Rishav Dhar <[email protected]> * comment format and validate inputs as well Signed-off-by: Rishav Dhar <[email protected]> * fallback for empty command input Signed-off-by: Rishav Dhar <[email protected]> * add fallback for tf.console.txt Signed-off-by: Rishav Dhar <[email protected]> * change fallback to touch empty file instead of passing default true value Signed-off-by: Rishav Dhar <[email protected]> * revert fallback value and default values in place of selective command inputs Signed-off-by: Rishav Dhar <[email protected]> * comment out command input altogether just to see what happens Signed-off-by: Rishav Dhar <[email protected]> * show plan-file artifact Signed-off-by: Rishav Dhar <[email protected]> * show "tfplan" Signed-off-by: Rishav Dhar <[email protected]> * require tf init before tf show Signed-off-by: Rishav Dhar <[email protected]> * change dir Signed-off-by: Rishav Dhar <[email protected]> * test without init, just to see what the error looks like Signed-off-by: Rishav Dhar <[email protected]> * comment in tf init again Signed-off-by: Rishav Dhar <[email protected]> * grep planfile Signed-off-by: Rishav Dhar <[email protected]> * decrypt Signed-off-by: Rishav Dhar <[email protected]> * plan-encrypt Signed-off-by: Rishav Dhar <[email protected]> * check the basics Signed-off-by: Rishav Dhar <[email protected]> * retry Signed-off-by: Rishav Dhar <[email protected]> * change directory Signed-off-by: Rishav Dhar <[email protected]> * retry Signed-off-by: Rishav Dhar <[email protected]> * decrypt Signed-off-by: Rishav Dhar <[email protected]> * init plan-encrypt Signed-off-by: Rishav Dhar <[email protected]> * show tfplan Signed-off-by: Rishav Dhar <[email protected]> * output Signed-off-by: Rishav Dhar <[email protected]> * comment out command input for kicks and giggles Signed-off-by: Rishav Dhar <[email protected]> * revert include command input init Signed-off-by: Rishav Dhar <[email protected]> * docs improve wording command input Signed-off-by: Rishav Dhar <[email protected]> * check apply job output Signed-off-by: Rishav Dhar <[email protected]> * check negative case Signed-off-by: Rishav Dhar <[email protected]> * echo diff_exists status Signed-off-by: Rishav Dhar <[email protected]> * retry Signed-off-by: Rishav Dhar <[email protected]> * output diff_exists value from step Signed-off-by: Rishav Dhar <[email protected]> * test negative case Signed-off-by: Rishav Dhar <[email protected]> * revert post-test Signed-off-by: Rishav Dhar <[email protected]> * doc pr_push_stages example workflow for condition job stages Signed-off-by: Rishav Dhar <[email protected]> * line breaks Signed-off-by: Rishav Dhar <[email protected]> * line breaks Signed-off-by: Rishav Dhar <[email protected]> * br Signed-off-by: Rishav Dhar <[email protected]> * br Signed-off-by: Rishav Dhar <[email protected]> * br Signed-off-by: Rishav Dhar <[email protected]> * br Signed-off-by: Rishav Dhar <[email protected]> * br clean Signed-off-by: Rishav Dhar <[email protected]> * bold Signed-off-by: Rishav Dhar <[email protected]> * plan file naming Signed-off-by: Rishav Dhar <[email protected]> * being tflint workflow example Signed-off-by: Rishav Dhar <[email protected]> * draft pr_push_lint workflow Signed-off-by: Rishav Dhar <[email protected]> * code Signed-off-by: Rishav Dhar <[email protected]> * dogfood pr_push_lint workflow Signed-off-by: Rishav Dhar <[email protected]> * test with tofu Signed-off-by: Rishav Dhar <[email protected]> * use terraform for simplicity Signed-off-by: Rishav Dhar <[email protected]> * debug Signed-off-by: Rishav Dhar <[email protected]> * debug static string Signed-off-by: Rishav Dhar <[email protected]> * more debug Signed-off-by: Rishav Dhar <[email protected]> * test tflint stderr output Signed-off-by: Rishav Dhar <[email protected]> * now with tflint stdout Signed-off-by: Rishav Dhar <[email protected]> * raw tflint error Signed-off-by: Rishav Dhar <[email protected]> * remove dquotes Signed-off-by: Rishav Dhar <[email protected]> * remove ticks Signed-off-by: Rishav Dhar <[email protected]> * re-introduce dquotes Signed-off-by: Rishav Dhar <[email protected]> * introduce heredoc Signed-off-by: Rishav Dhar <[email protected]> * variable tflint output Signed-off-by: Rishav Dhar <[email protected]> * er Signed-off-by: Rishav Dhar <[email protected]> * one backtick Signed-off-by: Rishav Dhar <[email protected]> * second backtick Signed-off-by: Rishav Dhar <[email protected]> * erm Signed-off-by: Rishav Dhar <[email protected]> * just tflint output by itself Signed-off-by: Rishav Dhar <[email protected]> * sub backtick for squote Signed-off-by: Rishav Dhar <[email protected]> * sub backtick for dquote Signed-off-by: Rishav Dhar <[email protected]> * heredoc Signed-off-by: Rishav Dhar <[email protected]> * retry Signed-off-by: Rishav Dhar <[email protected]> * re Signed-off-by: Rishav Dhar <[email protected]> * um Signed-off-by: Rishav Dhar <[email protected]> * re Signed-off-by: Rishav Dhar <[email protected]> * backticks syntax highlighting Signed-off-by: Rishav Dhar <[email protected]> * sheesh Signed-off-by: Rishav Dhar <[email protected]> * what Signed-off-by: Rishav Dhar <[email protected]> * er Signed-off-by: Rishav Dhar <[email protected]> * concise Signed-off-by: Rishav Dhar <[email protected]> * dquotes Signed-off-by: Rishav Dhar <[email protected]> * remove braces Signed-off-by: Rishav Dhar <[email protected]> * squotes Signed-off-by: Rishav Dhar <[email protected]> * surround in parentheses Signed-off-by: Rishav Dhar <[email protected]> * dquotes Signed-off-by: Rishav Dhar <[email protected]> * separate Signed-off-by: Rishav Dhar <[email protected]> * compact Signed-off-by: Rishav Dhar <[email protected]> * dquotes instead of squotes Signed-off-by: Rishav Dhar <[email protected]> * stderr or stdout Signed-off-by: Rishav Dhar <[email protected]> * ready pr_push_lint Signed-off-by: Rishav Dhar <[email protected]> * revert tf_tests Signed-off-by: Rishav Dhar <[email protected]> * ready merge Signed-off-by: Rishav Dhar <[email protected]> --------- Signed-off-by: Rishav Dhar <[email protected]>
1 parent 5343973 commit b3d1122

