Use $RUNNER_TEMP when TF_CLI_CONFIG_FILE not in use

If you don't specify the TF_CLI_CONFIG_FILE environment variable, the default config is written to $HOME directory, which could theoretically be shared by multiple runners when using self-hosted runners. When TF_CLI_CONFIG_FILE is _not_ in use, I replaced the usage of $HOME with the directory $RUNNER_TEMP, whose setup/cleanup is managed by the runner framework and exported a TF_CLI_CONFIG_FILE.
hashicorp · Nov 9, 2022 · c9de504 · c9de504
1 parent 633666f
commit c9de504
Show file tree

Hide file tree

Showing 4 changed files with 44 additions and 70 deletions.
diff --git a/.github/workflows/setup-terraform.yml b/.github/workflows/setup-terraform.yml
@@ -116,17 +116,10 @@ jobs:
       with:
         cli_config_credentials_token: ${{ env.TF_CLOUD_API_TOKEN }}
 
-    - name: Validate Terraform Credentials (Windows)
-      if: runner.os == 'Windows'
+    - name: Validate Terraform Credentials
       run: |
-        cat ${APPDATA}/terraform.rc | grep 'credentials "app.terraform.io"'
-        cat ${APPDATA}/terraform.rc | grep 'token = "${{ env.TF_CLOUD_API_TOKEN }}"'
-
-    - name: Validate Teraform Credentials (Linux & macOS)
-      if: runner.os != 'Windows'
-      run: |
-        cat ${HOME}/.terraformrc | grep 'credentials "app.terraform.io"'
-        cat ${HOME}/.terraformrc | grep 'token = "${{ env.TF_CLOUD_API_TOKEN }}"'
+        cat ${RUNNER_TEMP}/setup-terraform.tfrc | grep 'credentials "app.terraform.io"'
+        cat ${RUNNER_TEMP}/setup-terraform.tfrc | grep 'token = "${{ env.TF_CLOUD_API_TOKEN }
 
   terraform-credentials-enterprise:
     name: 'Terraform Enterprise Credentials'
@@ -146,17 +139,10 @@ jobs:
         cli_config_credentials_hostname: 'terraform.example.com'
         cli_config_credentials_token: ${{ env.TF_CLOUD_API_TOKEN }}
 
-    - name: Validate Terraform Credentials (Windows)
-      if: runner.os == 'Windows'
-      run: |
-        cat ${APPDATA}/terraform.rc | grep 'credentials "terraform.example.com"'
-        cat ${APPDATA}/terraform.rc | grep 'token = "${{ env.TF_CLOUD_API_TOKEN }}"'
-
-    - name: Validate Teraform Credentials (Linux & macOS)
-      if: runner.os != 'Windows'
+    - name: Validate Terraform Credentials
       run: |
-        cat ${HOME}/.terraformrc | grep 'credentials "terraform.example.com"'
-        cat ${HOME}/.terraformrc | grep 'token = "${{ env.TF_CLOUD_API_TOKEN }}"'
+        cat ${RUNNER_TEMP}/setup-terraform.tfrc | grep 'credentials "terraform.example.com"'
+        cat ${RUNNER_TEMP}/setup-terraform.tfrc | grep 'token = "${{ env.TF_CLOUD_API_TOKEN }}"'
 
   terraform-credentials-none:
     name: 'Terraform No Credentials'
@@ -171,15 +157,9 @@ jobs:
     - name: Setup Terraform
       uses: ./
 
-    - name: Validate Terraform Credentials (Windows)
-      if: runner.os == 'Windows'
-      run: |
-        [[ -f ${APPDATA}/terraform.rc ]] || exit 0
-
-    - name: Validate Teraform Credentials (Linux & macOS)
-      if: runner.os != 'Windows'
+    - name: Validate Teraform Credentials
       run: |
-        [[ -f ${HOME}/.terraformrc ]] || exit 0
+        [[ -f ${RUNNER_TEMP}/setup-terraform.tfrc ]] || exit 0
 
   terraform-arguments:
     name: 'Terraform Arguments'

diff --git a/dist/index.js b/dist/index.js
@@ -103,15 +103,15 @@ credentials "${credentialsHostname}" {
 }`.trim();
   // eslint-enable
 
