Framework for Monorepo to build high level Terraform Workflows by GitHub Actions
Home Page: https://suzuki-shunsuke.github.io/tfaction/docs/
License: MIT License
Framework for Monorepo to build high level Terraform Workflows by GitHub Actions
https://suzuki-shunsuke.github.io/tfaction/docs/
Note
If you want to add your company or organization to the list, please send a pull request or send a comment to the GitHub Discussion!
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot]")
![suzuki-shunsuke-app[bot] avatar](https://avatars.githubusercontent.com/in/142183?v=4 "suzuki-shunsuke-app[bot]")
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
tfmigrate:<target>target_groups:
- working_directory:
target:
jobs:
- job_id: terraform-plan # GITHUB_JOB
aws_assume_role_arn:
secrets:
# ...Hi! I found thing that seems like bug.
tfaction/terraform-plan/main.sh
Lines 12 to 16 in de7ecac
In action terrafom-plan, when terraform plan fails old tfplan.binary is supposed to be deleted in case of S3. But it remains in case of GCS.
Is this a behavior you suppose? If not, I'm going to make PR.
We would like to create and merge many pull requests by Renovate.
When we manage dependencies such as Terraform, Terraform Providers, tfsec, tflint, etc and create pull request per working directory, we have to handle many pull requests by Renovate.
I found that when we update tfsec and tflint we don't have to run terraform plan and terraform apply.
We only have to run tfsec and tflint.
On the other hand, when Terraform and Terraform Providers are updated, we have to run terraform plan and terraform apply.
By skipping terraform plan and terraform apply, we can efficiently update dependencies.
terraform plan's unexpected changesterraform plan and terraform applyAdd the fields in tfaction-root.yaml.
When skip_terraform_by_renovate is true, in pull requests by Renovate terraform plan and terraform apply are skipped.
If commits by non Renovate are included in the pull request, terraform plan and terraform apply aren't skipped.
When pull request labels in renovate_terraform_labels are set, terraform plan and terraform apply are executed.
tfaction-root.yaml
skip_terraform_by_renovate: true
renovate_terraform_labels:
- terraformrenovate.json
{
"packageRules": [
{
"matchManagers": ["terraform", "terraform-version"],
"addLabels": ["terraform"]
},
{
"matchPackageNames": ["hashicorp/terraform"],
"addLabels": ["terraform"]
}
]
}Error: ENOENT: no such file or directory, open 'github/foo/tfaction.yaml'
Due to #128
Affected version: v0.4.4 v0.4.5 v0.4.6
Please use tfaction v0.4.3 in the workflow scaffold-working-directory.
tfaction suports creating some types of pull requests.
They are really useful, but they are created by GitHub App so you can pass 1 approval Required by approving your changes by yourself.
To solve the problem, we consider to create only branch and skip creating pull request.
Currently, when you migrate state across multiple state with tfmigrate,
you have to set the pull request label ignore:*.
When this label is set, tfmigrate-plan and terraform-plan jobs aren't run against the working directory,
then tfsec and tflint aren't run.
https://github.com/accurics/terrascan
#40 is required.
Hello, thank you for creating awesome tool.
This is minor misprint I noticed when I read source code.
secrets parameter is required while nothing is required in README.tfaction/export-secrets/action.yaml
Lines 4 to 6 in 5118f1d
tfaction/export-secrets/README.md
Lines 17 to 19 in 5118f1d
The secrets parameter is required also in README.
I will create PR against this issue. Thank you.
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
This repository currently has no open or pending branches.