File tree

5 files changed

+227
-28
lines changed

5 files changed

+227
-28
lines changed

‎.github/examples/pr_push_lint.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
name: Trigger on pull_request (plan) and push (apply) events with fmt/validate checks and TFLint.
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches: [main]
8+
9+
jobs:
10+
tf:
11+
runs-on: ubuntu-latest
12+
13+
permissions:
14+
actions: read # Required to identify workflow run.
15+
checks: write # Required to add status summary.
16+
contents: read # Required to checkout repository.
17+
pull-requests: write # Required to add comment and label.
18+
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@v4
22+
23+
- name: Setup TF
24+
uses: hashicorp/setup-terraform@v3
25+
26+
- name: Init TF
27+
id: tf
28+
if: ${{ github.event_name == 'pull_request' }}
29+
uses: devsectop/tf-via-pr@v12
30+
with:
31+
command: init
32+
arg-lock: false
33+
working-directory: path/to/directory
34+
format: true
35+
validate: true
36+
37+
- name: Setup TFLint
38+
if: ${{ github.event_name == 'pull_request' }}
39+
uses: terraform-linters/setup-tflint@v4
40+
with:
41+
tflint_wrapper: true
42+
43+
- name: Run TFLint
44+
id: tflint
45+
if: ${{ github.event_name == 'pull_request' }}
46+
working-directory: path/to/directory
47+
run: |
48+
tflint --init
49+
tflint --format compact
50+
continue-on-error: true
51+
52+
- name: Comment if TFLint errors
53+
if: ${{ github.event_name == 'pull_request' && steps.tflint.outputs.exitcode != 0 }}
54+
env:
55+
GH_TOKEN: ${{ github.token }}
56+
run: |
57+
# Compose TFLint output.
58+
tflint='${{ steps.tflint.outputs.stderr || steps.tflint.outputs.stdout }}'
59+
tflint="<details><summary>TFLint error.</summary>
60+
61+
\`\`\`hcl
62+
$(echo "$tflint" | sed 's/`/\\`/g')
63+
\`\`\`
64+
</details>"
65+
66+
# Get body of PR comment from tf step output.
67+
comment=$(gh api /repos/{owner}/{repo}/issues/comments/${{ steps.tf.outputs.comment-id }} --method GET --jq '.body')
68+
69+
# Replace placeholder with TFLint output.
70+
comment="${comment//<!-- placeholder-2 -->/$tflint}"
71+
72+
# Update PR comment combined with TFLint output.
73+
gh api /repos/{owner}/{repo}/issues/comments/${{ steps.tf.outputs.comment-id }} --method PATCH --field body="$comment"
74+
75+
# Exit workflow due to TFLint error.
76+
exit 1
77+
78+
- name: Provision TF
79+
uses: devsectop/tf-via-pr@v12
80+
with:
81+
command: ${{ github.event_name == 'push' && 'apply' || 'plan' }}
82+
arg-lock: ${{ github.event_name == 'push' }}
83+
working-directory: path/to/directory