-  // default to OS-specific path
-  let credsFile = osPlat === 'win32'
-    ? `${process.env.APPDATA}/terraform.rc`
-    : `${process.env.HOME}/.terraformrc`;
-
-  // override with TF_CLI_CONFIG_FILE environment variable
-  credsFile = process.env.TF_CLI_CONFIG_FILE ? process.env.TF_CLI_CONFIG_FILE : credsFile;
+  // set or use the TF_CLI_CONFIG_FILE environment variable
+  let credsFile = process.env.TF_CLI_CONFIG_FILE;
+  if (!credsFile) {
+    credsFile = path.join(process.env.RUNNER_TEMP, 'setup-terraform.tfrc');
+    core.debug(`Default CLI config created as ${credsFile}`);
+    core.exportVariable('TF_CLI_CONFIG_FILE', credsFile);
+  }
 
-  // get containing folder
+  // create containing folder in case it doesn't exist
   const credsFolder = path.dirname(credsFile);
 
   core.debug(`Creating ${credsFolder}`);

diff --git a/lib/setup-terraform.js b/lib/setup-terraform.js
@@ -97,15 +97,15 @@ credentials "${credentialsHostname}" {
 }`.trim();
   // eslint-enable
 
-  // default to OS-specific path
-  let credsFile = osPlat === 'win32'
-    ? `${process.env.APPDATA}/terraform.rc`
-    : `${process.env.HOME}/.terraformrc`;
-
-  // override with TF_CLI_CONFIG_FILE environment variable
-  credsFile = process.env.TF_CLI_CONFIG_FILE ? process.env.TF_CLI_CONFIG_FILE : credsFile;
+  // set or use the TF_CLI_CONFIG_FILE environment variable
+  let credsFile = process.env.TF_CLI_CONFIG_FILE;
+  if (!credsFile) {
+    credsFile = path.join(process.env.RUNNER_TEMP, 'setup-terraform.tfrc');
+    core.debug(`Default CLI config created as ${credsFile}`);
+    core.exportVariable('TF_CLI_CONFIG_FILE', credsFile);
+  }
 
-  // get containing folder
+  // create containing folder in case it doesn't exist
   const credsFolder = path.dirname(credsFile);
 
   core.debug(`Creating ${credsFolder}`);

diff --git a/test/setup-terraform.test.js b/test/setup-terraform.test.js
@@ -23,18 +23,12 @@ const setup = require('../lib/setup-terraform');
 //   .fn(console.error);
 
 describe('Setup Terraform', () => {
-  const HOME = process.env.HOME;
-  const APPDATA = process.env.APPDATA;
-
   beforeEach(() => {
-    process.env.HOME = '/tmp/asdf';
-    process.env.APPDATA = '/tmp/asdf';
+    process.env.RUNNER_TEMP = '/tmp/asdf'
   });
 
   afterEach(async () => {
-    await io.rmRF(process.env.HOME);
-    process.env.HOME = HOME;
-    process.env.APPDATA = APPDATA;
+    await io.rmRF(process.env.RUNNER_TEMP);
   });
 
   test('gets specific version and adds token and hostname on linux, amd64', async () => {
@@ -73,8 +67,8 @@ describe('Setup Terraform', () => {
 
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -118,8 +112,8 @@ describe('Setup Terraform', () => {
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
 
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/terraform.rc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -161,8 +155,8 @@ describe('Setup Terraform', () => {
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
 
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -204,8 +198,8 @@ describe('Setup Terraform', () => {
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
 
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -246,8 +240,8 @@ describe('Setup Terraform', () => {
 
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -288,8 +282,8 @@ describe('Setup Terraform', () => {
 
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -330,8 +324,8 @@ describe('Setup Terraform', () => {
 
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -372,8 +366,8 @@ describe('Setup Terraform', () => {
 
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });
@@ -414,8 +408,8 @@ describe('Setup Terraform', () => {
 
     // downloaded CLI has been added to path
     expect(core.addPath).toHaveBeenCalled();
-    // expect credentials are in ${HOME}.terraformrc
-    const creds = await fs.readFile(`${process.env.HOME}/.terraformrc`, { encoding: 'utf8' });
+    // expect credentials are in ${RUNNER_TEMP}/setup-terraform.tfrc
+    const creds = await fs.readFile(`${process.env.RUNNER_TEMP}/setup-terraform.tfrc`, { encoding: 'utf8' });
     expect(creds.indexOf(credentialsHostname)).toBeGreaterThan(-1);
     expect(creds.indexOf(credentialsToken)).toBeGreaterThan(-1);
   });