.github/workflows/actionlint.yaml
suzuki-shunsuke/actionlint-workflow v1.0.1@813a6d08c08cfd7a08618a89a59bfe78e573597c.github/workflows/prerelease-pr.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332tibdex/github-app-token v2.1.0@3beb63f4bd073e61482598c45c71c1019b59b73a.github/workflows/release.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332.github/workflows/test.yaml
dorny/paths-filter v3.0.2@de90cc6fb38fc0963ad72b210f1f284cd68cea36.github/workflows/watch-star.yaml
suzuki-shunsuke/watch-star-action v0.1.1@2b3d259ce2ea06d53270dfe33a66d5642c8010ca.github/workflows/wc-create-pr-branch.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332tibdex/github-app-token v2.1.0@3beb63f4bd073e61482598c45c71c1019b59b73aaquaproj/aqua-installer v3.0.1@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c.github/workflows/wc-deploy-schema.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332peaceiris/actions-gh-pages v4.0.0@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e.github/workflows/wc-enable-auto-merge.yaml
suzuki-shunsuke/enable-auto-merge-action v0.1.0@ec074392e76cd1062925255cd82a86ea1c44b6fd.github/workflows/wc-ghalint.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332aquaproj/aqua-installer v3.0.1@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c.github/workflows/wc-prettier.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332actions/setup-node v4.0.3@1e60f620b9541d16bece96c5465dc8ee9832be0b.github/workflows/wc-renovate-config-validator.yaml
suzuki-shunsuke/renovate-config-validator-workflow v0.2.3@4a378742d05b4e67aae34039d7c779ac913cd79d.github/workflows/wc-test-get-target-config.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332aquaproj/aqua-installer v3.0.1@6ce1f8848ec8e61f14d57bd5d7597057a6dd187cactions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332aquaproj/aqua-installer v3.0.1@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c.github/workflows/wc-test-list-working-dirs.yaml
actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332aquaproj/aqua-installer v3.0.1@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c.github/workflows/wc-update-aqua-checksums.yaml
aquaproj/update-checksum-workflow v1.0.2@437067ad2fba9ba8ed8454cf207f2532432d4e28apply/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction maincreate-follow-up-pr/action.yaml
suzuki-shunsuke/tfaction maincreate-scaffold-module-pr/action.yaml
suzuki-shunsuke/tfaction maincreate-scaffold-pr/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainlist-targets/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainlist-working-dirs/action.yaml
suzuki-shunsuke/tfaction mainplan/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainscaffold-module/action.yaml
suzuki-shunsuke/tfaction mainscaffold-tfmigrate/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainscaffold-working-dir/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainset-drift-env/action.yaml
suzuki-shunsuke/tfaction mainsetup/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainaquaproj/update-checksum-action v0.2.3@0fef5fa12e81e046bb29078f76b99bb29fa4e696aws-actions/configure-aws-credentials v4.0.2@e3dd6a429d7300a6a4c196c26e071d42e0343502suzuki-shunsuke/tfaction maingoogle-github-actions/auth v2.1.4@f112390a2df9932162083945e46d439060d66ec2google-github-actions/auth v2.1.4@f112390a2df9932162083945e46d439060d66ec2google-github-actions/setup-gcloud v2.1.1@f0990588f1e5b5af6827153b93673613abdc6ec7suzuki-shunsuke/tfaction mainsuzuki-shunsuke/github-action-terraform-init v1.1.1@a0f2e069f49737ab11fbd9b00b2149019703ba99terraform-apply/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainterraform-plan/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainactions/upload-artifact v4.3.6@834a144ee995460fba8ed112a2fc961b36a5ec5atest-module/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/trivy-config-action v0.2.2@6c7c845cbf76e5745c4d772719de7a34453ae81dsuzuki-shunsuke/github-action-tfsec v1.0.0@6b4afce3060c0d8865d269de0c5fabc90e1b20f7suzuki-shunsuke/github-action-tflint v1.1.0@0b7fbc35b0d512749f35c3036df57c3a95d3e9e1suzuki-shunsuke/github-action-terraform-fmt v0.2.2@bdc85c3536e31ae189339cc09c5a0f9768d0ffa7tfmigrate-apply/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction maintfmigrate-plan/action.yaml
suzuki-shunsuke/tfaction mainsuzuki-shunsuke/tfaction mainupdate-drift-issue/action.yaml
suzuki-shunsuke/tfaction main
.node-version
node 20.16.0
check-terraform-skip/package.json
export-aws-secrets-manager/package.json
export-secrets/package.json
get-global-config/package.json
get-target-config/package.json
lib/package.json
list-changed-modules/package.json
list-module-callers/package.json
list-targets-with-changed-files/package.json
package.json
.nvmrc
node 20.16.0
renovate.json5
aquaproj/aqua-renovate-config 2.3.1aquaproj/aqua-renovate-config:file 2.3.1.github/workflows/actionlint.yaml
aquaproj/aqua v2.30.0.github/workflows/wc-create-pr-branch.yaml
aquaproj/aqua v2.30.0.github/workflows/wc-ghalint.yaml
aquaproj/aqua v2.30.0.github/workflows/wc-test-get-target-config.yaml
aquaproj/aqua v2.30.0aquaproj/aqua v2.30.0.github/workflows/wc-test-list-working-dirs.yaml
aquaproj/aqua v2.30.0.github/workflows/wc-update-aqua-checksums.yaml
aquaproj/aqua v2.30.0renovate.json5
aquaproj/aqua-renovate-config 2.3.1aquaproj/aqua-renovate-config 2.3.1aqua.yaml
aquaproj/aqua-registry v4.212.0aqua/actionlint.yaml
rhysd/actionlint v1.7.1aqua/cmdx.yaml
suzuki-shunsuke/cmdx v1.7.4aqua/ghalint.yaml
suzuki-shunsuke/ghalint v0.2.12aqua/ghcp.yaml
int128/ghcp v1.13.3aqua/github-comment.yaml
suzuki-shunsuke/github-comment v6.2.0aqua/pinact.yaml
suzuki-shunsuke/pinact v0.2.1aqua/reviewdog.yaml
reviewdog/reviewdog v0.20.1
Terraform itself doesn't support timeout.
