terraform-github-actions

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.44.0 to use exactly this release
• @v1.44 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Outdated comments are now minimised in the GitHub UI, making it easier to find the most recent plan.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.43.0 to use exactly this release
• @v1.43 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• New dflook/terraform-test and dflook/tofu-test actions.

  These can be used to run automated tests on Terraform/OpenTofu modules using the built-in test command.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.42.1 to use exactly this release
• @v1.42 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• required_version constraints that prefix the version number with v now work correctly.

  Previously a required_version constraint like >=v1.0.0 would not be recognised as a valid constraint.
  This does not appear to be documented anywhere, but Terraform does accept them.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.42.0 to use exactly this release
• @v1.42 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• A new GITHUB_DOT_COM_TOKEN environment variable may be set to an authentication token to use for GitHub.com API requests.

  This is only useful to avoid rate limiting when using the actions with GitHub Enterprise together with OpenTofu.

  Normally the GITHUB_TOKEN environment variable is used for API requests. When using GitHub Enterprise, the GITHUB_TOKEN is the token for the GitHub Enterprise instance, and not the GitHub.com API.
  OpenTofu requires the GitHub.com API to fetch release information.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.41.2 to use exactly this release
• @v1.41 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• Integration with Terraform cloud workspaces using Terraform >=1.6.

  Previously, applying a plan to a Terraform cloud workspace that used Terraform >=1.6 would fail.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.41.1 to use exactly this release
• @v1.41 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• Reading the terraform version from a .tool-versions file in the workspace root. Previously this was only working when the .tool-versions file was in a subdirectory of the workspace.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.41.0 to use exactly this release
• @v1.41 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Downloaded OpenTofu checksum files are now verified using the OpenTofu public gpg key, beginning with OpenTofu v1.6.0.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.40.0 to use exactly this release
• @v1.40 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• An optional plan_path input for dflook/terraform-apply, and matching plan_path output for dflook/terraform-plan.

  This allows passing the generated plan from the plan step to the apply step, if you have a secure place to store it.

  The default behaviour when this is not set is unchanged - the apply step will generate a fresh plan and compare it to the plan from the PR comment.
  By passing the plan from the plan step to the apply step, the apply step will skip generating a plan and use the passed plan instead.
  It must still match the plan in the PR comment.

  This can be much faster than planning the same change twice, but is not necessarily a better choice. See the dflook/terraform-apply docs for details.

• A new to_import output for dflook/terraform-plan, which is the number of resources that would be imported by the plan.

  This joins the existing to_add, to_change, to_destroy and to_move outputs.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.39.0 to use exactly this release
• @v1.39 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Coloured highlighting for the plan in PR comments.

  The plan shown in PR comments now uses diff syntax highlighting, making it easier to see the effect of the plan.

Fixed

• Some workarounds were added for defective self-hosted runners that run docker based actions in broken environments.

  This includes Actions Runner Controller with containerMode: "kubernetes".

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.38.0 to use exactly this release
• @v1.38 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Terraform outputs are added to the PR comment after the plan is applied.

  This is useful for seeing the values of outputs that are only available after apply, e.g. the public IP of a created resource.
  Previously this was only visible in the workflow log.

• The new always-new option for the add_github_comment input of dflook/terraform-plan.

  This will always add a new comment for each plan that is generated, instead of updating an existing comment if one exists.
  This can be preferable if you are iterating on a plan and want to see each plan in the correct place in the PR timeline.

  The default behaviour is unchanged and will update an existing comment if one exists, hiding outdated plans. The history of the plan is visible in the comment history.

Changed

• PR comments will no longer be updated once a plan has been applied.

  When dflook/terraform-apply applies a plan, any PR comment will be updated with the results of the apply, and then no further updates will be made. Any further plans generated by dflook/terraform-plan will result in a new plan in a different PR comment.

  This is to avoid the comment being updated after the plan has been applied, which can be confusing.
  This would only happen if your workflow is to apply changes before merging the PR.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.37.0 to use exactly this release
• @v1.37 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Experimental support for OpenTofu.

