Skip to content

Add plan and apply credential modes #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bruzina merged 1 commit into from
Oct 6, 2026
Merged

Add plan and apply credential modes #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .env.apply.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# S3 backend configuration
AWS_ACCESS_KEY_ID="access-key-id"
AWS_SECRET_ACCESS_KEY="secret-access-key"

# GitHub App configuration
GITHUB_APP_ID=1234567
GITHUB_APP_INSTALLATION_ID=123456789
GITHUB_APP_PEM_FILE_PATH=./github-app.private-key.pem
8 changes: 8 additions & 0 deletions .env.plan.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# S3 backend configuration
AWS_ACCESS_KEY_ID="access-key-id"
AWS_SECRET_ACCESS_KEY="secret-access-key"

# GitHub App configuration
GITHUB_APP_ID=1234567
GITHUB_APP_INSTALLATION_ID=123456789
GITHUB_APP_PEM_FILE_PATH=./github-app-plan.private-key.pem
7 changes: 1 addition & 6 deletions .env.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,9 @@
# S3 backend configuration
AWS_BUCKET="terraform-state-bucket-name"
AWS_ENDPOINT_URL_S3="https://path.to.your.s3.endpoint"
AWS_ACCESS_KEY_ID="access-key-id"
AWS_SECRET_ACCESS_KEY="secret-access-key"

# GitHub App configuration
# GitHub configuration
GITHUB_OWNER="your-organization"
GITHUB_APP_ID=1234567
GITHUB_APP_INSTALLATION_ID=123456789
GITHUB_APP_PEM_FILE_PATH=./github-app.private-key.pem

# Terraform configuration
TF_VAR_config="../test.yaml"
1 change: 1 addition & 0 deletions .envrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
dotenv_if_exists
dotenv_if_exists ".env.${TF_MODE:-plan}"

if [[ -f "$GITHUB_APP_PEM_FILE_PATH" ]]; then
export GITHUB_APP_PEM_FILE="$(cat "$GITHUB_APP_PEM_FILE_PATH")"
Expand Down
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
.env
.env.*
!*.tmpl
*.pem
.terraform
.terraform.lock.hcl
Expand Down
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,7 @@ export TF_VAR_config="../test.yaml"

### Local Usage

Export variables `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and `GITHUB_APP_PEM_FILE`, or when using direnv copy the template [`.env.tmpl`](.env.tmpl) to `.env` and fill it in.
Export variables `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and `GITHUB_APP_PEM_FILE`, or when using direnv copy the templates [`.env.tmpl`](.env.tmpl), [`.env.plan.tmpl`](.env.plan.tmpl) and [`.env.apply.tmpl`](.env.apply.tmpl) without `.tmpl` and fill them in. Plan mode with read-only credentials is the default, apply credentials load only for a single command with `TF_MODE=apply`.

```shell
direnv allow
Expand All @@ -229,8 +229,8 @@ direnv allow

# Use Terraform as you need
terraform -chdir=terraform init -backend-config="bucket=$AWS_BUCKET"
terraform -chdir=terraform plan
terraform -chdir=terraform apply
terraform -chdir=terraform plan -lock=false -refresh=false
TF_MODE=apply direnv exec . terraform -chdir=terraform apply
```

## Development
Expand Down
Loading