feat(opentofu): source docs GitHub App key from Actions secret

.github/workflows/opentofu.yml

@@ -40,6 +40,8 @@ on:
         required: false
       CLOUDFLARE_API_TOKEN:
         required: false
+      CHART_UPDATER_GITHUB_APP_PRIVATE_KEY:
+        required: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -49,8 +51,9 @@ jobs:
   test:
     permissions:
       contents: write
-      id-token: write
       pull-requests: write
+    env:
+      DOCS_APP_KEY_AVAILABLE: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY != '' }}
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Checkout
@@ -105,37 +108,30 @@ jobs:
           fi
           echo 'changed=true' >> "$GITHUB_OUTPUT"
           exit 0
-      - name: Configure AWS credentials for generated Terraform docs
-        if: >-
-          steps.terraform-docs.outcome == 'success' &&
-          steps.terraform-docs.outputs.changed == 'true' &&
-          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          role-to-assume: arn:aws:iam::332355796717:role/github-actions-opentofu-docs
-          aws-region: ${{ inputs.aws-region }}
-      - name: Get GitHub App key for generated Terraform docs
+      - name: Require GitHub App key for generated Terraform docs
+        id: terraform-docs-key
+        continue-on-error: true
         if: >-
           steps.terraform-docs.outcome == 'success' &&
           steps.terraform-docs.outputs.changed == 'true' &&
           github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository
-        uses: aws-actions/aws-secretsmanager-get-secrets@33da984fe531194c1157993a528f0c28ecf9f946 # v2.2.1
-        with:
-          secret-ids: |
-            GITHUB_APP_PRIVATE_KEY, arn:aws:secretsmanager:us-west-2:332355796717:secret:xnoto-s-chart-updater-github-app-private-key-qP4Qr3
+          github.event.pull_request.head.repo.full_name == github.repository &&
+          env.DOCS_APP_KEY_AVAILABLE != 'true'
+        run: |
+          echo 'Terraform documentation is out of date and CHART_UPDATER_GITHUB_APP_PRIVATE_KEY is not available to commit it. Update README.md in the pull request branch.' >&2
+          exit 1
       - name: Create GitHub App token for generated Terraform docs
         id: github-app-token
         if: >-
           steps.terraform-docs.outcome == 'success' &&
           steps.terraform-docs.outputs.changed == 'true' &&
           github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository
+          github.event.pull_request.head.repo.full_name == github.repository &&
+          env.DOCS_APP_KEY_AVAILABLE == 'true'
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: '4745727'
-          private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
+          private-key: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
           permission-contents: write
@@ -145,7 +141,8 @@ jobs:
           steps.terraform-docs.outcome == 'success' &&
           steps.terraform-docs.outputs.changed == 'true' &&
           github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository
+          github.event.pull_request.head.repo.full_name == github.repository &&
+          env.DOCS_APP_KEY_AVAILABLE == 'true'
         env:
           GITHUB_APP_TOKEN: ${{ steps.github-app-token.outputs.token }}
           PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
@@ -174,6 +171,7 @@ jobs:
                 steps.fetch-config.outcome == 'failure' ||
                 steps.initialize.outcome == 'failure' ||
                 steps.terraform-docs.outcome == 'failure' ||
+                steps.terraform-docs-key.outcome == 'failure' ||
                 steps.validation.outcome == 'failure' }}
         with:
           script: |
@@ -205,6 +203,7 @@ jobs:
            steps.fetch-config.outcome == 'failure' ||
            steps.initialize.outcome == 'failure' ||
            steps.terraform-docs.outcome == 'failure' ||
+           steps.terraform-docs-key.outcome == 'failure' ||
            steps.validation.outcome == 'failure')
         run: exit 1
 
@@ -266,7 +265,7 @@ jobs:
             echo "No plan output found" > plan-filtered.txt
           fi
 
-          sed -E $'s/\x1B\\[[0-?]*[ -\\/]*[@-~]//g' plan-filtered.txt |
+          sed -E $'s/\x1B\[[0-?]*[ -\/]*[@-~]//g' plan-filtered.txt |
             sed -E \
               -e '/(secret|token|password|private[_ -]?key|credential|authorization|access[_ -]?key|client[_ -]?secret|kubeconfig|sops)/I c\[REDACTED: potentially sensitive plan output]' \
               > plan-filtered-redacted.txt

README.md

@@ -57,6 +57,25 @@ jobs:
 
 Do not add this mapping for consumers that do not use Cloudflare.
 
+### Generated documentation commits
+
+Repositories whose same-repository pull requests should receive automatic
+Terraform-docs `README.md` commits map the centrally distributed chart updater
+GitHub App key:
+
+```yaml
+jobs:
+  opentofu:
+    uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
+    secrets:
+      CHART_UPDATER_GITHUB_APP_PRIVATE_KEY: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY }}
+```
+
+The key is provisioned by `tfroot-github` to approved repositories only. Without
+it, generated-documentation drift fails the `test` job and the README must be
+updated manually. Fork pull requests never receive secrets and always fail on
+drift.
+
 ## Available Workflows
 
 | Workflow | Description |