Skip to content

ci: add protected Terraform plan and apply workflows - #67

Open
lweberru wants to merge 15 commits into
feat/multi-area-regional-hub-spokefrom
ci/optional-terraform-plan
Open

ci: add protected Terraform plan and apply workflows#67
lweberru wants to merge 15 commits into
feat/multi-area-regional-hub-spokefrom
ci/optional-terraform-plan

Conversation

@lweberru

@lweberru lweberru commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • run an authenticated OpenTofu plan automatically for every same-repository pull request
  • protect STACKIT credentials with CODEOWNER approval and disabled admin bypass
  • allow GitHub repository variables to override the selected tfvars configuration
  • publish an add/change/destroy/replace summary as a persistent PR comment
  • add a manual, CODEOWNER-only Apply workflow for main
  • block Apply plans containing deletes or replacements
  • fail Apply closed until a persistent remote state backend is configured
  • pin all actions in the sensitive workflows to immutable commit SHAs

Configuration

The default configuration is config/hub-and-spoke-prod-nonprod-firewall.tfvars. Repository variables and the protected environment secret have already been configured.

Testing

  • workflow YAML syntax validated
  • tofu fmt -check -recursive passed
  • protected PR plan executed successfully
  • Apply is intentionally not executed because the remote state backend is not configured yet

This PR is based on feat/multi-area-regional-hub-spoke because the selected tfvars file is introduced by #66.

@github-actions

github-actions Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Terraform Plan: Changes detected

Add Change Destroy Replace
2 0 0 4

Configuration: src/config/hub-and-spoke-prod-nonprod-firewall.tfvars
Commit: aa6cc9a
Workflow run

@lweberru lweberru changed the title ci: add optional Terraform plan for pull requests ci: require Terraform plan for pull requests Sep 3, 2026
@lweberru lweberru changed the title ci: require Terraform plan for pull requests ci: add protected Terraform plan and apply workflows Sep 3, 2026
@lweberru lweberru added the terraform-apply Request a protected Terraform Apply for this pull request label Sep 3, 2026
@lweberru lweberru added terraform-apply Request a protected Terraform Apply for this pull request and removed terraform-apply Request a protected Terraform Apply for this pull request labels Sep 3, 2026
@lweberru lweberru added terraform-apply Request a protected Terraform Apply for this pull request and removed terraform-apply Request a protected Terraform Apply for this pull request labels Sep 3, 2026
@lweberru
lweberru deployed to terraform-plan September 3, 2026 09:39 — with GitHub Actions Active
@lweberru lweberru added terraform-apply Request a protected Terraform Apply for this pull request and removed terraform-apply Request a protected Terraform Apply for this pull request labels Sep 3, 2026
@lweberru
lweberru deployed to terraform-plan September 3, 2026 10:02 — with GitHub Actions Active
@lweberru
lweberru deployed to terraform-plan September 3, 2026 10:02 — with GitHub Actions Active
@lweberru lweberru added terraform-apply Request a protected Terraform Apply for this pull request and removed terraform-apply Request a protected Terraform Apply for this pull request labels Sep 3, 2026
@lweberru
lweberru deployed to terraform-plan September 3, 2026 11:07 — with GitHub Actions Active
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mahauber mahauber Awaiting requested review from mahauber mahauber is a code owner
@simpe00 simpe00 Awaiting requested review from simpe00 simpe00 is a code owner
@dweezl dweezl Awaiting requested review from dweezl dweezl is a code owner

Assignees

No one assigned

Labels

terraform-apply Request a protected Terraform Apply for this pull request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lweberru