Discussion on "Deploying Terraform at scale with GitHub Actions"

Facundo Gauna · 2022-08-23T13:00:00.343Z

Have you wondered what is the best workflow to use open-source Terraform at scale? In this blog post, I'll walk you through my favorite workflow using GitHub Actions. I'll deploy to Azure, but the same workflow can be adapted with other cloud provide...

Hi Facundo, thanks for sharing this extensive write-up. It led me to explore the value GitHub Actions within CI/CD workflows to run Terraform from pull request comments: similar to Atlantis, but without the overhead of self-hosting.

I've open-sourced this reusable workflow and tried my best documenting its usage examples. Let me know if you happen to have any feedback.

Thank you for a good article! The PR comment can be made easier:

- name: Terraform Plan
      id: plan
      run: |
        terraform plan -refresh=false  -no-color -out out.plan

    - name: Comment PR
      if: github.event_name == 'pull_request'
      uses: peter-evans/create-or-update-comment@v1
      with:
        issue-number: ${{ github.event.pull_request.number }}
        body: ${{steps.plan.outputs.stdout}}

Hi Facundo,

Ty for your article. I'm currently testing GitHub actions with terraform.

How would you handle it, if terraform apply fails after the pr is merged?

Best regards Tobi

The downside with applying after the PR is merged is that you end up 'polluting' the main branch with (possibly many) attempts to fix the problem. With that in mind, I do like the atlantis approach where you don't merge unless the branch has been applied successfully.

Yes that is correct, but with terraform I like to have an approval step. Unfortunately, the only way to apply approval steps in Github Actions is via environment protection rules. And these are only available for private repositories with a Github Enterprise license.

Tobias Dehn I'm already using Github environments and protection rules. The problem I have with the protection rules is that they prevent any job from running (any branch). I need to be able to see the terraform plan, then approve the apply step.

Search Hashnode

Deploying Terraform at scale with GitHub Actions

Responses3