chore(deps): update terraform infisical to ~> 0.19 #572
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR OpenTofu Plan (develop branch) | |
| on: | |
| pull_request: | |
| branches: | |
| - develop | |
| types: [opened, synchronize, reopened] | |
| concurrency: | |
| group: tofu-plan-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: read | |
| pull-requests: write | |
| jobs: | |
| # Detect which files changed to determine if we need to run plan | |
| changes: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| infra: ${{ steps.filter.outputs.infra }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for infrastructure file changes | |
| uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| # Use the PR's base branch for comparison | |
| base: ${{ github.base_ref }} | |
| filters: | | |
| infra: | |
| - 'opentofu/**/*.tofu' | |
| - 'opentofu/**/*.tfvars' | |
| - 'opentofu/**/*.bu' | |
| - 'opentofu/**/*.tftpl' | |
| - 'opentofu/**/*.sh' | |
| - 'opentofu/**/userdata/**' | |
| - 'docker/scripts/**' | |
| tofu-plan: | |
| needs: changes | |
| if: needs.changes.outputs.infra == 'true' | |
| runs-on: ubuntu-latest | |
| environment: dev-ci | |
| steps: | |
| - name: Install Bitwarden Secrets Manager CLI (bws) | |
| run: | | |
| set -euo pipefail | |
| curl -fsSL \ | |
| https://github.com/bitwarden/sdk-sm/releases/download/bws-v1.0.0/bws-x86_64-unknown-linux-gnu-1.0.0.zip \ | |
| -o /tmp/bws.zip | |
| unzip -q /tmp/bws.zip -d /tmp/bws | |
| sudo mv /tmp/bws/bws /usr/local/bin/bws | |
| sudo chmod +x /usr/local/bin/bws | |
| bws --version | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| # Required if the GHCR image is private | |
| - name: Log in to GHCR | |
| env: | |
| GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} | |
| run: | | |
| docker login ghcr.io -u "noahwhite" --password-stdin <<< "$GHCR_TOKEN" | |
| - name: Pull OpenTofu tools image | |
| run: | | |
| docker pull ghcr.io/noahwhite/ghost-stack-shell:latest | |
| - name: Retrieve secrets via infra-shell.sh (CI mode) | |
| env: | |
| BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }} | |
| # GitHub repository variable for R2 bucket name | |
| BOOTSTRAP_R2_BUCKET_DEV: ${{ vars.BOOTSTRAP_R2_BUCKET_DEV }} | |
| # GitHub environment secret for workstation IP (used for SSH firewall rules) | |
| ADMIN_IP: ${{ secrets.ADMIN_IP }} | |
| # GitHub environment secret for Cloudflare Zone ID (from bootstrap outputs) | |
| CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }} | |
| run: | | |
| ./docker/scripts/infra-shell.sh --ci --secrets-only --export-github-env | |
| - name: Fix workspace permissions for Docker container | |
| run: | | |
| # Make opentofu directory writable by all users so the container's devops user can create .terraform directories | |
| chmod -R a+w "${GITHUB_WORKSPACE}/opentofu" | |
| - name: Run OpenTofu init | |
| env: | |
| TF_VAR_cloudflare_account_id: ${{ env.TF_VAR_cloudflare_account_id }} | |
| TF_VAR_cloudflare_api_token: ${{ env.TF_VAR_cloudflare_api_token }} | |
| R2_ACCESS_KEY_ID: ${{ env.R2_ACCESS_KEY_ID }} | |
| R2_SECRET_ACCESS_KEY: ${{ env.R2_SECRET_ACCESS_KEY }} | |
