Conversation
SalmaSamy
commented
Mar 3, 2026
SalmaSamy
commented
- Fixed branch name main -> master
- Allows only project MEMBER, OWNER, or COLLABORATOR roles to trigger the Terraform engine
- Added a step to automatically post the terraform plan output as a comment on the Pull Request, making it easier to review changes before merging.
- Switched from mutable version tags (like @v4) to immutable commit SHAs (like @11bd719...) to protect against compromised third-party actions.
- Configured the workflow to use the TF_VAR_ prefix for secrets, which works with the sensitive = true flag to ensure tokens are never leaked in logs or comments.
SalmaSamy
requested review from
Wyverald,
fweikert and
meteorcloudy
as code owners
| - uses: actions/checkout@v4 | ||
| - uses: dorny/paths-filter@v3 | ||
| - name: Checkout Code | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
There was a problem hiding this comment.
You mentioned in the PR description that using explicit commits rather than verison numbers is supposed to protect us against compromised action versions, but I don't quite understand. If an action is compromised at some git tag for some git commit, wouldn't both the version tag and the commit be tainted? Are you concerned about the case where a bad actor could overwrite a tag to a different commit?
| }) | ||
|
|
||
| - name: Terraform Apply | ||
| if: github.ref == 'refs/heads/master' && github.event_name == 'push' |
There was a problem hiding this comment.
Clarification for github.event_name == 'push': does this mean the PR is getting merged?
| } | ||
| } | ||
|
|
||
| variable "buildkite_api_token" { |
There was a problem hiding this comment.
Where do we tell github actions where to find the buildkite API token?
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
|
|
||
| - name: Path Filter | ||
| uses: dorny/paths-filter@de90cc6fb38fc0963ad727459f9a1755dc9ad150 # v3.0.2 |
There was a problem hiding this comment.
Just FYI, the last release from this action was 2 years ago, and there appear to be infrequent commits since then. We might consider adopting a more actively-maintained action dependency, or making some of the underlying workflows smarter instead of relying on external deps.
3 participants
