Skip to content

Commit cfdc2dd

Browse files
dflookdflook
committed
Add plan_path for plan/apply
1 parent aa00041 commit cfdc2dd

File tree

14 files changed

+273
-53
lines changed

14 files changed

+273
-53
lines changed

‎.github/workflows/test-binary-plan.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Test terraform-binary-plan
2+
3+
on:
4+
- pull_request
5+
6+
jobs:
7+
missing_plan_path:
8+
runs-on: ubuntu-latest
9+
name: Auto Approve
10+
steps:
11+
- name: Checkout
12+
uses: actions/checkout@v3
13+
14+
- name: Apply
15+
uses: ./terraform-apply
16+
id: apply
17+
continue-on-error: true
18+
with:
19+
path: tests/workflows/test-binary-plan
20+
plan_path: hello.tfplan
21+
auto_approve: true
22+
23+
- name: Verify outputs
24+
run: |
25+
if [[ "${{ steps.apply.outcome }}" != "failure" ]]; then
26+
echo "Apply did not fail correctly"
27+
exit 1
28+
fi
29+
30+
apply:
31+
runs-on: ubuntu-latest
32+
name: Apply approved changes
33+
env:
34+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
steps:
36+
- name: Checkout
37+
uses: actions/checkout@v3
38+
39+
- name: Plan
40+
uses: ./terraform-plan
41+
id: plan
42+
with:
43+
label: test-binary-plan apply
44+
path: tests/workflows/test-binary-plan
45+
46+
- name: Apply
47+
uses: ./terraform-apply
48+
id: first-apply
49+
with:
50+
label: test-binary-plan apply
51+
path: tests/workflows/test-binary-plan
52+
plan_path: ${{ steps.plan.outputs.plan_path }}
53+
54+
auto_approve:
55+
runs-on: ubuntu-latest
56+
name: Apply approved changes
57+
steps:
58+
- name: Checkout
59+
uses: actions/checkout@v3
60+
61+
- name: Plan
62+
uses: ./terraform-plan
63+
id: plan
64+
with:
65+
label: test-binary-plan auto_approve
66+
path: tests/workflows/test-binary-plan
67+
add_github_comment: false
68+
69+
- name: Apply
70+
uses: ./terraform-apply
71+
with:
72+
label: test-binary-plan auto_approve
73+
path: tests/workflows/test-binary-plan
74+
plan_path: ${{ steps.plan.outputs.plan_path }}
75+
auto_approve: true
76+
77+
plan_changed:
78+
runs-on: ubuntu-latest
79+
name: Apply should fail if the approved plan has changed
80+
env:
81+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
82+
steps:
83+
- name: Checkout
84+
uses: actions/checkout@v3
85+
86+
- name: Plan
87+
uses: ./terraform-plan
88+
id: plan
89+
with:
90+
label: test-binary-plan apply
91+
path: tests/workflows/test-binary-plan
92+
93+
- name: Plan
94+
uses: ./terraform-plan
95+
with:
96+
label: test-binary-plan apply
97+
path: tests/workflows/test-binary-plan
98+
99+
- name: Apply
100+
uses: ./terraform-apply
101+
with:
102+
label: test-binary-plan apply
103+
path: tests/workflows/test-binary-plan
104+
plan_path: ${{ steps.plan.outputs.plan_path }}

‎.github/workflows/test-plan.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ jobs:
3838
echo "::error:: text_plan_path not set correctly"
3939
exit 1
4040
fi
41+
42+
if ! [[ -f '${{ steps.plan.outputs.plan_path }}' ]]; then
43+
echo "::error:: plan_path not set correctly"
44+
exit 1
45+
fi
4146
4247
if [[ -n "${{ steps.apply.outputs.run_id }}" ]]; then
4348
echo "::error:: run_id should not be set"

‎image/entrypoints/apply.sh‎

Lines changed: 62 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -77,49 +77,58 @@ function apply() {
7777