| TF_VAR_vultr_api_key: ${{ env.TF_VAR_vultr_api_key }} | |
| TAILSCALE_API_KEY: ${{ env.TAILSCALE_API_KEY }} | |
| TAILSCALE_TAILNET: ${{ env.TAILSCALE_TAILNET }} | |
| TF_VAR_tailscale_tailnet: ${{ env.TF_VAR_tailscale_tailnet }} | |
| TF_VAR_PD_CLIENT_ID: ${{ env.TF_VAR_PD_CLIENT_ID }} | |
| TF_VAR_PD_CLIENT_SECRET: ${{ env.TF_VAR_PD_CLIENT_SECRET }} | |
| TF_VAR_pd_subdomain: ${{ env.TF_VAR_pd_subdomain }} | |
| TF_VAR_pd_user_tok: ${{ env.TF_VAR_pd_user_tok }} | |
| TF_VAR_GC_ACCESS_TOK: ${{ env.TF_VAR_GC_ACCESS_TOK }} | |
| TF_VAR_SOC_DEV_TERRAFORM_SA_TOK: ${{ env.TF_VAR_SOC_DEV_TERRAFORM_SA_TOK }} | |
| TF_BACKEND_BUCKET: ${{ env.TF_BACKEND_BUCKET }} | |
| run: | | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/home/devops/app" \ | |
| -w /home/devops/app \ | |
| -e TF_VAR_cloudflare_account_id \ | |
| -e TF_VAR_cloudflare_api_token \ | |
| -e R2_ACCESS_KEY_ID \ | |
| -e R2_SECRET_ACCESS_KEY \ | |
| -e TF_VAR_vultr_api_key \ | |
| -e TAILSCALE_API_KEY \ | |
| -e TAILSCALE_TAILNET \ | |
| -e TF_VAR_tailscale_tailnet \ | |
| -e TF_VAR_PD_CLIENT_ID \ | |
| -e TF_VAR_PD_CLIENT_SECRET \ | |
| -e TF_VAR_pd_subdomain \ | |
| -e TF_VAR_pd_user_tok \ | |
| -e TF_VAR_GC_ACCESS_TOK \ | |
| -e TF_VAR_SOC_DEV_TERRAFORM_SA_TOK \ | |
| -e TF_BACKEND_BUCKET \ | |
| ghcr.io/noahwhite/ghost-stack-shell:latest \ | |
| bash -c "git config --global --add safe.directory /home/devops/app && ./opentofu/scripts/tofu.sh dev init" | |
| - name: Run OpenTofu validate | |
| env: | |
| TF_VAR_cloudflare_account_id: ${{ env.TF_VAR_cloudflare_account_id }} | |
| TF_VAR_cloudflare_api_token: ${{ env.TF_VAR_cloudflare_api_token }} | |
| R2_ACCESS_KEY_ID: ${{ env.R2_ACCESS_KEY_ID }} | |
| R2_SECRET_ACCESS_KEY: ${{ env.R2_SECRET_ACCESS_KEY }} | |
| TF_BACKEND_BUCKET: ${{ env.TF_BACKEND_BUCKET }} | |
| TF_VAR_infisical_client_id: ${{ env.TF_VAR_infisical_client_id }} | |
| TF_VAR_infisical_client_secret: ${{ env.TF_VAR_infisical_client_secret }} | |
| TF_VAR_infisical_org_id: ${{ env.TF_VAR_infisical_org_id }} | |
| run: | | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/home/devops/app" \ | |
| -w /home/devops/app \ | |
| -e TF_VAR_cloudflare_account_id \ | |
| -e TF_VAR_cloudflare_api_token \ | |
| -e R2_ACCESS_KEY_ID \ | |
| -e R2_SECRET_ACCESS_KEY \ | |
| -e TF_BACKEND_BUCKET \ | |
| -e TF_VAR_infisical_client_id \ | |
| -e TF_VAR_infisical_client_secret \ | |
| -e TF_VAR_infisical_org_id \ | |
| ghcr.io/noahwhite/ghost-stack-shell:latest \ | |
| bash -c "git config --global --add safe.directory /home/devops/app && tofu -chdir=opentofu/envs/dev validate" | |
| - name: Run OpenTofu plan | |
| env: | |
| TF_VAR_cloudflare_account_id: ${{ env.TF_VAR_cloudflare_account_id }} | |
| TF_VAR_cloudflare_api_token: ${{ env.TF_VAR_cloudflare_api_token }} | |
| R2_ACCESS_KEY_ID: ${{ env.R2_ACCESS_KEY_ID }} | |
| R2_SECRET_ACCESS_KEY: ${{ env.R2_SECRET_ACCESS_KEY }} | |
| TF_VAR_vultr_api_key: ${{ env.TF_VAR_vultr_api_key }} | |
| TAILSCALE_API_KEY: ${{ env.TAILSCALE_API_KEY }} | |
| TAILSCALE_TAILNET: ${{ env.TAILSCALE_TAILNET }} | |
| TF_VAR_tailscale_tailnet: ${{ env.TF_VAR_tailscale_tailnet }} | |
