cloudposse / cloudposse/github-action-atmos-terraform-plan
Unable to Disable Atmos Identity/Auth for Github Action
- Dominant language
- HCL
- Stars
- 8
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the Bug
It is possible we are doing something incorrectly, but the evidence so far seems to suggest otherwise.
I created a simple workflow to test Atmos integration with Github Actions. The plan is to use OIDC for authentication, but for local development we _do_ have an `auth` block configured in our `atmos.yaml` configuration file, per the [Atmos documentation here](https://atmos.tools/cli/configuration/auth/) (primarily SSO identities). Since we're using OIDC for Github Actions, the plan was to simply disable Atmos auth. This seems to be possible according to a [blog post here](https://atmos.tools/changelog/disable-identity-authentication). An initial glance at this action's code appeared to confirm that [here](https://github.com/cloudposse/github-action-atmos-terraform-plan/blob/d4e329e1a5ceaf4cd044a402113d2824d57e4ba6/action.yml#L351).
However, all attempts to run the atmos-terraform-plan action fail. It _seems_ as though it is trying to use the identity literally named "false" (we have also tried `0`, `off`, etc.). Our auth configuration works just fine locally and we have confirmed that we're able to disable Atmos auth locally using either environment variables or via `--identity=false`. But this does not seem to translate with this Github Action.
```markdown
# identityName
**Error:** invalid auth config
## Hints
💡 Identity specified was not found in the auth config.
# Error
**Error:** identity not found
## Explanation
false
```
When I temporarily delete our Atmos auth configuration all-together, the problem disappears.
### Expected Behavior
We expected Atmos to disable Atmos auth and instead revert back to the default behavior using the standard AWS CLI environment, thus allowing us to use OIDC instead.
### Steps to Reproduce
Create a simple workflow that just uses this Github Action. We have the identity set two different ways below to show how we've tried to set this in two of the supported ways, one via an action input and another via environment variable.
```yaml
name: 👽 Atmos Terraform Plan (Manual)
run-name: 👽 Atmos Terraform Plan (Manual)
on:
workflow_dispatch:
inputs:
component:
description: "The name of the Terraform component."
required: true
type: string
stack:
description: "The name of the Atmos stack."
required: true
type: string
permissions:
id-token: write
contents: read
pull-requests: write
jobs:
atmos-plan:
name: "Atmos Terraform Plan"
runs-on: ubuntu-latest
env:
ATMOS_IDENTITY: false
steps:
- name: Plan Atmos Component
uses: cloudposse/github-action-atmos-terraform-plan@v5
with:
component: ${{ inputs.component }}
stack: ${{ inputs.stack }}
atmos-version: 1.203.0
identity: false
```
After setting up OIDC integration per Atmos' documentation, attempt to run a 'plan' against a stack and component specified via the workflow's inputs.
### Screenshots
_No response_
### Environment
- Atmos version: `1.203.0`
- Terraform version: `1.10.2`
### Additional Context
_No response_
Contributor guide
Research direction
Start with action.yml around line 351, then compare the identity action input with the ATMOS_IDENTITY environment variable shown in the reproduction workflow. Run the workflow with the Atmos auth configuration present and verify that disabling identity authentication allows the OIDC-based AWS setup to proceed without treating false as an identity name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, github-actions
- Domain
- authentication, ci-cd, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100