Skip to content

fix: report captured OpenTofu plan failures #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xnoto merged 3 commits into from
Aug 27, 2026
Merged

fix: report captured OpenTofu plan failures #20

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7419d7e
fix: capture OpenTofu plan failures for PR comments
xnoto Aug 27, 2026
1277513
fix: satisfy plan workflow shell lint
xnoto Aug 27, 2026
1edc6c6
fix: avoid plan-comment fence lint false positive
xnoto Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 11 additions & 46 deletions .github/workflows/opentofu.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,52 +50,43 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

- name: Fetch canonical pre-commit config
id: fetch-config
continue-on-error: true
run: |
curl -sSL -o .pre-commit-config.yaml \
https://raw.githubusercontent.com/makeitworkcloud/images/main/tfroot-runner/pre-commit-config.yaml

- name: Initialize OpenTofu
id: initialize
continue-on-error: true
run: tofu init -backend=false

- name: Generate Terraform docs
id: terraform-docs
continue-on-error: true
run: |
set -euo pipefail
pre-commit run terraform_docs -a

changed_files="$(
{
git diff --name-only
git diff --cached --name-only
git ls-files --others --exclude-standard
} | sort -u
)"

if [ -z "$changed_files" ]; then
exit 0
fi

unexpected_files="$(printf '%s\n' "$changed_files" | grep -vx 'README.md' || true)"
if [ -n "$unexpected_files" ]; then
printf 'terraform_docs changed files other than README.md:\n%s\n' "$unexpected_files" >&2
exit 1
fi

if [ "${{ github.event_name }}" != 'pull_request' ] || \
[ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
echo 'Terraform documentation is out of date. Update README.md in the pull request branch.' >&2
exit 1
fi

echo 'changed=true' >> "$GITHUB_OUTPUT"

- name: Commit generated Terraform docs
if: >-
steps.terraform-docs.outcome == 'success' &&
Expand All @@ -112,12 +103,10 @@ jobs:
git diff --cached --quiet && exit 0
git commit -m 'chore(docs): update Terraform documentation'
git push origin "HEAD:$PR_HEAD_REF"

- name: Run tests
id: validation
continue-on-error: true
run: SKIP=no-commit-to-branch pre-commit run -a

- name: Report validation on pull request
if: >-
always() && github.event_name == 'pull_request' &&
Expand All @@ -138,28 +127,13 @@ jobs:
const body = failed
? `${marker}\n## OpenTofu CI failed\n\nValidation failed. [View the workflow run](${workflowUrl}).`
: `${marker}\n## OpenTofu CI passed\n\nValidation passed. [View the workflow run](${workflowUrl}).`;
const { data: comments } = await github.rest.issues.listComments({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
});
const { data: comments } = await github.rest.issues.listComments({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number });
const existing = comments.find((comment) => comment.body?.includes(marker));
if (existing) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: existing.id,
body,
});
await github.rest.issues.updateComment({ owner: context.repo.owner, repo: context.repo.repo, comment_id: existing.id, body });
} else {
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
body,
});
await github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, body });
}

- name: Mark validation failed
if: >-
always() &&
Expand All @@ -183,41 +157,36 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.ref }}

- name: Configure AWS credentials for SOPS KMS
if: inputs.gcp-workload-identity-provider == ''
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ inputs.aws-role-to-assume }}
aws-region: ${{ inputs.aws-region }}

- name: Configure Google credentials through Workload Identity Federation
if: inputs.gcp-workload-identity-provider != ''
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
workload_identity_provider: ${{ inputs.gcp-workload-identity-provider }}
service_account: ${{ inputs.gcp-service-account }}

- name: Install SSH key
if: ${{ inputs.setup-ssh }}
uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
with:
key: ${{ secrets.SSH_PRIVATE_KEY }}
known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

- name: OpenTofu Plan
id: plan
run: |
set -o pipefail
export SHELLOPTS
set +e
make plan
make plan 2>&1 | tee plan-output.txt
plan_exit_code=$?
set -e

if [ -s plan-output.txt ]; then
sed -n '/OpenTofu will perform the following actions:/,$p' plan-output.txt > plan-filtered.txt

sed -n "/OpenTofu will perform the following actions:/,\$p" plan-output.txt > plan-filtered.txt
if [ ! -s plan-filtered.txt ]; then
if ! grep -A 2 "No changes" plan-output.txt > plan-filtered.txt; then
cp plan-output.txt plan-filtered.txt
Expand All @@ -230,11 +199,13 @@ jobs:
echo "No plan output found" > plan-filtered.txt
fi

sed -E \
-e '/(secret|token|password|private[_ -]?key|credential|authorization|access[_ -]?key|client[_ -]?secret|kubeconfig|sops)/I c\[REDACTED: potentially sensitive plan output]' \
plan-filtered.txt > plan-filtered-redacted.txt
mv plan-filtered-redacted.txt plan-filtered.txt
printf 'exit-code=%s\n' "$plan_exit_code" >> "$GITHUB_OUTPUT"

tail -n 1000 plan-filtered.txt > plan-filtered-truncated.txt
mv plan-filtered-truncated.txt plan-filtered.txt

- name: prepare-comment
env:
PLAN_EXIT_CODE: ${{ steps.plan.outputs.exit-code }}
Expand All @@ -245,18 +216,16 @@ jobs:
if [ "$PLAN_EXIT_CODE" -ne 0 ]; then
echo "OpenTofu plan failed with exit code $PLAN_EXIT_CODE."
fi
echo '```'
echo '````'
cat plan-filtered.txt
echo '```'
echo '````'
} > comment-body.md

- name: comment
uses: johanwulf/replace-comment@73e5abab2457a7742d94f71355f878f25e950c71 # v1.0.1
with:
issue-number: ${{ github.event.pull_request.number }}
body-includes: '<!-- opentofu-plan -->'
body-path: comment-body.md

- name: Fail if plan failed
if: steps.plan.outputs.exit-code != '0'
env:
Expand All @@ -274,27 +243,23 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Configure AWS credentials for SOPS KMS
if: inputs.gcp-workload-identity-provider == ''
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ inputs.aws-role-to-assume }}
aws-region: ${{ inputs.aws-region }}

- name: Configure Google credentials through Workload Identity Federation
if: inputs.gcp-workload-identity-provider != ''
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
workload_identity_provider: ${{ inputs.gcp-workload-identity-provider }}
service_account: ${{ inputs.gcp-service-account }}

- name: Install SSH key
if: ${{ inputs.setup-ssh }}
uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
with:
key: ${{ secrets.SSH_PRIVATE_KEY }}
known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

- name: OpenTofu Apply
run: make apply