38 terraform required version minimum 1.12

[here]

Fixes #38

What changes did you make?

• Add required_version to incubator terraform/backend.tf

Why did you make the changes (we will use this info to test)?

• Confirmed latest stable terraform version 1.12.* at https://github.com/hashicorp/terraform/releases

[here]

Same symptoms on checks failing as previously when submitted from a for with #108

---

The check job for terraform plan appears to have run successfully with the same code for RSkuma on 2025-04-14 at https://github.com/hackforla/incubator/pull/106/checks .

---

Pull request checks are failing with permissions errors related to aws credentials,

Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

See error in Checks on pull request at https://github.com/hackforla/incubator/pull/108/checks

---

From source of configure-aws-credentials@v4 , additional detail recommends "it is likely but not guaranteed that the user needs but lacks this permission in their workflow."

• https://github.com/aws-actions/configure-aws-credentials/blob/v4.2.1/src/index.ts#L87

   with:
    role-to-assume: arn:aws:iam::035866691871:role/gha-incubator
    role-session-name: ghaincubatorplan
    aws-region: us-west-2
    audience: sts.amazonaws.com

Confirmed that the .github workflow files include expected permissions for OIDC workflows as described in docs at https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings

[Bwoltz]

Hey @here,

I took a look at our Trust Policy for the gha-incubator role on AWS. It looks like we allow requests for branch builds ("repo:hackforla/incubator:refs/heads/*"), but not branch pull requests ("repo:hackforla/incubator:pull_request"). That seems to be why it's getting denied. I also verified on Cloud Trail that the GH request matches the "repo:hackforla/incubator:pull_request" string which gets denied.

So nothing on your end. We just need to update the trust policy on AWS.

I don't have permissions to update the role on AWS, but hopefully someone with access can change it soon.

cc: @ale210

Not sure if we also want to update the terraform file for it?

It looks like we removed the PR option at some point, but I'm not sure the reason... from commit message, it's "no longer supported"? Not sure the details: hackforla/devops-security@b4cf61e

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

✅ Plan applied in Terraform apply (OIDC) #44

[ale210]

looks great, thanks @here