Terraform Plan GitHub Action

Runs terraform plan on your project and posts a comment with the changes on a Pull Request (PR). It runs the following commands:

terraform init
terraform validate
terraform fmt --check
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan 

This action does not install Terraform or Terragrunt, but can be installed using Terraform tools setup action. You can see how it's used in the pr-test.yaml workflow.

Settings

Use the following to control the action:

Setting	Description	Default
allow-failure	Allow the action to fail	false
comment	Add comment with changes to the PR	true
comment-delete	Delete previous comments made by the bot on the PR	false
comment-title	The title to give the PR comment	Plan changes
conftest-character-limit	Character limit for Conftest output	2000
conftest-checks	Location of custom conftest check definitions	git::https://github.com/cds-snc/opa_checks.git//aws_terraform
directory	Directory with the *.tf files to validate	.
github-token	GitHub Token used to add comment to PR (required to add comments).
plan-character-limit	Character limit for Terraform plan output	30000
terraform-init	Custom Terraform init args
terragrunt	Use Terragrunt instead of Terraform	false
skip-conftest	Skip the Conftest step	false
skip-fmt	Skip the Terraform format check	false
skip-plan	Skip the Terraform plan for projects without a remote state	false
init-run-all	Run init across all modules (only applicable for terragrunt).	false

Examples

# Setup Terraform, Terragrunt, and Conftest
- name: Setup terraform tools
  uses: cds-snc/terraform-tools-setup@v1

# Run Terraform plan and add a comment with changes on the PR
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}

# Use Terragrunt, allow failure and set a custom PR comment title
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    allow-failure: true
    comment-title: Custom comment title
    github-token: ${{ secrets.GITHUB_TOKEN }}
    terragrunt: true

# Run on a sub project folder, deleting previous PR comments made by the action
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    directory: ./infra
    comment-delete: true
    github-token: ${{ secrets.GITHUB_TOKEN }}

# Run Terraform plan with no PR comment
# Plan will still availabe in the workflow logs
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    add-comment: false

# Run Terraform plan custom Terraform init args
- name: Terraform plan
  uses: cds-snc/terraform-plan
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    terraform-init: |
      -backend-config="bucket=your-state-bucket-name"
      -backend-config="region=ca-central-1"

Contributing

To setup your local dev environment:

npm install
npm run prepare

Husky provides a pre-commit hook that builds the dist/index.js used by the action. To test locally, nektos/act works well.

Policy

Open Policy Agent is used to check the terraform plan for changes. Policies are written in Rego and then compiled into a WebAssembly module using npm run policy.