7878
### Generate a plan
7979

80-
plan
81-
82-
if [[ $PLAN_EXIT -eq 1 ]]; then
83-
if grep -q "Saving a generated plan is currently not supported" "$STEP_TMP_DIR/terraform_plan.stderr"; then
84-
set-remote-plan-args
85-
PLAN_OUT=""
86-
87-
if [[ "$INPUT_AUTO_APPROVE" == "true" ]]; then
88-
# The apply will have to generate the plan, so skip doing it now
89-
PLAN_EXIT=2
90-
else
91-
plan
92-
fi
93-
fi
94-
fi
95-
96-
if [[ $PLAN_EXIT -eq 1 ]]; then
97-
cat >&2 "$STEP_TMP_DIR/terraform_plan.stderr"
98-
99-
if lock-info "$STEP_TMP_DIR/terraform_plan.stderr"; then
100-
set_output failure-reason state-locked
101-
fi
102-
103-
update_comment error
104-
exit 1
105-
fi
80+
if [[ "$INPUT_PLAN_PATH" != "" ]]; then
81+
if [[ ! -f "$INPUT_PLAN_PATH" ]]; then
82+
echo "Plan file '$INPUT_PLAN_PATH' does not exist"
83+
exit 1
84+
fi
10685

107-
if [[ -z "$PLAN_OUT" && "$INPUT_AUTO_APPROVE" == "true" ]]; then
108-
# Since we are doing an auto approved remote apply there is no point in planning beforehand
109-
# No text_plan_path output for this run
110-
:
86+
PLAN_EXIT=0
11187
else
112-
mkdir -p "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR"
113-
cp "$STEP_TMP_DIR/plan.txt" "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.txt"
114-
set_output text_plan_path "$WORKSPACE_TMP_DIR/plan.txt"
115-
fi
116-
117-
if [[ -n "$PLAN_OUT" ]]; then
118-
if (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME show -json "$PLAN_OUT") >"$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.json" 2>"$STEP_TMP_DIR/terraform_show.stderr"; then
119-
set_output json_plan_path "$WORKSPACE_TMP_DIR/plan.json"
120-
else
121-
debug_file "$STEP_TMP_DIR/terraform_show.stderr"
122-
fi
88+
plan
89+
90+
if [[ $PLAN_EXIT -eq 1 ]]; then
91+
if grep -q "Saving a generated plan is currently not supported" "$STEP_TMP_DIR/terraform_plan.stderr"; then
92+
set-remote-plan-args
93+
PLAN_OUT=""
94+
95+
if [[ "$INPUT_AUTO_APPROVE" == "true" ]]; then
96+
# The apply will have to generate the plan, so skip doing it now
97+
PLAN_EXIT=2
98+
else
99+
plan
100+
fi
101+
fi
102+
fi
103+
104+
if [[ $PLAN_EXIT -eq 1 ]]; then
105+
cat >&2 "$STEP_TMP_DIR/terraform_plan.stderr"
106+
107+
if lock-info "$STEP_TMP_DIR/terraform_plan.stderr"; then
108+
set_output failure-reason state-locked
109+
fi
110+
111+
update_comment error
112+
exit 1
113+
fi
114+
115+
if [[ -z "$PLAN_OUT" && "$INPUT_AUTO_APPROVE" == "true" ]]; then
116+
# Since we are doing an auto approved remote apply there is no point in planning beforehand
117+
# No text_plan_path output for this run
118+
:
119+
else
120+
mkdir -p "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR"
121+
cp "$STEP_TMP_DIR/plan.txt" "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.txt"
122+
set_output text_plan_path "$WORKSPACE_TMP_DIR/plan.txt"
123+
fi
124+
125+
if [[ -n "$PLAN_OUT" ]]; then
126+
if (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME show -json "$PLAN_OUT") >"$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.json" 2>"$STEP_TMP_DIR/terraform_show.stderr"; then
127+
set_output json_plan_path "$WORKSPACE_TMP_DIR/plan.json"
128+
else
129+
debug_file "$STEP_TMP_DIR/terraform_show.stderr"
130+
fi
131+
fi
123132
fi
124133

125134
### Apply the plan
@@ -142,11 +151,19 @@ else
142151
exit 1
143152
fi
144153

145-
if github_pr_comment approved "$STEP_TMP_DIR/plan.txt"; then
146-
apply
154+
if [[ "$INPUT_PLAN_PATH" != "" ]]; then
155+
if github_pr_comment approved-binary "$INPUT_PLAN_PATH"; then
156+
PLAN_OUT=$INPUT_PLAN_PATH
157+
apply
158+
else
159+
exit 1
160+
fi
147161
else
148-
exit 1
162+
if github_pr_comment approved "$STEP_TMP_DIR/plan.txt"; then
163+
apply
164+
else
165+
exit 1
166+
fi
149167
fi
150168

