hashicorp / hashicorp/setup-terraform

Config file is overwritten

Open
#428 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.6k
Forks
288
Avg merge
23h 21m
Merged PRs (30d)
3

Description

# Problem

If we have an existing config file, [this action will overwrite it](https://github.com/hashicorp/setup-terraform/blob/7f4493e15578a47490e79892b308bf23dee56c45/lib/setup-terraform.js#L121). The debug log line just before the overwrite says `Adding credentials to ${credsFile}`, which adds to the confusion, because it's replacing the existing file ([as fs.writeFile does](https://nodejs.org/docs/latest/api/fs.html#fswritefilefile-data-options-callback)), not adding anything to it.

I hit this issue when trying to use a custom provider (or network mirrors). This behaviour makes a static file in the repo hard to use, we end up having to append content to the file this action smashes.

# Expected behaviour

If we have custom config in the default location (`${{ github.workspace }}/.terraformrc`) or in a custom one set with `TF_CLI_CONFIG_FILE`, the content is preserved and any other configuration is added, not overwritten (at least not by default).

If that's too much to ask, at least have clearer debug logs and documentation about this behaviour, because it's a bit painful to get the right outcome.

# Steps to reproduce

1. Have a config file in `${{ github.workspace }}/.terraformrc` or in a location that matches the env variable `TF_CLI_CONFIG_FILE`. Stick some errors in it if you don't have a network mirror to test, just gibberish that would break any terraform command using the config.
2. On a step after that, run the `setup-terraform` action.
3. Have another step perform any Terraform command, like `terraform init`. It won't honour the config, it won't break if you had any errors.

## Example

```yaml
name: Config overwrite reproduction

on: [ push ]

env:
# Not really needed, this is the default, but change it and will still get overwritten.
TF_CLI_CONFIG_FILE: ${{ github.workspace }}/terraformrc.tfrc

jobs:
terraform-reproduce:
name: Terraform Reproduce
runs-on: ubuntu-22.04
permissions:
contents: read
id-token: write
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Write Terraform Config file
run: |
echo "Writing config to ${TF_CLI_CONFIG_FILE}"
cat <<-EOT > "${TF_CLI_CONFIG_FILE}"
# This block is unnecessary to reproduce, you can change the mirror URL or not, as it
# will be overwritten. But adding it for context for an example of something that should
# eventually work. A simpler case would be to uncomment the 2 broken lines at the end
# of this heredoc
provider_installation {
direct {
exclude = ["registry.terraform.io/*/*"]
}
network_mirror {
url = "https://FIXME-WITH-YOUR-OWN-MIRROR/api/terraform/terraform-providers-virtual/providers/"
}
}
# Uncomment these lines to have something that should break any command:
# bleh = blah
# this_breaks = true
EOT
shell: bash
- name: DEBUG config file
# Just a sanity check to see that the file written above is actually available from other steps.
run: |
echo "Config file from another step:"
cat ${TF_CLI_CONFIG_FILE}
shell: bash
- name: Setup Terraform
uses: hashicorp/setup-terraform@v2
with:
cli_config_credentials_hostname: "FIXME-WITH-YOUR-OWN-MIRROR"
cli_config_credentials_token: "FIXME-WITH-A-TOKEN"
terraform_version: 1.4.0. # not sure it matters much, but it's the one I used when I hit this
- name: Terraform Validate
id: validate
# This is not the simplest command one can use for a reproduction, but leaving it here as it might make it easier
# on an existing module repo structure.
run: find . -name 'main.tf' -not -path '*/.terraform/*' -print0 | xargs -0 -I{} bash -c 'cd $(dirname {}) && terraform init && terraform validate'
shell: bash
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.