‎.github/examples/pr_push_stages.yaml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
name: Trigger on pull_request (plan) and push (apply) events with conditional job stages based on plan file.
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches: [main]
8+
9+
permissions:
10+
actions: read # Required to identify workflow run.
11+
checks: write # Required to add status summary.
12+
contents: read # Required to checkout repository.
13+
pull-requests: write # Required to add comment and label.
14+
15+
jobs:
16+
plan:
17+
if: github.event_name == 'pull_request'
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v4
23+
24+
- name: Setup TF
25+
uses: hashicorp/setup-terraform@v3
26+
27+
- name: Plan TF
28+
uses: devsectop/tf-via-pr@v12
29+
with:
30+
command: plan
31+
working-directory: path/to/directory
32+
plan-encrypt: ${{ secrets.PASSPHRASE }}
33+
34+
pre_apply:
35+
if: github.event_name == 'push'
36+
runs-on: ubuntu-latest
37+
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@v4
41+
42+
- name: Setup TF
43+
uses: hashicorp/setup-terraform@v3
44+
45+
- name: Init TF
46+
id: tf
47+
uses: devsectop/tf-via-pr@v12
48+
with:
49+
command: init
50+
working-directory: path/to/directory
51+
comment-pr: none
52+
53+
- name: Check for diff
54+
id: check
55+
env:
56+
GH_TOKEN: ${{ github.token }}
57+
path: path/to/directory
58+
plan: ${{ steps.tf.outputs.identifier }}
59+
pass: ${{ secrets.PASSPHRASE }} # For use with "plan-encrypt".
60+
run: |
61+
echo "Download plan file artifact."
62+
artifact_id=$(gh api /repos/{owner}/{repo}/actions/artifacts --method GET --field "name=$plan" --jq '.artifacts[0].id')
63+
gh api /repos/{owner}/{repo}/actions/artifacts/${artifact_id}/zip --method GET > "$plan.zip"
64+
unzip "$plan.zip" -d "$path"
65+
cd "$path"
66+
67+
echo "Optionally decrypt plan file."
68+
temp=$(mktemp)
69+
printf "%s" "$pass" > "$temp"
70+
openssl enc -aes-256-ctr -pbkdf2 -salt -in "tfplan" -out "tfplan.decrypted" -pass file:"$temp" -d
71+
mv "tfplan.decrypted" "tfplan"
72+
73+
echo "Check if plan file has diff."
74+
diff_exists=$(tofu show "tfplan" | grep -q "^Plan:" && echo "true" || echo "false")
75+
echo "diff_exists=$diff_exists" >> $GITHUB_OUTPUT
76+
77+
outputs:
78+
diff_exists: ${{ steps.check.outputs.diff_exists }}
79+
80+
apply:
81+
needs: pre_apply
82+
if: ${{ needs.pre_apply.outputs.diff_exists == 'true' }}
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v4
88+
89+
- name: Setup TF
90+
uses: hashicorp/setup-terraform@v3
91+
92+
- name: Apply TF
93+
uses: devsectop/tf-via-pr@v12
94+
with:
95+
command: apply
96+
working-directory: path/to/directory
97+
plan-encrypt: ${{ secrets.PASSPHRASE }}

