Terraform in CI/CD: Plan/Apply Gates with GitHub Actions

说明与用途

GitHub Actions 流水线通过使用计划工件和 OIDC，强制 Terraform 更改的审查、审计、凭证卫生和可重复性，并为生产环境设置环境门控。

问题

Engineers still run Terraform apply from laptops, leading to unreviewed, unlogged, and unrepeatable deployments.

结果

The pipeline ensures that every Terraform change is reviewed, auditable, credential‑secure, and repeatable, preventing accidental or malicious deployments.

工作流

• Run terraform fmt -check on every PR
• Run terraform init -backend=false and terraform validate on every PR
• Run terraform init against real backend and terraform plan -out=tfplan, save artifact
• Render plan to text and post as PR comment
• On merge to main, download plan artifact and run terraform apply
• Apply only in environments with required reviewers (e.g., production gate)

证据

Laptop applies are unreviewed, unlogged, and unrepeatable.

来源

The plan file is saved as an artifact. On pull requests, the human-readable plan is posted as an PR comment.

来源

Only on merge to main. Downloads the exact plan artifact from the plan stage and applies it. Never re-plans at apply time.

来源

The workflow needs one permission block: permissions: id-token: write contents: read pull-requests: write

来源