151169
fi
152-

‎image/entrypoints/plan.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ if [[ "$GITHUB_EVENT_NAME" == "pull_request" || "$GITHUB_EVENT_NAME" == "issue_c
6060
TF_CHANGES=true
6161
fi
6262

63-
if ! TF_CHANGES=$TF_CHANGES STATUS=":memo: Plan generated in $(job_markdown_ref)" github_pr_comment plan <"$STEP_TMP_DIR/plan.txt"; then
63+
if ! PLAN_OUT="$PLAN_OUT" TF_CHANGES=$TF_CHANGES STATUS=":memo: Plan generated in $(job_markdown_ref)" github_pr_comment plan <"$STEP_TMP_DIR/plan.txt"; then
6464
exit 1
6565
fi
6666
fi
@@ -91,6 +91,9 @@ cp "$STEP_TMP_DIR/plan.txt" "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.txt"
9191
set_output text_plan_path "$WORKSPACE_TMP_DIR/plan.txt"
9292

9393
if [[ -n "$PLAN_OUT" ]]; then
94+
cp "$PLAN_OUT" "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.tfplan"
95+
set_output plan_path "$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.tfplan"
96+
9497
if (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME show -json "$PLAN_OUT") >"$GITHUB_WORKSPACE/$WORKSPACE_TMP_DIR/plan.json" 2>"$STEP_TMP_DIR/terraform_show.stderr"; then
9598
set_output json_plan_path "$WORKSPACE_TMP_DIR/plan.json"
9699
else

‎image/src/github_pr_comment/__main__.py‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
from github_pr_comment.backend_fingerprint import fingerprint
2121
from github_pr_comment.cmp import plan_cmp, remove_warnings, remove_unchanged_attributes
2222
from github_pr_comment.comment import find_comment, TerraformComment, update_comment, serialize, deserialize
23-
from github_pr_comment.hash import comment_hash, plan_hash
23+
from github_pr_comment.hash import comment_hash, plan_hash, plan_out_hash
2424
from github_pr_comment.plan_formatting import format_diff
2525
from plan_renderer.outputs import render_outputs
2626
from plan_renderer.variables import render_argument_list, Sensitive
@@ -382,6 +382,9 @@ def is_approved(proposed_plan: str, comment: TerraformComment) -> bool:
382382
debug('Approving plan based on plan text')
383383
return plan_cmp(proposed_plan, comment.body)
384384

385+
def is_approved_binary_plan(plan_path: str, comment: TerraformComment) -> bool:
386+
return plan_out_hash(os.environ['PLAN_OUT'], comment.issue_url) == comment.headers['plan_out_hash']
387+
385388
def truncate(text: str, max_size: int, too_big_message: str) -> str:
386389
lines = []
387390
total_size = 0
@@ -504,6 +507,12 @@ def main() -> int:
504507

505508
headers = comment.headers.copy()
506509
headers['plan_job_ref'] = job_workflow_ref()
510+
511+
if os.environ.get('PLAN_OUT', ''):
512+
headers['plan_out_hash'] = plan_out_hash(os.environ['PLAN_OUT'], comment.issue_url)
513+
elif 'plan_out_hash' in headers:
514+
del headers['plan_out_hash']
515+
507516
headers['plan_hash'] = plan_hash(body, comment.issue_url)
508517
format_type = os.environ.get('TF_ACTIONS_PLAN_FORMAT', 'diff')
509518
headers['plan_text_format'], plan_text = format_plan_text(body, format_type)
@@ -565,6 +574,29 @@ def main() -> int:
565574
with open(sys.argv[2], 'w') as f:
566575
f.write(comment.body)
567576

