You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[](https://raw.githubusercontent.com/op5dev/tf-via-pr/refs/heads/main/.github/assets/comment.png"View full-size image.")
> - All supported arguments (e.g., `-backend-config`, `-destroy`, `-parallelism`, etc.) are [listed below](#inputs---arguments).
85
-
> - Environment variables can be passed in for cloud platform authentication (e.g., [configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials "Configuring AWS credentials for use in GitHub Actions.") for short-lived credentials).
85
+
> - All supported arguments (e.g., `-backend-config`, `-destroy`, `-parallelism`, etc.) are [listed below](#arguments).
86
+
> - Environment variables can be passed in for cloud platform authentication (e.g., [configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials "Configuring AWS credentials for use in GitHub Actions.") for short-lived credentials via OIDC).
86
87
> - Recommend setting `terraform_wrapper`/`tofu_wrapper` to `false` in order to output the [detailed exit code](https://developer.hashicorp.com/terraform/cli/commands/plan#detailed-exitcode) for better error handling.
87
88
88
89
</br>
89
90
90
91
### Where to find more examples?
91
92
92
-
The following workflows showcase common use cases, while a comprehensive list of inputs is [documented](#parameters) below.
93
+
The following workflows showcase common use cases, while a comprehensive list of inputs is [documented](#inputs) below.
93
94
94
95
<table>
95
96
<tr>
@@ -134,7 +135,7 @@ The following workflows showcase common use cases, while a comprehensive list of
134
135
135
136
### How does encryption work?
136
137
137
-
Before the workflow uploads the plan file as an artifact, it can be encrypted with a passphrase (e.g., `${{ secrets.PASSPHRASE }}`) to prevent exposure of sensitive data using `plan-encrypt` input. This is done with [OpenSSL](https://docs.openssl.org/master/man1/openssl-enc/ "OpenSSL encryption documentation.")'s symmetric stream counter mode encryption with salt and pbkdf2.
138
+
Before the workflow uploads the plan file as an artifact, it can be encrypted-at-rest with a passphrase using `plan-encrypt` input to prevent exposure of sensitive data (e.g., `${{ secrets.PASSPHRASE }}`). This is done with [OpenSSL](https://docs.openssl.org/master/man1/openssl-enc/ "OpenSSL encryption documentation.")'s symmetric stream counter mode ([256 bit AES in CTR](https://docs.openssl.org/3.3/man1/openssl-enc/#supported-ciphers:~:text=192/256%20bit-,AES%20in%20CTR%20mode,-aes%2D%5B128%7C192)) encryption with salt and pbkdf2.
138
139
139
140
In order to decrypt the plan file locally, use the following commands after downloading the artifact (adding a whitespace before `openssl` to prevent recording the command in shell history):
For each workflow run, a matrix-friendly job summary with logs is added as a fallback to the PR comment. Below this, you'll find a list of plan file artifacts generated during runtime.</br>
153
-
154
-
[](https://raw.githubusercontent.com/op5dev/tf-via-pr/refs/heads/main/.github/assets/workflow.png "View full-size image.")
| UI | `label-pr` | Add a PR label with the command input (e.g., `tf:plan`).</br>Default: `true`|
171
+
| UI | `comment-pr` | Add a PR comment: `always`, `on-change`, or `never`.<sup>4</sup></br>Default: `always` |
172
+
| UI | `comment-method` | PR comment by: `update`existing comment or `recreate` and delete previous one.<sup>5</sup></br>Default: `update` |
173
+
| UI | `tag-actor` | Tag the workflow triggering actor: `always`, `on-change`, or `never`.<sup>4</sup></br>Default: `always` |
174
+
| UI | `hide-args` | Hide comma-separated list of CLI arguments from the command input.<sup>6</sup></br>Default: `detailed-exitcode,parallelism,lock,out,var=`|
175
+
| UI | `show-args` | Show comma-separated list of CLI arguments in the command input.<sup>6</sup></br>Default: `workspace`|
179
176
180
177
</br>
181
178
182
179
1. Both `command: plan` and `command: apply` include: `init`, `fmt` (with `format: true`), `validate` (with `validate: true`), and `workspace` (with `arg-workspace`) commands rolled into it automatically.</br>
183
180
To separately run checks and/or generate outputs only, `command: init` can be used.</br></br>
184
-
1. Originally intended for `merge_group` event trigger, `plan-parity: true` input helps prevent stale apply within a series of workflow runs when merging multiple PRs.</br></br>
181
+
1. Originally intended for `merge_group` event trigger, `plan-parity: true` input helps to prevent stale apply within a series of workflow runs when merging multiple PRs.</br></br>
185
182
1. The secret string input for `plan-encrypt` can be of any length, as long as it's consistent between encryption (plan) and decryption (apply).</br></br>
186
-
1. The `on-change` option is true when the exit code of the last TF command is non-zero.</br></br>
183
+
1. The `on-change` option is true when the exit code of the last TF command is non-zero (ensure `terraform_wrapper`/`tofu_wrapper` is set to `false`).</br></br>
187
184
1. The default behavior of `comment-method` is to update the existing PR comment with the latest plan/apply output, making it easy to track changes over time through the comment's revision history.</br></br>
188
-
[](https://raw.githubusercontent.com/op5dev/tf-via-pr/refs/heads/main/.github/assets/revisions.png "View full-size image.")
185
+
[](https://raw.githubusercontent.com/op5dev/tf-via-pr/refs/heads/main/.github/assets/revisions.png "View full-size image.")</br></br>
186
+
1. It can be desirable to hide certain arguments from the last run command input to prevent exposure in the PR comment (e.g., sensitive `arg-var` values). Conversely, it can be desirable to show other arguments even if they are not in last run command input (e.g., `arg-workspace` or `arg-backend-config` selection).
189
187
190
188
</br>
191
189
192
-
### Inputs - Arguments
190
+
### Arguments
193
191
194
192
> [!NOTE]
195
193
>
196
-
> - Arguments are passed to the appropriate TF command(s) automatically, whether that's `init`, `workspace`, `validate`, `plan`, or `apply`.</br>
194
+
> - Arguments are passed to the appropriate TF command(s) automatically, whether that's `fmt`, `init`, `validate`, `plan`, or `apply`.</br>
197
195
> - For repeated arguments like `arg-var`, `arg-var-file`, `arg-backend-config`, `arg-replace` and `arg-target`, use commas to separate multiple values (e.g., `arg-var: key1=value1,key2=value2`).
198
196
199
-
<details><summary>Toggle view of all available CLI arguments.</summary>
200
-
201
197
</br>
202
198
199
+
Applicable to respective "plan" and "apply" `command` inputs ("init" included).
0 commit comments