  New tofu actions have been added that are identical to the terraform actions, but uses OpenTofu instead of Terraform for versions >=1.6.0:

  • dflook/tofu-version
  • dflook/tofu-remote-state
  • dflook/tofu-output
  • dflook/tofu-validate
  • dflook/tofu-fmt-check
  • dflook/tofu-fmt
  • dflook/tofu-check
  • dflook/tofu-plan
  • dflook/tofu-apply
  • dflook/tofu-destroy
  • dflook/tofu-new-workspace
  • dflook/tofu-destroy-workspace
  • dflook/tofu-unlock-state

  As OpenTofu currently only has pre-release versions, OpenTofu will only be selected by using the exact version number.
  The easiest way to do this is by setting the OPENTOFU_VERSION environment variable, e.g in your workflow:

    env:
        OPENTOFU_VERSION: 1.6.0-alpha3
  

  Setting OPENTOFU_VERSION with the dflook/terraform-* actions will cause it to behave as if it was the dflook/tofu-* action.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.36.2 to use exactly this release
• @v1.36 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• When no terraform version is specified and no state file exists the actions will now use the latest terraform version, instead of incorrectly using Terraform 0.9.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.36.1 to use exactly this release
• @v1.36 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• The selected workspace was not being shown in the workflow log when using a partial cloud block.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.36.0 to use exactly this release
• @v1.36 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Support for being triggered by repository_dispatch events.

  Previously dflook/terraform-plan and dflook/terraform-apply couldn't work with PR comments when triggered by repository_dispatch events. With this change repository_dispatch events that include the PR api url in the client payload will be able to use PR comments.

  The minimum client payload looks like:

  {
    "pull_request": {
      "url": "https://api.github.com/repos/dflook/terraform-github-actions/pulls/1"
    }
  }
  

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.35.0 to use exactly this release
• @v1.35 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• Support for partial or empty cloud blocks. This means you can use a placeholder cloud block in your terraform, like so:

terraform {
  cloud {
  }
}

The configuration will be completed with the TF_CLOUD_ORGANIZATION and TF_CLOUD_HOSTNAME environment variables - the workspace should be specified using the workspace input.
As always, any tokens can be supplied in the TERRAFORM_CLOUD_TOKENS environment variable.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.34.0 to use exactly this release
• @v1.34 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• The action image now also builds for arm64, meaning these actions will work on linux/arm64 runners.

Fixed

• Workaround Terraform 1.4.0 sometimes forgetting to output anything.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.33.0 to use exactly this release
• @v1.33 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• The dflook/terraform-plan and dflook/terraform-apply actions now have a destroy input.
  When setting destroy: true terraform will run in destroy mode, planning the destruction of all resources.
  This allows reviewing the effect of a destroy before applying it.

  The dflook/terraform-destroy action is unchanged and will still immediately destroy all resources.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.32.1 to use exactly this release
• @v1.32 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• When triggered by issue_comment or pull_request_review_comment events, the action will again add a 👍 reaction to the comment. This stopped working in v1.30.0

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.32.0 to use exactly this release
• @v1.32 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Added

• A new dflook/terraform-state-unlock action. Thanks patricktalmeida for working on this!
• Actions that fail because the state was locked will now have the failure-reason output set to state-locked.
  They also have a new lock-info output which is a json object with any available lock information.
  This affects dflook/terraform-apply, dflook/terraform-destroy, and dflook/terraform-destroy-worksapce.

Changed

• If a terraform operation fails because the state is locked the failure-reason output will now be set to state-locked, where before it may have been apply-failed or destroy-failed.

All the terraform actions in this repository are released as one.
Use the actions as part of a GitHub Actions workflow, e.g:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - uses: dflook/[email protected]
      with:
        path: my-terraform-config

You can specify an action version as:

• @v1.31.1 to use exactly this release
• @v1.31 to use the latest patch release for this specific minor version
• @v1 to use the latest patch release for this specific major version

Changes

Fixed

• Failing to read backend config files for the purpose of identifying the backend state. This meant multiple plans with only
  different backend config files would overwrite each others PR comments.