https://discuss.hashicorp.com/t/timeout-setting-for-terraform-binary/29627/2
tfaction/terraform-apply/main.sh
Line 13 in d9b00e2
tfaction.yaml
tflint: false
tfsec: falserenovate_follow_up_mentions:
- suzuki-shunsuke
- <org name>/<team name>When Renovate Pull Request was merged automatically and apply failed,
follow up pull request is created but no mention is set and no one is assigned.
If pull request author is Renovate and GITHUB_ACTOR is bot, renovate_follow_up_mentions are mentioned and assigned.
Make the workflow simpler
env:
<env name>: <env value>
# ...Hi, This is my proposal.
I want to try to make pipeline with tfaction faster adding the -parallelism=n option to terraform plan / apply.
What if terraform-plan and terraform-apply actions support adding any terraform options to realize this? What do you think of this.
If it seems good idea, I will create the PR.
gcloud is required. https://cloud.google.com/sdk/gcloud
https://github.com/actions/virtual-environments
Google Cloud SDK 368.0.0 (apt source repository: https://packages.cloud.google.com/apt)
e.g.
terraform_plan_config:
aws_secrets_manager:
- secret_id: foo
version_id:
version_stage:
aws_region: ap-northeast-1
envs:
- env_name: ATLAS_API_KEY
secret_key: atlas_api_key
- secret_id: bar
version_id:
version_stage:
aws_region: ap-northeast-1
envs:
- env_name: BARHi, I found kind of like a bug.
https://suzuki-shunsuke.github.io/tfaction/docs/config/tfaction-yaml
In above document, It seems that tfaction.yaml in working directory overwrites tfaction-root.yaml.
You can override the configuration of tfaction-root.yaml by tfaction.yaml.
On the other hand, in the action get-target-config it seems that tfaction-root.yaml overwrites tfaction.yaml in working directory.
tfaction/get-target-config/src/index.ts
Lines 41 to 52 in 4f6e115
As far as I read the codes, each variables mean like following.
So the order of list in arguments to setOutputs seems incorrect.
The order like following is correct?
lib.setOutputs([
's3_bucket_name_plan_file',
's3_bucket_name_tfmigrate_history',
'gcs_bucket_name_plan_file',
'providers_lock_opts',
], [config, targetConfig, wdConfig]);
lib.setOutputs([
'aws_region',
'aws_assume_role_arn',
'gcp_service_account',
'gcp_workload_identity_provider',
], [config, targetConfig, rootJobConfig, wdConfig, jobConfig]);
If it's correct I send the PR! Thank you for reading in advance.
Add a file tfaction_module.yaml in Module's root directory.
GitHub: https://www.terraform.io/language/modules/sources#github
module_<module name>_<version>
/ seems to be unavailable in Terraform Modules Ref.
Inputs
It is difficult to update Modules by Renovate.
We'll consider to create feature branches or pull requests to update Modules by GitHub Actions.
https://gha-trigger.github.io/
GITHUB_TOKEN
secrets:
<Secret Name>: <Environment variable name>
# ...Hi, this is feature request for tfaction!
We are managing a lot of working directories, and I'm facing a problem like hashicorp/terraform-provider-aws#5171 .
To prevent this problem, I want to pass [--parallelism](https://www.terraform.io/docs/commands/plan.html#parallelism-n) flag to the terraform command, but currently it's not possible.
I'm thinking about adding configuration item to tfaction.yaml like:
terraform-option: --parallelism 10
And this is passed to
tfaction/terraform-plan/main.sh
Line 8 in 4963543
Thanks in advance!
Hi, I found a thing like a bag.
Even if the skip_create_pr option (default: false) is set both false or true in tfaction-root.yaml, skip_create_pr.sh is always executed when terraform apply fails.
tfaction/create-follow-up-pr/action.yaml
Line 18 in c779fe4
When skip_create_pr option is set as false, main.sh is executed not but skip_create_pr.sh.
tfaction/create-follow-up-pr/action.yaml
Line 27 in c779fe4
This bug is caused by the following wrong condition.
tfaction/create-follow-up-pr/action.yaml
Lines 18 to 33 in c779fe4
According to this document, output is always dealt as string so it can't compare to boolean.
In above case, as long as steps.global-config.outputs.skip_create_pr is not null, the result of condition is always true.
Refference: GitHub Actions で真偽値を正しく扱う
I'm going to send PR!
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.