From 16c349fd4f560de534c9c50ab5e95e45e0a922ee Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sun, 30 Aug 2026 10:58:00 -0600 Subject: [PATCH] feat(opentofu): source docs GitHub App key from Actions secret --- .github/workflows/opentofu.yml | 41 +++++++++++++++++----------------- README.md | 19 ++++++++++++++++ 2 files changed, 39 insertions(+), 21 deletions(-) diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml index c291d3e..18ec044 100644 --- a/.github/workflows/opentofu.yml +++ b/.github/workflows/opentofu.yml @@ -40,6 +40,8 @@ on: required: false CLOUDFLARE_API_TOKEN: required: false + CHART_UPDATER_GITHUB_APP_PRIVATE_KEY: + required: false concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -49,8 +51,9 @@ jobs: test: permissions: contents: write - id-token: write pull-requests: write + env: + DOCS_APP_KEY_AVAILABLE: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY != '' }} runs-on: ${{ inputs.runs-on }} steps: - name: Checkout @@ -105,37 +108,30 @@ jobs: fi echo 'changed=true' >> "$GITHUB_OUTPUT" exit 0 - - name: Configure AWS credentials for generated Terraform docs - if: >- - steps.terraform-docs.outcome == 'success' && - steps.terraform-docs.outputs.changed == 'true' && - github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - with: - role-to-assume: arn:aws:iam::332355796717:role/github-actions-opentofu-docs - aws-region: ${{ inputs.aws-region }} - - name: Get GitHub App key for generated Terraform docs + - name: Require GitHub App key for generated Terraform docs + id: terraform-docs-key + continue-on-error: true if: >- steps.terraform-docs.outcome == 'success' && steps.terraform-docs.outputs.changed == 'true' && github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository - uses: aws-actions/aws-secretsmanager-get-secrets@33da984fe531194c1157993a528f0c28ecf9f946 # v2.2.1 - with: - secret-ids: | - GITHUB_APP_PRIVATE_KEY, arn:aws:secretsmanager:us-west-2:332355796717:secret:xnoto-s-chart-updater-github-app-private-key-qP4Qr3 + github.event.pull_request.head.repo.full_name == github.repository && + env.DOCS_APP_KEY_AVAILABLE != 'true' + run: | + echo 'Terraform documentation is out of date and CHART_UPDATER_GITHUB_APP_PRIVATE_KEY is not available to commit it. Update README.md in the pull request branch.' >&2 + exit 1 - name: Create GitHub App token for generated Terraform docs id: github-app-token if: >- steps.terraform-docs.outcome == 'success' && steps.terraform-docs.outputs.changed == 'true' && github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository + github.event.pull_request.head.repo.full_name == github.repository && + env.DOCS_APP_KEY_AVAILABLE == 'true' uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: '4745727' - private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }} + private-key: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: ${{ github.event.repository.name }} permission-contents: write @@ -145,7 +141,8 @@ jobs: steps.terraform-docs.outcome == 'success' && steps.terraform-docs.outputs.changed == 'true' && github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository + github.event.pull_request.head.repo.full_name == github.repository && + env.DOCS_APP_KEY_AVAILABLE == 'true' env: GITHUB_APP_TOKEN: ${{ steps.github-app-token.outputs.token }} PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} @@ -174,6 +171,7 @@ jobs: steps.fetch-config.outcome == 'failure' || steps.initialize.outcome == 'failure' || steps.terraform-docs.outcome == 'failure' || + steps.terraform-docs-key.outcome == 'failure' || steps.validation.outcome == 'failure' }} with: script: | @@ -205,6 +203,7 @@ jobs: steps.fetch-config.outcome == 'failure' || steps.initialize.outcome == 'failure' || steps.terraform-docs.outcome == 'failure' || + steps.terraform-docs-key.outcome == 'failure' || steps.validation.outcome == 'failure') run: exit 1 @@ -266,7 +265,7 @@ jobs: echo "No plan output found" > plan-filtered.txt fi - sed -E $'s/\x1B\\[[0-?]*[ -\\/]*[@-~]//g' plan-filtered.txt | + sed -E $'s/\x1B\[[0-?]*[ -\/]*[@-~]//g' plan-filtered.txt | sed -E \ -e '/(secret|token|password|private[_ -]?key|credential|authorization|access[_ -]?key|client[_ -]?secret|kubeconfig|sops)/I c\[REDACTED: potentially sensitive plan output]' \ > plan-filtered-redacted.txt diff --git a/README.md b/README.md index 97ef7c3..eb93658 100644 --- a/README.md +++ b/README.md @@ -57,6 +57,25 @@ jobs: Do not add this mapping for consumers that do not use Cloudflare. +### Generated documentation commits + +Repositories whose same-repository pull requests should receive automatic +Terraform-docs `README.md` commits map the centrally distributed chart updater +GitHub App key: + +```yaml +jobs: + opentofu: + uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main + secrets: + CHART_UPDATER_GITHUB_APP_PRIVATE_KEY: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY }} +``` + +The key is provisioned by `tfroot-github` to approved repositories only. Without +it, generated-documentation drift fails the `test` job and the README must be +updated manually. Fork pull requests never receive secrets and always fail on +drift. + ## Available Workflows | Workflow | Description |