Implement storage of plan artifacts in the same storage as state files#1425
Implement storage of plan artifacts in the same storage as state files#1425christian-calabrese merged 28 commits intomainfrom
Conversation
|
christian-calabrese
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
christian-calabrese
changed the title
|
Here is a full test of the flow: dx-playground |
|
The workflow reads the Terraform backend configuration from the local file It then computes the upload path by taking the state key, splitting it into directory and basename, and placing the plan next to the state under a sibling folder: Finally the plan is uploaded to the same storage provider/container/bucket using the After a successful apply, the download action’s post: step (controlled by |
christian-calabrese
changed the title
| # Outputs (provider, plan-path, credentials) are passed to the apply job. | ||
| - name: Upload Terraform Plan | ||
| id: upload_plan | ||
| uses: pagopa/dx/actions/terraform-plan-storage-upload@poc-store-plan-artifact-in-csp |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| # Download and extract the plan bundle (plan file + .terraform.lock.hcl + .terraform/modules/). | ||
| # Storage coordinates come directly from the tf_plan job outputs — no terraform init required. | ||
| - name: Download Terraform Plan | ||
| uses: pagopa/dx/actions/terraform-plan-storage-download@poc-store-plan-artifact-in-csp |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
…e creation (CWE-377)
…creation (CWE-377)
christian-calabrese
force-pushed
the
poc-store-plan-artifact-in-csp
branch
from
e6e3ce3 to
3410876
Compare
#1425) Add two new TypeScript actions to read/write Terraform plan bundles on Azure Blob Storage and S3. The infra_apply workflow uses them to store the plan next to the state file (same container/bucket, plan-artifacts/ prefix), replacing the previous GitHub Artifact flow. Compared to the old encrypted-artifact approach, storing the plan on the CSP backend means access is controlled by the same federated identity already trusted for state operations — no encryption key to provision or rotate, and the plan never leaves the CSP security boundary. The download action includes a post: step that automatically deletes the remote object after a successful apply. Resolves CES-1727
5 participants
Add two new TypeScript actions to read/write Terraform plan bundles on Azure Blob Storage and S3. The infra_apply workflow uses them to store the plan next to the state file (same container/bucket, plan-artifacts/ prefix), replacing the previous GitHub Artifact flow.
Compared to the old encrypted-artifact approach, storing the plan on the CSP backend means access is controlled by the same federated identity already trusted for state operations — no encryption key to provision or rotate, and the plan never leaves the CSP security boundary.
The download action includes a post: step that automatically deletes the remote object after a successful apply.
Resolves CES-1727