‎.github/examples/schedule_refresh.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
name: Trigger on schedule (cron) event with fmt/validate checks to open an issue on configuration drift.
2+
name: Trigger on schedule (cron) event with -refresh-only to open an issue on configuration drift.
33

44
on:
55
schedule:
@@ -23,7 +23,7 @@ jobs:
2323
- name: Setup TF
2424
uses: hashicorp/setup-terraform@v3
2525

26-
- name: Provision TF
26+
- name: Plan TF
2727
id: provision
2828
uses: devsectop/tf-via-pr@v12
2929
with:
@@ -32,8 +32,6 @@ jobs:
3232
arg-refresh-only: true
3333
working-directory: path/to/directory
3434
plan-encrypt: ${{ secrets.PASSPHRASE }}
35-
format: true
36-
validate: true
3735

3836
- name: Open issue on drift
3937
if: steps.provision.outputs.exitcode != 0

‎README.md‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,18 +86,38 @@ The following workflows showcase common use cases, while a comprehensive list of
8686
<table>
8787
<tr>
8888
<td>
89-
<a href="/.github/examples/pr_push_auth.yaml">Run on</a> <code>pull_request</code> (plan) and <code>push</code> (apply) events with Terraform, AWS <strong>authentication</strong> and <strong>caching</strong>.
89+
</br>
90+
<a href="/.github/examples/pr_push_auth.yaml"><strong>Run on</strong></a> <code>pull_request</code> (plan) and <code>push</code> (apply) events with Terraform, AWS <strong>authentication</strong> and <strong>caching</strong>.
91+
</br></br>
9092
</td>
9193
<td>
92-
<a href="/.github/examples/pr_merge_matrix.yaml">Run on</a> <code>pull_request</code> (plan) and <code>merge_group</code> (apply) events with OpenTofu in <strong>matrix</strong> strategy.
94+
</br>
95+
<a href="/.github/examples/pr_merge_matrix.yaml"><strong>Run on</strong></a> <code>pull_request</code> (plan) and <code>merge_group</code> (apply) events with OpenTofu in <strong>matrix</strong> strategy.
96+
</br></br>
9397
</td>
9498
</tr>
9599
<tr>
96100
<td>
97-
<a href="/.github/examples/pr_self_hosted.yaml">Run on</a> <code>pull_request</code> (plan or apply) event with Terraform and OpenTofu on <strong>self-hosted</strong> runner.
101+
</br>
102+
<a href="/.github/examples/pr_push_stages.yaml"><strong>Run on</strong></a> <code>pull_request</code> (plan) and <code>push</code> (apply) events with <strong>conditional job stages</strong> based on plan file.
103+
</br></br>
98104
</td>
99105
<td>
100-
<a href="/.github/examples/schedule_refresh.yaml">Run on</a> <code>schedule</code> (cron) event with fmt/validate checks to open an issue on <strong>configuration drift</strong>.
106+
</br>
107+
<a href="/.github/examples/schedule_refresh.yaml"><strong>Run on</strong></a> <code>schedule</code> (cron) event with <code>-refresh-only</code> to open an issue on <strong>configuration drift</strong>.
108+
</br></br>
109+
</td>
110+
</tr>
111+
<tr>
112+
<td>
113+
</br>
114+
<a href="/.github/examples/pr_push_lint.yaml"><strong>Run on</strong></a> <code>pull_request</code> (plan) and <code>push</code> (apply) events with <strong>fmt/validate checks</strong> and TFLint.
115+
</br></br>
116+
</td>
117+
<td>
118+
</br>
119+
<a href="/.github/examples/pr_self_hosted.yaml"><strong>Run on</strong></a> <code>pull_request</code> (plan or apply) event with Terraform and OpenTofu on <strong>self-hosted</strong> runner.
120+
</br></br>
101121
</td>
102122
</tr>
103123
</table>
@@ -127,7 +147,7 @@ For each workflow run, a matrix-friendly job summary with logs is added as a fal
127147

