Terraform in CI/CD: Plan/Apply Gates with GitHub Actions

Описание и применение

Пайплайн GitHub Actions обеспечивает проверку, аудит, безопасные креденшелы и воспроизводимость Terraform‑изменений, используя артефакт плана и OIDC.

Задача

Engineers still run Terraform apply from laptops, leading to unreviewed, unlogged, and unrepeatable deployments.

Результат

The pipeline ensures that every Terraform change is reviewed, auditable, credential‑secure, and repeatable, preventing accidental or malicious deployments.

Рабочий процесс

• Run terraform fmt -check on every PR
• Run terraform init -backend=false and terraform validate on every PR
• Run terraform init against real backend and terraform plan -out=tfplan, save artifact
• Render plan to text and post as PR comment
• On merge to main, download plan artifact and run terraform apply
• Apply only in environments with required reviewers (e.g., production gate)

Доказательства

Laptop applies are unreviewed, unlogged, and unrepeatable.

Источник

The plan file is saved as an artifact. On pull requests, the human-readable plan is posted as an PR comment.

Источник

Only on merge to main. Downloads the exact plan artifact from the plan stage and applies it. Never re-plans at apply time.

Источник

The workflow needs one permission block: permissions: id-token: write contents: read pull-requests: write

Источник