From b9be0c5b007a1c6e48b151827a40ac9ea002e9c4 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 16:44:58 -0700 Subject: [PATCH 1/9] terraform/backend tf add required_version ~> 1.12 https://github.com/hackforla/incubator/issues/38 --- terraform/backend.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/terraform/backend.tf b/terraform/backend.tf index dc23855..ca01c86 100644 --- a/terraform/backend.tf +++ b/terraform/backend.tf @@ -1,4 +1,5 @@ terraform { + required_version = "~> 1.12" backend "s3" { } required_providers { From 76dc994c634d023e37df6609290db7721e9c5681 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 18:09:26 -0700 Subject: [PATCH 2/9] .github/workflows/tf-plan comment pg secrets test --- .github/workflows/terraform-plan.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index b12990a..379f2a2 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -18,8 +18,8 @@ jobs: runs-on: ubuntu-latest env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} - TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} + # TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} + # TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} permissions: id-token: write From 2dac536cfe8b49a359692fa4881e9db654e1dc41 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 18:24:39 -0700 Subject: [PATCH 3/9] github workflows tf plan following oidc examples https://github.com/aws-actions/configure-aws-credentials/blob/main/examples/cfn-deploy-example/.github/workflows/deploy.yml --- .github/workflows/terraform-plan.yaml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index 379f2a2..92a1bc1 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -8,24 +8,21 @@ on: - '**/*.tf' - '**/*.yaml' -permissions: - id-token: write - contents: read - jobs: terraform-plan: name: Terraform Plan runs-on: ubuntu-latest - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} - # TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} permissions: id-token: write contents: read pull-requests: write + env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} + # TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} + steps: - name: Clone repo uses: actions/checkout@v4 From d4c1c5fc1af83b94acf0cfe92c7161a20fcc0f24 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 18:26:30 -0700 Subject: [PATCH 4/9] gh workflow terraform plan syntax fix --- .github/workflows/terraform-plan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index 92a1bc1..436e66a 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -18,7 +18,7 @@ jobs: contents: read pull-requests: write - env: + # env: # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} # TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} From 3f302405a072f9027d8c391ad07bd75c357c3131 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 18:36:27 -0700 Subject: [PATCH 5/9] terraform-plan revert to main --- .github/workflows/terraform-plan.yaml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index 436e66a..b12990a 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -8,21 +8,24 @@ on: - '**/*.tf' - '**/*.yaml' +permissions: + id-token: write + contents: read + jobs: terraform-plan: name: Terraform Plan runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} + TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} permissions: id-token: write contents: read pull-requests: write - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # TF_VAR_pgpassword: ${{ secrets.TF_VAR_PGPASSWORD }} - # TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} - steps: - name: Clone repo uses: actions/checkout@v4 From 9d1be12193b4db49b0309a38ca063b68f3b97169 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 19:03:22 -0700 Subject: [PATCH 6/9] github workflows tf plan rm id-token write test --- .github/workflows/terraform-plan.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index b12990a..c18daf2 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -9,7 +9,6 @@ on: - '**/*.yaml' permissions: - id-token: write contents: read jobs: @@ -22,7 +21,6 @@ jobs: TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} permissions: - id-token: write contents: read pull-requests: write From 749f7bd14074d6086157da83def6bab862a39eb8 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 19:05:44 -0700 Subject: [PATCH 7/9] gh workflows tf plan config aws creds v3 to v4 --- .github/workflows/terraform-plan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index c18daf2..e5ef43e 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -29,7 +29,7 @@ jobs: uses: actions/checkout@v4 - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@v3 + uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: arn:aws:iam::035866691871:role/gha-incubator role-session-name: ghaincubatorplan From b3ae1db3789ac04de81576829d937de599802506 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 19:21:13 -0700 Subject: [PATCH 8/9] gh workflows tf plan re-add id-token write --- .github/workflows/terraform-plan.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index e5ef43e..2311dfa 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -9,6 +9,7 @@ on: - '**/*.yaml' permissions: + id-token: write contents: read jobs: @@ -21,6 +22,7 @@ jobs: TF_VAR_pghost: ${{ secrets.TF_VAR_PGHOST }} permissions: + id-token: write contents: read pull-requests: write From bbe291c841504624470ffd480f59e5e5a91425a2 Mon Sep 17 00:00:00 2001 From: mike Date: Wed, 4 Jun 2025 19:22:24 -0700 Subject: [PATCH 9/9] gh workflows tf plan revert to main --- .github/workflows/terraform-plan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml index 2311dfa..b12990a 100644 --- a/.github/workflows/terraform-plan.yaml +++ b/.github/workflows/terraform-plan.yaml @@ -31,7 +31,7 @@ jobs: uses: actions/checkout@v4 - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v3 with: role-to-assume: arn:aws:iam::035866691871:role/gha-incubator role-session-name: ghaincubatorplan