| TF_VAR_PD_CLIENT_ID: ${{ env.TF_VAR_PD_CLIENT_ID }} | |
| TF_VAR_PD_CLIENT_SECRET: ${{ env.TF_VAR_PD_CLIENT_SECRET }} | |
| TF_VAR_pd_subdomain: ${{ env.TF_VAR_pd_subdomain }} | |
| TF_VAR_pd_user_tok: ${{ env.TF_VAR_pd_user_tok }} | |
| TF_VAR_GC_ACCESS_TOK: ${{ env.TF_VAR_GC_ACCESS_TOK }} | |
| TF_VAR_SOC_DEV_TERRAFORM_SA_TOK: ${{ env.TF_VAR_SOC_DEV_TERRAFORM_SA_TOK }} | |
| TF_BACKEND_BUCKET: ${{ env.TF_BACKEND_BUCKET }} | |
| TF_VAR_admin_subnets: ${{ env.TF_VAR_admin_subnets }} | |
| TF_VAR_admin_ip: ${{ env.TF_VAR_admin_ip }} | |
| TF_VAR_ssh_public_key: ${{ env.TF_VAR_ssh_public_key }} | |
| TF_VAR_cloudflare_zone_id: ${{ env.TF_VAR_cloudflare_zone_id }} | |
| TF_VAR_infisical_client_id: ${{ env.TF_VAR_infisical_client_id }} | |
| TF_VAR_infisical_client_secret: ${{ env.TF_VAR_infisical_client_secret }} | |
| TF_VAR_infisical_org_id: ${{ env.TF_VAR_infisical_org_id }} | |
| run: | | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/home/devops/app" \ | |
| -w /home/devops/app \ | |
| -e TF_VAR_cloudflare_account_id \ | |
| -e TF_VAR_cloudflare_api_token \ | |
| -e R2_ACCESS_KEY_ID \ | |
| -e R2_SECRET_ACCESS_KEY \ | |
| -e TF_VAR_vultr_api_key \ | |
| -e TAILSCALE_API_KEY \ | |
| -e TAILSCALE_TAILNET \ | |
| -e TF_VAR_tailscale_tailnet \ | |
| -e TF_VAR_PD_CLIENT_ID \ | |
| -e TF_VAR_PD_CLIENT_SECRET \ | |
| -e TF_VAR_pd_subdomain \ | |
| -e TF_VAR_pd_user_tok \ | |
| -e TF_VAR_GC_ACCESS_TOK \ | |
| -e TF_VAR_SOC_DEV_TERRAFORM_SA_TOK \ | |
| -e TF_BACKEND_BUCKET \ | |
| -e TF_VAR_admin_subnets \ | |
| -e TF_VAR_admin_ip \ | |
| -e TF_VAR_ssh_public_key \ | |
| -e TF_VAR_cloudflare_zone_id \ | |
| -e TF_VAR_infisical_client_id \ | |
| -e TF_VAR_infisical_client_secret \ | |
| -e TF_VAR_infisical_org_id \ | |
| ghcr.io/noahwhite/ghost-stack-shell:latest \ | |
| bash -c "git config --global --add safe.directory /home/devops/app && ./opentofu/scripts/tofu.sh dev plan -out=tfplan" | |
| - name: Generate human-readable plan output | |
| run: | | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/home/devops/app" \ | |
| -w /home/devops/app \ | |
| ghcr.io/noahwhite/ghost-stack-shell:latest \ | |
| bash -c "git config --global --add safe.directory /home/devops/app && tofu -chdir=opentofu/envs/dev show -no-color tfplan > opentofu/envs/dev/plan-output.txt" | |
| - name: Upload plan as artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: tofu-plan-dev-${{ github.event.pull_request.number }} | |
| path: opentofu/envs/dev/plan-output.txt | |
| retention-days: 30 | |
| # Summary job that always runs to provide clear status | |
| status: | |
| needs: [changes, tofu-plan] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check status | |
| run: | | |
| if [[ "${{ needs.changes.outputs.infra }}" != "true" ]]; then | |
| echo "✅ Skipped: No infrastructure files changed" | |
| echo " Deployment will be skipped when this PR is merged." | |
| exit 0 | |
| fi | |
| if [[ "${{ needs.tofu-plan.result }}" == "success" ]]; then | |
| echo "✅ OpenTofu plan completed successfully" | |
| exit 0 | |
| fi | |
| echo "❌ OpenTofu plan failed" | |
| exit 1 |