terraform-github-actions

terraform-apply action

This is one of a suite of Terraform related actions - find them at dflook/terraform-github-actions.

This action applies a Terraform plan. The default behaviour is to apply the plan that has been added to a PR using the dflook/terraform-plan action.

If the plan is not found or has changed, then the apply action will fail. This is to ensure that the action only applies changes that have been reviewed by a human.

You can instead set auto_approve: true which will generate a plan and apply it immediately, without looking for a plan attached to a PR.

Demo

This a demo of the process for apply a Terraform change using the dflook/terraform-plan and dflook/terraform-apply actions.

GitHub

To make best use of this action, require that the plan is always reviewed before merging the PR to approve. You can enforce this in github by going to the branch settings for the repo and enable protection for the main branch:

  1. Enable ‘Require pull request reviews before merging’
  2. Check ‘Dismiss stale pull request approvals when new commits are pushed’
  3. Enable ‘Require status checks to pass before merging’, and select the job that runs the plan.
  4. Enable ‘Require branches to be up to date before merging’

Inputs

These input values must be the same as any dflook/terraform-plan for the same configuration. (unless auto_approve: true)

Outputs

Environment Variables

Workflow events

When applying a plan from a PR comment (auto_approve is the default of false), the workflow can be triggered by the following events:

When auto_approve is set to true, the workflow can be triggered by any event.

issue_comment

This event triggers workflows when a comment is made in a Issue or a Pull Request. Since running the action will only work in the context of a PR, the workflow should check that the comment is on a PR before running.

Also take care to checkout the PR ref.

jobs:
  apply:
    if: $
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: $
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: refs/pull/$/merge

      - name: terraform apply
        uses: dflook/terraform-apply@v1
        with:
          path: my-terraform-config

push

The pushed commit must have come from a Pull Request. Typically this is used to trigger a workflow that runs on the main branch after a PR has been merged.

repository_dispatch

This event can be used to trigger a workflow from another workflow. The client payload must include the pull_request api url of where the plan PR comment can be found.

A minimal example payload looks like:

{
  "pull_request": {
    "url": "https://api.github.com/repos/dflook/terraform-github-actions/pulls/1"
  }
}

Example usage

Apply PR approved plans

This example workflow runs for every push to main. If the commit came from a PR that has been merged, applies the plan from the PR.

name: Apply

on:
  push:
    branches:
      - main

permissions:
  contents: read
  pull-requests: write

jobs:
  apply:
    runs-on: ubuntu-latest
    name: Apply approved plan
    env:
      GITHUB_TOKEN: $
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: terraform apply
        uses: dflook/terraform-apply@v1
        with:
          path: my-terraform-config

Always apply changes

This example workflow runs for every push to main. Changes are planned and applied.

name: Apply

on:
  push:
    branches:
      - main

jobs:
  apply:
    runs-on: ubuntu-latest
    name: Apply Terraform
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: terraform apply
        uses: dflook/terraform-apply@v1
        with:
          path: my-terraform-config
          auto_approve: true

Apply specific resources

This example workflow runs every morning and updates a TLS certificate if necessary.

name: Rotate certs

on:
  schedule:
    - cron:  "0 8 * * *"

jobs:
  apply:
    runs-on: ubuntu-latest
    name: Rotate certs
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: terraform apply
        uses: dflook/terraform-apply@v1
        with:
          path: my-terraform-config
          auto_approve: true
          target: |
            kubernetes_secret.tls_cert_public
            kubernetes_secret.tls_cert_private

Applying a plan using a comment

This workflow applies a plan on demand, triggered by someone commenting terraform apply on the PR. The plan is taken from an existing comment generated by the dflook/terraform-plan action.

name: Terraform Apply

on: [issue_comment]

jobs:
  apply:
    if: $
    runs-on: ubuntu-latest
    name: Apply Terraform plan
    env:
      GITHUB_TOKEN: $
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: refs/pull/$/merge

      - name: Terraform apply
        uses: dflook/terraform-apply@v1
        with:
          path: my-terraform-config

This example retries the terraform apply operation if it fails.

name: Apply plan

on:
  push:
    branches:
      - main

permissions:
  contents: read
  pull-requests: write

jobs:
  plan:
    runs-on: ubuntu-latest
    name: Apply Terraform plan
    env:
      GITHUB_TOKEN: $
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: terraform apply
        uses: dflook/terraform-apply@v1
        continue-on-error: true
        id: first_try
        with:
          path: terraform

      - name: Retry failed apply
        uses: dflook/terraform-apply@v1
        if: $
        with:
          path: terraform
          auto_approve: true