From 260d5ecc9cb93ef414dd97eb5bea5429bc46d783 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Tue, 6 Oct 2026 19:19:01 +0200
Subject: [PATCH] feat: add plan and apply credential modes

---
 .env.apply.tmpl | 8 ++++++++
 .env.plan.tmpl  | 8 ++++++++
 .env.tmpl       | 7 +------
 .envrc          | 1 +
 .gitignore      | 2 ++
 README.md       | 6 +++---
 6 files changed, 23 insertions(+), 9 deletions(-)
 create mode 100644 .env.apply.tmpl
 create mode 100644 .env.plan.tmpl

diff --git a/.env.apply.tmpl b/.env.apply.tmpl
new file mode 100644
index 0000000..22bb840
--- /dev/null
+++ b/.env.apply.tmpl
@@ -0,0 +1,8 @@
+# S3 backend configuration
+AWS_ACCESS_KEY_ID="access-key-id"
+AWS_SECRET_ACCESS_KEY="secret-access-key"
+
+# GitHub App configuration
+GITHUB_APP_ID=1234567
+GITHUB_APP_INSTALLATION_ID=123456789
+GITHUB_APP_PEM_FILE_PATH=./github-app.private-key.pem
diff --git a/.env.plan.tmpl b/.env.plan.tmpl
new file mode 100644
index 0000000..9a97e4d
--- /dev/null
+++ b/.env.plan.tmpl
@@ -0,0 +1,8 @@
+# S3 backend configuration
+AWS_ACCESS_KEY_ID="access-key-id"
+AWS_SECRET_ACCESS_KEY="secret-access-key"
+
+# GitHub App configuration
+GITHUB_APP_ID=1234567
+GITHUB_APP_INSTALLATION_ID=123456789
+GITHUB_APP_PEM_FILE_PATH=./github-app-plan.private-key.pem
diff --git a/.env.tmpl b/.env.tmpl
index f44b977..93f2acd 100644
--- a/.env.tmpl
+++ b/.env.tmpl
@@ -1,14 +1,9 @@
 # S3 backend configuration
 AWS_BUCKET="terraform-state-bucket-name"
 AWS_ENDPOINT_URL_S3="https://path.to.your.s3.endpoint"
-AWS_ACCESS_KEY_ID="access-key-id"
-AWS_SECRET_ACCESS_KEY="secret-access-key"
 
-# GitHub App configuration
+# GitHub configuration
 GITHUB_OWNER="your-organization"
-GITHUB_APP_ID=1234567
-GITHUB_APP_INSTALLATION_ID=123456789
-GITHUB_APP_PEM_FILE_PATH=./github-app.private-key.pem
 
 # Terraform configuration
 TF_VAR_config="../test.yaml"
diff --git a/.envrc b/.envrc
index c08a966..6ef0e07 100644
--- a/.envrc
+++ b/.envrc
@@ -1,4 +1,5 @@
 dotenv_if_exists
+dotenv_if_exists ".env.${TF_MODE:-plan}"
 
 if [[ -f "$GITHUB_APP_PEM_FILE_PATH" ]]; then
   export GITHUB_APP_PEM_FILE="$(cat "$GITHUB_APP_PEM_FILE_PATH")"
diff --git a/.gitignore b/.gitignore
index 6b6e1b0..9eec1bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,6 @@
 .env
+.env.*
+!*.tmpl
 *.pem
 .terraform
 .terraform.lock.hcl
diff --git a/README.md b/README.md
index 5824767..dce7bca 100644
--- a/README.md
+++ b/README.md
@@ -220,7 +220,7 @@ export TF_VAR_config="../test.yaml"
 
 ### Local Usage
 
-Export variables `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and `GITHUB_APP_PEM_FILE`, or when using direnv copy the template [`.env.tmpl`](.env.tmpl) to `.env` and fill it in.
+Export variables `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and `GITHUB_APP_PEM_FILE`, or when using direnv copy the templates [`.env.tmpl`](.env.tmpl), [`.env.plan.tmpl`](.env.plan.tmpl) and [`.env.apply.tmpl`](.env.apply.tmpl) without `.tmpl` and fill them in. Plan mode with read-only credentials is the default, apply credentials load only for a single command with `TF_MODE=apply`.
 
 ```shell
 direnv allow
@@ -229,8 +229,8 @@ direnv allow
 
 # Use Terraform as you need
 terraform -chdir=terraform init -backend-config="bucket=$AWS_BUCKET"
-terraform -chdir=terraform plan
-terraform -chdir=terraform apply
+terraform -chdir=terraform plan -lock=false -refresh=false
+TF_MODE=apply direnv exec . terraform -chdir=terraform apply
 ```
 
 ## Development