128148
| Type | Name | Description |
129149
| -------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
130-
| CLI | `command` | Command to run between: `plan`, `apply` or leave empty for `init` with checks.</br>Example: `plan` |
150+
| CLI | `command` | Command to run between: `plan` or `apply`. Optionally `init` for checks and outputs only.</br>Example: `plan` |
131151
| CLI | `working-directory` | Specify the working directory of TF code, alias of `arg-chdir`.</br>Example: `path/to/directory` |
132152
| CLI | `tool` | Provisioning tool to use between: `terraform` or `tofu`.</br>Default: `terraform` |
133153
| Check | `format` | Check format of TF code.</br>Default: `false` |

‎action.yml‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ runs:
7777
# Get PR number using different query methods for push, merge_group, and pull_request events.
7878
if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
7979
# List PRs associated with the commit, then get the PR number from the head ref or the latest PR.
80-
associated_prs=$(gh api /repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls --header "$GH_API" --method GET --field per_page=100)
80+
associated_prs=$(gh api /repos/{owner}/{repo}/commits/${GITHUB_SHA}/pulls --header "$GH_API" --method GET --field per_page=100)
8181
pr_number=$(echo "$associated_prs" | jq --raw-output '(.[] | select(.head.ref == env.GITHUB_REF_NAME) | .number) // .[0].number // 0')
8282
elif [[ "$GITHUB_EVENT_NAME" == "merge_group" ]]; then
8383
# Get the PR number by parsing the ref name.
@@ -94,7 +94,7 @@ runs:
9494
echo "name=${{ inputs.tool }}-${pr_number}-${identifier}.tfplan" >> "$GITHUB_OUTPUT"
9595
9696
# List jobs from the current workflow run.
97-
workflow_run=$(gh api /repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}/jobs --header "$GH_API" --method GET --field per_page=100)
97+
workflow_run=$(gh api /repos/{owner}/{repo}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}/jobs --header "$GH_API" --method GET --field per_page=100)
9898
9999
# Get the current job ID from the workflow run using different query methods for matrix and regular jobs.
100100
if [[ "$GH_MATRIX" == "null" ]]; then
@@ -122,7 +122,8 @@ runs:
122122
echo "${{ inputs.tool }} fmt${{ steps.arg.outputs.arg-chdir }}${args}" | sed 's/ -/\n -/g' > tf.command.txt
123123
${{ inputs.tool }}${{ steps.arg.outputs.arg-chdir }} fmt${args} 2> >(tee tf.console.txt) > >(tee tf.console.txt)
124124
125-
- id: initialize
125+
- if: ${{ contains(fromJSON('["plan", "apply", "init"]'), inputs.command) }}
126+
id: initialize
126127
shell: bash
127128
run: |
128129
# TF initialize.
@@ -131,7 +132,7 @@ runs:
131132
echo "${{ inputs.tool }} init${{ steps.arg.outputs.arg-chdir }}${args}" | sed 's/ -/\n -/g' > tf.command.txt
132133
${{ inputs.tool }}${{ steps.arg.outputs.arg-chdir }} init${args} 2> >(tee tf.console.txt) > >(tee tf.console.txt)
133134
134-
- if: ${{ inputs.arg-workspace != '' }}
135+
- if: ${{ inputs.arg-workspace != '' && contains(fromJSON('["plan", "apply", "init"]'), inputs.command) }}
135136
id: workspace
136137
shell: bash
137138
run: |
@@ -141,7 +142,7 @@ runs:
141142
echo "${{ inputs.tool }} workspace select${{ steps.arg.outputs.arg-chdir }}${args}" | sed 's/ -/\n -/g' > tf.command.txt
142143
${{ inputs.tool }}${{ steps.arg.outputs.arg-chdir }} workspace select${args} 2> >(tee tf.console.txt) > >(tee tf.console.txt)
143144
144-
- if: ${{ inputs.validate == 'true' }}
145+
