Github Actions & OpenTF

[John-Donalson]

Here is a working github actions for AWS and opentf,
Obviously you would need to define aws secrets in github secrets,
set the vars in variables, and .tfvars and apply to commands...

but it works.

workflow.yml

name: Opentf CI

on:
  push:
    branches:
      - main

permissions:
  contents: read

defaults:
  run:
    shell: sh -eux {0}

env:
  ACTIONS_ALLOW_UNSECURE_COMMANDS: true
  ACCESS_KEY: ${{ secrets.ACCESS_KEY }}
  SECRET_KEY: ${{ secrets.SECRET_KEY }}

jobs:
  opentf:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ env.ACCESS_KEY }}
          aws-secret-access-key: ${{ env.SECRET_KEY }}
          aws-region: us-east-2

      - name: Setup Go environment
        uses: actions/setup-go@v2
        with:
          go-version: '1.20.3'

      - name: Build opentf from source
        run: |
          git clone https://github.com/opentffoundation/opentf.git
          cd opentf
          go build -o $GITHUB_WORKSPACE/opentf-bin
      - name: Symlink opentf
        run: sudo ln -s $GITHUB_WORKSPACE/opentf-bin /usr/local/bin/opentf

      - name: Initialize opentf
        run: opentf init -lock=false

      - name: Validate opentf
        run: opentf validate

      - name: Plan opentf
        run: opentf plan -var-file="./dev.tfvars" -var "access_key=${ACCESS_KEY}" -var "secret_key=${SECRET_KEY}" -lock=false

dev.tfvars

access_key = "$ACCESS_KEY"
secret_key = "$SECRET_KEY"

variables.tf

variable "access_key" {
  type      = string
  sensitive = true
}

variable "secret_key" {
  type      = string
  sensitive = true
}

[jschwanz]

@John-Donalson thank you for this example of getting opentf to work with GHA as it stands today. I actually was popping on here to advocate for yet another fork, this time of the setup-terraform Action. We use this Action quite heavily in our environment, and it would be valuable to us to have a drop-in replacement for this as well.

[m1rl0k]

this would be perfect!

[PawelHaracz]

Are you gonna fork this action? I'm asking because I would like contribut and can help with poriting the gh action into open tofu GitHub action. The same can we do with Azure DevOps tasks

[John-Donalson]

Im not sure I have the time to maintain a fork, I can contribute though, also.

[cube2222]

Relevant issue: #556

[rdhar]

Hey @John-Donalson, this seems to have picked up traction over in issue #556 as an accepted enhancement, which is assigned by @cube2222 to @kislerdm.

As per @jschwanz's suggestion, there is a new opentofu/setup-opentofu work-in-progress project in order to support a drop-in replacement (perhaps this is of interest to @PawelHaracz).

[PawelHaracz]

Sure, I will try to do it in this week

[cube2222]

@PawelHaracz I appreciate the willingness to contribute! However, right now @kislerdm is assigned to the issue, and took ownership, so please let him attempt contributing this and don't do any work on this for now.