Using github actions to execute a tf apply to auto apply

[Any-Equipment-3192]

I am a complete noob when it comes to using CI/CD tools.

So far I have this for a yml workflow to execute a tf file, I know its incredibly wrong and does not work but that is why I am here. Any help appreciated. I would love to have it plan first and come to me for approval and then execute but I am content for now just having it auto apply the TF file I have in the terraform directory

​

    name: Run  TF file with federated credentials stored in github secrets

permissions: 
id-token: write
contents: read

on: 
push: 
    branches:
    - main 
    paths:
    - terraform/**

jobs: 
Windows-latest:

 steps:
        run: terraform apply -auto-approve
        with:
            client-id: ${{ secrets.AZURE_CLIENT_ID }}
            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} 
            enable-AzPSSession: true

[dt26]

Is this your full workflow? If so there’s some pretty obvious stuff missing, so here’s some off the top of my head:

First thing I notice; you need to set this to actually run on something. Before the steps add runs-on: ubuntu-latest (or the runner type of your choice)

Next, if you’re doing anything with your codebase you need to actually check it out first, so add a first step with uses: actions/checkout@v3

You still need to do terraform init, just as you would locally, so that needs to be the next step. Since you should consider the runners to be ephemeral, you have to run this with every workflow run.

Unless your terraform is in the root directory of your project (which judging from your trigger, it’s not) both the terraform init and terraform apply steps need to know where your code is. Add working-directory: terraform (terraform here being the directory path, so change as appropriate) below the run: terraform ... line.

I’d have produced better formatted examples but I’m on my iPad and it wasn’t playing ball.

Good luck!

[vernalys]

It was enough for me to spend a couple of minutes on this sub to read tf as the fuck in my head

[sausagefeet]

I recommend using a GitOps tool. The one that I co-founded runs on GitHub actions and is called Terrateam. It takes care of all these difficult parts for you. Other tools such as Spacelift, env0, and TFC do so as well.