chore: pin hashicorp/kubernetes to 3.2.1 across all templates #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## | |
| # Dry-run counterpart to "Push templates (ai.coder.com)". | |
| # | |
| # That workflow runs `terraform apply -auto-approve` on push to main with no | |
| # plan step, so the effect of a change to coder/ or modules/ is only visible | |
| # after it has already been applied to production. This runs the same | |
| # configuration through `terraform plan` on the pull request instead. | |
| # | |
| # Deliberately read-only: no apply, and nothing is written back to the | |
| # deployment. Plan output stays in the job log, which GitHub masks registered | |
| # secrets in. It is not posted to the PR, because template variables carry API | |
| # keys and comment bodies are not masked. | |
| ## | |
| name: "Terraform Plan (ai.coder.com)" | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| paths: | |
| - 'deployments/ai.coder.com/**' | |
| - 'coder/**' | |
| - 'modules/**' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| # Plans may queue behind each other, but must never cancel a run mid-flight | |
| # while it holds the state lock. | |
| concurrency: | |
| group: plan-templates-ai.coder.com-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| plan: | |
| name: Terraform Plan | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: coder | |
| env: | |
| # Mirrors the deploy job in push-templates.yml. These have to match for | |
| # the plan to be representative: template `vars` feed a sha1 trigger on | |
| # null_resource.push-templates, so a missing value shows up as spurious | |
| # churn. | |
| TF_VAR_ai_coder_com_access_url: ${{ secrets.AI_CODER_COM_CODER_URL }} | |
| TF_VAR_ai_coder_com_token: ${{ secrets.AI_CODER_COM_CODER_SESSION_TOKEN }} | |
| TF_VAR_ai_coder_com_bot_gh_username: ${{ secrets.AI_CODER_COM_BOT_GH_USERNAME }} | |
| TF_VAR_ai_coder_com_bot_gh_email: ${{ secrets.AI_CODER_COM_BOT_GH_EMAIL }} | |
| TF_VAR_ai_coder_com_bot_gh_token: ${{ secrets.AI_CODER_COM_BOT_GH_TOKEN }} | |
| TF_VAR_ai_coder_com_bot_aws_account_id: ${{ secrets.AI_CODER_COM_BOT_AWS_ACCOUNT_ID }} | |
| TF_VAR_ai_coder_com_cursor_api_key: ${{ secrets.AI_CODER_COM_CURSOR_API_KEY }} | |
| TF_VAR_ai_coder_com_kiro_cli_auth_tarball: ${{ secrets.AI_CODER_COM_KIRO_CLI_AUTH_TARBALL }} | |
| TF_VAR_ai_coder_com_codex_api_key: ${{ secrets.AI_CODER_COM_CODEX_API_KEY }} | |
| TF_VAR_ai_coder_com_gemini_api_key: ${{ secrets.AI_CODER_COM_GEMINI_API_KEY }} | |
| TF_VAR_coderdemo_io_access_url: ${{ secrets.CODERCOM_IO_CODER_URL }} | |
| TF_VAR_coderdemo_io_token: ${{ secrets.CODERCOM_IO_CODER_SESSION_TOKEN }} | |
| TF_VAR_manual_trigger: ${{ vars.LAST_MANUAL_RUN_ID }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_ARN }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| # The coderd provider reads template state from the deployment during | |
| # refresh, so the CLI credentials have to be present for the plan to | |
| # reflect reality rather than an empty diff. | |
| - name: Setup Coder CLI | |
| uses: coder/setup-action@v1.1.0 | |
| with: | |
| access_url: ${{ secrets.AI_CODER_COM_CODER_URL }} | |
| coder_session_token: ${{ secrets.AI_CODER_COM_CODER_SESSION_TOKEN }} | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v4 | |
| with: | |
| terraform_version: "1.15.5" | |
| # -upgrade matches push-templates.yml. Provider versions are pinned | |
| # exactly in coder/main.tf, so this resolves deterministically; without | |
| # the pin it would resolve whatever is newest and the plan could differ | |
| # from the apply. | |
| - name: Terraform Init | |
| run: | | |
| terraform init -upgrade \ | |
| -backend-config="bucket=${{ secrets.TF_BACKEND_S3_BUCKET }}" \ | |
| -backend-config="key=${{ secrets.TF_BACKEND_S3_KEY }}" \ | |
| -backend-config="region=${{ secrets.TF_BACKEND_S3_REGION }}" | |
| - name: Terraform Validate | |
| run: terraform validate | |
| - name: Terraform Plan | |
| run: terraform plan -no-color -input=false | |
| - name: Remind that this was a dry run | |
| if: always() | |
| run: | | |
| echo "::notice::Plan only. Nothing was applied. Review the plan above" | |
| echo "::notice::before merging, especially any destroy or replace lines." |