- if: ${{ inputs.validate == 'true' && contains(fromJSON('["plan", "apply", "init"]'), inputs.command) }}
145146
id: validate
146147
shell: bash
147148
run: |
@@ -151,15 +152,15 @@ runs:
151152
echo "${{ inputs.tool }} validate${{ steps.arg.outputs.arg-chdir }}${args}" | sed 's/ -/\n -/g' > tf.command.txt
152153
${{ inputs.tool }}${{ steps.arg.outputs.arg-chdir }} validate${args} 2> >(tee tf.console.txt) > >(tee tf.console.txt)
153154
154-
- if: ${{ inputs.label-pr == 'true' && steps.identifier.outputs.pr != 0 }}
155+
- if: ${{ inputs.label-pr == 'true' && steps.identifier.outputs.pr != 0 && contains(fromJSON('["plan", "apply"]'), inputs.command) }}
155156
continue-on-error: true
156157
shell: bash
157158
run: |
158159
# Label PR.
159160
# If the label does not exist, create it before adding it to the PR in the format 'tf:${{ inputs.command }}'.
160-
gh api /repos/${GITHUB_REPOSITORY}/labels/tf:${{ inputs.command }} --header "$GH_API" --method GET || \
161-
gh api /repos/${GITHUB_REPOSITORY}/labels --header "$GH_API" --method POST --field "name=tf:${{ inputs.command }}" --field "description=Pull requests that ${{ inputs.command }} TF code." --field "color=5C4EE5"
162-
gh api /repos/${GITHUB_REPOSITORY}/issues/${{ steps.identifier.outputs.pr }}/labels --header "$GH_API" --method POST --field "labels[]=tf:${{ inputs.command }}"
161+
gh api /repos/{owner}/{repo}/labels/tf:${{ inputs.command }} --header "$GH_API" --method GET || \
162+
gh api /repos/{owner}/{repo}/labels --header "$GH_API" --method POST --field "name=tf:${{ inputs.command }}" --field "description=Pull requests that ${{ inputs.command }} TF code." --field "color=5C4EE5"
163+
gh api /repos/{owner}/{repo}/issues/${{ steps.identifier.outputs.pr }}/labels --header "$GH_API" --method POST --field "labels[]=tf:${{ inputs.command }}"
163164
164165
- if: ${{ inputs.command == 'plan' }}
165166
id: plan
@@ -177,8 +178,8 @@ runs:
177178
run: |
178179
# Download plan file.
179180
# Get the artifact ID of the latest matching plan files for download.
180-
artifact_id=$(gh api /repos/${GITHUB_REPOSITORY}/actions/artifacts --header "$GH_API" --method GET --field "name=${{ steps.identifier.outputs.name }}" --jq '.artifacts[0].id')
181-
gh api /repos/${GITHUB_REPOSITORY}/actions/artifacts/${artifact_id}/zip --header "$GH_API" --method GET > "${{ steps.identifier.outputs.name }}.zip"
181+
artifact_id=$(gh api /repos/{owner}/{repo}/actions/artifacts --header "$GH_API" --method GET --field "name=${{ steps.identifier.outputs.name }}" --jq '.artifacts[0].id')
182+
gh api /repos/{owner}/{repo}/actions/artifacts/${artifact_id}/zip --header "$GH_API" --method GET > "${{ steps.identifier.outputs.name }}.zip"
182183
183184
# Unzip the plan file to the working directory, then clean up the zip file.
184185
unzip "${{ steps.identifier.outputs.name }}.zip" -d "${{ inputs.arg-chdir || inputs.working-directory }}"
@@ -261,7 +262,7 @@ runs:
261262
${{ inputs.tool }}${{ steps.arg.outputs.arg-chdir }} apply${args} 2> >(tee tf.console.txt) > >(tee tf.console.txt)
262263
263264
- id: post
264-
if: ${{ !cancelled() && steps.identifier.outcome == 'success' }}
265+
if: ${{ !cancelled() && steps.identifier.outcome == 'success' && contains(fromJSON('["plan", "apply", "init"]'), inputs.command) }}
265266
shell: bash
266267
run: |
267268
# Post output.
@@ -301,7 +302,7 @@ runs:
301302
if [[ "${{ steps.format.outcome }}" == "failure" ]]; then syntax="diff"; fi
302303
303304
# Add summary to the job status.
304-
