terraform-github-actions

tofu-plan action

This is one of a suite of OpenTofu related actions - find them at dflook/terraform-github-actions.

This action generates an OpenTofu plan. If the triggering event relates to a PR it will add a comment on the PR containing the generated plan.

The GITHUB_TOKEN environment variable must be set for the PR comment to be added. The action can be run on other events, which prints the plan to the workflow log.

The dflook/tofu-apply action can be used to apply the generated plan.

Inputs

Outputs

Environment Variables

Workflow events

When adding the plan to a PR comment (add_github_comment is not false), the workflow can be triggered by the following events:

When add_github_comment is set to false, the workflow can be triggered by any event.

issue_comment

This event triggers workflows when a comment is made in a Issue, as well as a Pull Request. Since running the action will only work in the context of a PR, the workflow should check that the comment is on a PR before running.

Also take care to checkout the PR ref.

jobs:
  plan:
    if: $
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: $
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: refs/pull/$/merge

      - name: tofu apply
        uses: dflook/tofu-plan@v1
        with:
          path: my-tofu-config

push

The pushed commit must have come from a Pull Request. Typically this is used to trigger a workflow that runs on the main branch after a PR has been merged.

repository_dispatch

This event can be used to trigger a workflow from another workflow. The client payload must include the pull_request api url of where the plan PR comment should be added.

A minimal example payload looks like:

{
  "pull_request": {
    "url": "https://api.github.com/repos/dflook/terraform-github-actions/pulls/1"
  }
}

Example usage

Automatically generating a plan

This example workflow runs on every push to an open pull request, and create or updates a comment with the tofu plan

name: PR Plan

on: [pull_request]

permissions:
  contents: read
  pull-requests: write

jobs:
  plan:
    runs-on: ubuntu-latest
    name: Create tofu plan
    env:
      GITHUB_TOKEN: $            
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: tofu plan
        uses: dflook/tofu-plan@v1
        with:
          path: my-tofu-config

A full example of inputs

This example workflow demonstrates most of the available inputs:

name: PR Plan

on: [pull_request]

env:
  GITHUB_TOKEN: $
  TERRAFORM_CLOUD_TOKENS: tofu.example.com=$
  TERRAFORM_SSH_KEY: $

permissions:
  contents: read
  pull-requests: write

jobs:
  plan:
    runs-on: ubuntu-latest
    name: Create OpenTofu plan
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: tofu plan
        uses: dflook/tofu-plan@v1
        with:
          path: my-tofu-config
          label: production
          workspace: prod
          var_file: env/prod.tfvars
          variables: |
            turbo_mode=true
          backend_config_file: env/prod.backend
          backend_config: token=$

Generating a plan using a comment

This workflow generates a plan on demand, triggered by someone commenting tofu plan on the PR. The action will create or update a comment on the PR with the generated plan.

name: OpenTofu Plan

on: [issue_comment]

permissions:
  contents: read
  pull-requests: write

jobs:
  plan:
    if: $
    runs-on: ubuntu-latest
    name: Create OpenTofu plan
    env:
      GITHUB_TOKEN: $
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: refs/pull/$/merge

      - name: tofu plan
        uses: dflook/tofu-plan@v1
        with:
          path: my-tofu-config