Releases: DevSecTop/TF-via-PR
Releases · DevSecTop/TF-via-PR
v12 Enhanced Commands, Outputs and Examples
v12 Enhanced Commands, Outputs and Examples
Highlights (view blog)
- Around 55% reduction in codebase by consolidating action.yml within Bash, lowering the barrier to entry for contributors.
- Configurable rendering of command inputs and outputs without wrapper script (e.g.,
hide-args
from PR comment). - Streamlined documentation with a focus on workflow examples for common use-cases.
Breaking
- In/output parameters have been renamed:
- All
_
underscores are replaced with-
hyphens. working-directory
is added as an alias toarg-chdir
.arg_command
is renamed tocommand
.- For the full list, view the parameters.
- All
- To minimize dependencies, the following have been removed:
- Tool installation via
tenv
(replacement). - Caching integration (replacement).
- Tool installation via
Added
gh
GitHub CLI integration for consistent interoperability with GitHub's REST API.- Link to view workflow log with the precise step where TF-via-PR was executed.
- Pass repeated arguments as comma-separated values (e.g.,
arg-var: key1=value1,key2=value2
). - Contextual workflow outputs, like plan file artifact ID and URL, as well as truncated results from CLI response.
Updated
- Order of command execution to:
fmt
* >init
>workspace
* >validate
* >plan
/apply
(* optional). - Workflow examples with recommendations, including cron-scheduled configuration drift checks.
comment-pr
default from "recreate" to "update" for its revision history.format
default from "true" to "false" for explicit opt-in of the command, as done withvalidate
.
Removed
actions/cache
dependency, as out-of-scope.actions/github-script
dependecy, as superseded bygh
GitHub CLI.tenv
dependency, as replaced by 3rd parties.
Fixed
- Upon failure, output the error message directly instead of the entire command output.
- Upon exceeding character limit, gracefully handle truncation of command output.
- Handling of multiline strings with associated quoting.
Secured
- Support for v12 and after.
v12 Enhanced Parsing of Commands and Outputs
v12 Enhanced Parsing of Commands and Outputs
Highlights
- Around 55% reduction in codebase by consolidating action.yaml within Bash, lowering the barrier to entry for contributors.
- Configurable rendering of command inputs and outputs without wrapper script (e.g.,
hide-args
from PR comment). - Streamlined documentation with a focus on workflow examples for common use-cases.
Breaking
- Input parameters have been renamed:
- All
_
underscores are replaced with-
hyphens. working-directory
is added as an alias toarg-chdir
.arg_command
is renamed tocommand
.- For the full list, view the parameters.
- All
- To minimize dependencies, the following have been removed:
- Tool installation via
tenv
(replacement). - Caching integration (replacement).
- Tool installation via
Added
gh
GitHub CLI integration for consistent interoperability with GitHub's REST API.- Link to view workflow log with the precise step where TF-via-PR was executed.
- Pass repeated arguments as comma-separated values (e.g.,
arg-var: key1=value1,key2=value2
).
Changed
comment-pr
default from "recreate" to "update" for its revision history.format
default from "true" to "false" for explicit opt-in of the command, as done withvalidate
.
Removed
actions/cache
dependency, as out-of-scope.actions/github-script
dependecy, as superseded bygh
GitHub CLI.tenv
dependency, as replaced by 3rd parties.
Fixed
- Upon failure, output the error message directly instead of the entire command output.
- Upon exceeding character limit, gracefully handle truncation of command output.
Secured
- Support for v12 and after.
Commits changelog: v11.4.6...v12
v11.4.6
Fixed
- Interpolation of
auto-approve
argument handling (thank you, @chris3ware).
Commits changelog: v11.4.5...v11.4.6
v11 Pass Command Arguments with more PR Automation
Highlights
- Input individual command arguments instead of a string.
- Expand support for PR automation event triggers.
Added
- Separate input parameters for each command argument passed into TF.
- Leverage github-script instead of bash for handling workflow logic and GitHub API.
- Support for
tenv
to avoid TF wrapper script.
Updated
- Example workflows for common use-cases and event triggers.
- Sample workflow to consolidate with matrix strategy and deployment environments.
- Readme documentation with up-to-date screenshot and guidance.
Changed
-
Refactor input parameter names:
Before After Default command_input
args_*
cli_uses
tf_tool
terraform
label_enable
label_pr
true
plan_outline
outline_enable
true
recreate_comment
update_comment
false
-
Refactor output parameter names:
Before After command
header
comment_summary
summary
plan_id
identifier
tf_fmt
fmt_result
tf_output
last_result
Removed
- Support for
issue_comment
event trigger in order to focus on PR automation events.
Fixed
- #237 by fetching the job name with several methods until GitHub fixes it.
- #238 by enabling compatibility with
workflow_dispatch
event trigger while using0
as a placeholder PR number. - #243 by confirming compatibility with
merge_group
event trigger and documenting workflow example. - #245 by confirming compatibility with
push
event trigger and documenting workflow example.
Secured
- Support for v11.0.0 and above.
Todo
- Add workflow example for interactive PR label trigger.
- Add support for
terragrunt
thin wrapper, per #258.
Commits changelog: v10.7.0...v11.0.0
v11.4.5
Fixed
- Interpolation of
auto-approve
argument (thank you, @chris3ware).
Commits changelog: v11.4.4...v11.4.5
v11.4.4
Fixed
- Correctly parse and retrieve
tenv
versions beyond the latest one (thank you, @ego93!). - New
tenv_arch
input parameter to select atenv
's architecture in place of the default "amd64".
Commits changelog: v11.4.3...v11.4.4
v11.4.3
Fixed
- CI workflow to update major release tag (for real, this time).
Commits changelog: v11.4.2...v11.4.3
v11.4.2
Fixed
- CI workflow to update major release tag.
Removed
- GitHub Codespaces support.
Commits changelog: v11.4.1...v11.4.2
v11.4.1
v11.4.0
Added
- The new
exitcode
output parameter will return0
(succeeded) or1
(failed) by default. By passing inarg_detailed_exitcode: true
, thenexitcode
will return one of the documented exit codes:0
= Succeeded with empty diff (no changes)1
= Error2
= Succeeded with non-empty diff (changes present)
- The
init
command now consumes-var-file
and-var
inputs to complement OpenTofu's early (static) evaluation implementation.
Commits changelog: v11.3.0...v11.4.0