check_run=$(gh api /repos/${GITHUB_REPOSITORY}/check-runs/${{ steps.identifier.outputs.job }} --header "$GH_API" --method PATCH --field "output[title]=${summary}" --field "output[summary]=${summary}")
305+
check_run=$(gh api /repos/{owner}/{repo}/check-runs/${{ steps.identifier.outputs.job }} --header "$GH_API" --method PATCH --field "output[title]=${summary}" --field "output[summary]=${summary}")
305306
306307
# From check_run, echo html_url.
307308
check_url=$(echo "$check_run" | jq --raw-output '.html_url')
@@ -364,23 +365,23 @@ runs:
364365
# Post PR comment per ${{ inputs.comment-pr }} and if the PR number is not 0.
365366
if [[ "${{ inputs.comment-pr }}" != "none" && "${{ steps.identifier.outputs.pr }}" != "0" ]]; then
366367
# Check if the PR contains a bot comment with the same identifier.
367-
list_comments=$(gh api /repos/${GITHUB_REPOSITORY}/issues/${{ steps.identifier.outputs.pr }}/comments --header "$GH_API" --method GET --field per_page=100)
368+
list_comments=$(gh api /repos/{owner}/{repo}/issues/${{ steps.identifier.outputs.pr }}/comments --header "$GH_API" --method GET --field per_page=100)
368369
bot_comment=$(echo "$list_comments" | jq --raw-output --arg identifier "${{ steps.identifier.outputs.name }}" '.[] | select(.user.type == "Bot") | select(.body | contains($identifier)) | .id' | tail -n 1)
369370
370371
if [[ -n "$bot_comment" ]]; then
371372
if [[ "${{ inputs.comment-pr }}" == "recreate" ]]; then
372373
# Delete previous comment before posting a new one.
373-
gh api /repos/${GITHUB_REPOSITORY}/issues/comments/${bot_comment} --header "$GH_API" --method DELETE
374-
pr_comment=$(gh api /repos/${GITHUB_REPOSITORY}/issues/${{ steps.identifier.outputs.pr }}/comments --header "$GH_API" --method POST --field "body=${body}")
374+
gh api /repos/{owner}/{repo}/issues/comments/${bot_comment} --header "$GH_API" --method DELETE
375+
pr_comment=$(gh api /repos/{owner}/{repo}/issues/${{ steps.identifier.outputs.pr }}/comments --header "$GH_API" --method POST --field "body=${body}")
375376
echo "comment_id=$(echo "$pr_comment" | jq --raw-output '.id')" >> "$GITHUB_OUTPUT"
376377
elif [[ "${{ inputs.comment-pr }}" == "update" ]]; then
377378
# Update existing comment.
378-
pr_comment=$(gh api /repos/${GITHUB_REPOSITORY}/issues/comments/${bot_comment} --header "$GH_API" --method PATCH --field "body=${body}")
379+
pr_comment=$(gh api /repos/{owner}/{repo}/issues/comments/${bot_comment} --header "$GH_API" --method PATCH --field "body=${body}")
379380
echo "comment_id=$(echo "$pr_comment" | jq --raw-output '.id')" >> "$GITHUB_OUTPUT"
380381
fi
381382
else
382383
# Post new comment.
383-
pr_comment=$(gh api /repos/${GITHUB_REPOSITORY}/issues/${{ steps.identifier.outputs.pr }}/comments --header "$GH_API" --method POST --field "body=${body}")
384+
pr_comment=$(gh api /repos/{owner}/{repo}/issues/${{ steps.identifier.outputs.pr }}/comments --header "$GH_API" --method POST --field "body=${body}")
384385
echo "comment_id=$(echo "$pr_comment" | jq --raw-output '.id')" >> "$GITHUB_OUTPUT"
385386
fi
386387
fi
@@ -430,7 +431,7 @@ inputs:
430431
# Action parameters.
431432
command:
432433
default: ""
433-
description: "Command to run between: `plan`, `apply` or leave empty for `init` with checks (e.g., `plan`)."
434+
description: "Command to run between: `plan` or `apply`. Optionally `init` for checks and outputs only (e.g., `plan`)."
434435
required: false
435436
comment-pr:
436437
default: "update"

0 commit comments

Comments
 (0)