577+
elif sys.argv[1] == 'approved-binary':
578+
579+
if comment.comment_url is None:
580+
sys.stdout.write("Plan not found on PR\n")
581+
sys.stdout.write("Generate the plan first using the dflook/terraform-plan action. Alternatively set the auto_approve input to 'true'\n")
582+
sys.stdout.write("If dflook/terraform-plan was used with add_github_comment set to changes-only, this may mean the plan has since changed to include changes\n")
583+
output('failure-reason', 'plan-changed')
584+
sys.exit(1)
585+
586+
if not is_approved_binary_plan(sys.argv[2], comment):
587+
588+
sys.stdout.write("Not applying the plan - it has changed from the plan on the PR\n")
589+
sys.stdout.write("The plan on the PR must be up to date. Alternatively, set the auto_approve input to 'true' to apply outdated plans\n")
590+
comment = update_comment(github, comment, status=f':x: Plan not applied in {job_markdown_ref()} (Plan has changed)')
591+
592+
if plan_ref := comment.headers.get('plan_job_ref'):
593+
sys.stdout.write(f'\nThis plan is different to the plan generated by the dflook/terraform-plan action in {plan_ref}\n')
594+
595+
output('failure-reason', 'plan-changed')
596+
597+
step_cache['comment'] = serialize(comment)
598+
return 1
599+
568600
elif sys.argv[1] == 'approved':
569601

570602
proposed_plan = remove_warnings(remove_unchanged_attributes(Path(sys.argv[2]).read_text().strip()))

‎image/src/github_pr_comment/hash.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,18 @@ def plan_hash(plan_text: str, salt: str) -> str:
2323
plan = remove_warnings(remove_unchanged_attributes(plan_text))
2424

2525
return comment_hash(plan.encode(), salt)
26+
27+
def plan_out_hash(plan_path: str, salt: str) -> str:
28+
"""
29+
Compute a sha256 hash of the binary plan file
30+
"""
31+
32+
debug(f'Hashing {plan_path} with salt {salt}')
33+
34+
h = hashlib.sha256(f'dflook/terraform-github-actions/{salt}'.encode())
35+
36+
with open(plan_path, 'rb') as f:
37+
while data := f.read(65536):
38+
h.update(data)
39+
40+
return h.hexdigest()

‎terraform-apply/README.md‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ These input values must be the same as any [`dflook/terraform-plan`](https://git
5454
A friendly name for the environment the Terraform configuration is for.
5555
This will be used in the PR comment for easy identification.
5656

57-
It must be the same as the `label` used in the corresponding [`dflook/terraform-plan`](https://github.com/dflook/terraform-github-actions/tree/main/terraform-plan) command.
57+
It must be the same as the `label` used in the corresponding [`dflook/terraform-plan`](https://github.com/dflook/terraform-github-actions/tree/main/terraform-plan) action.
5858

5959
- Type: string
6060
- Optional
@@ -157,11 +157,20 @@ These input values must be the same as any [`dflook/terraform-plan`](https://git
157157
- Optional
158158
- Default: false
159159

160+
* `plan_path`
161+
162+
Path to a plan file to apply. This would have been generated by a previous [`dflook/terraform-plan`](https://github.com/dflook/terraform-github-actions/tree/main/terraform-plan) action.
163+
164+
When not supplied, a new plan will be generated.
165+
166+
- Type: string
167+
- Optional
168+
160169
* `auto_approve`
161170

162-
When set to `true`, generated plans are always applied.
171+
When set to `true`, plans are always applied.
163172

164-
The default is `false`, which requires plans to have been approved through a pull request.
173+
The default is `false`, which requires plans to have been added to a pull request comment.
165174

166175
- Type: bool
167176
- Optional

‎terraform-apply/action.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ inputs:
5555
description: Create and apply a plan to destroy all resources
5656
required: false
5757
default: "false"
58+
plan_path:
59+
description: Path to the plan file to apply.
60+
required: false
61+
default: ""
5862

5963
outputs:
6064
text_plan_path:

‎terraform-plan/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,13 @@ The [dflook/terraform-apply](https://github.com/dflook/terraform-github-actions/
308308

309309
- Type: boolean
310310

311+
* `plan_path`
312+
313+
This is the path to the generated plan in an opaque binary format.
314+
The path is relative to the Actions workspace.
315+
316+
- Type: string
317+
311318
* `json_plan_path`
312319

313320
This is the path to the generated plan in [JSON Output Format](https://www.terraform.io/docs/internals/json-format.html)

0 commit comments

Comments
 (0)