Externalize auth, OpenTofu support, multi-cloud backends, Node.js 24 actions - #1
Closed
andypotanin wants to merge 8 commits into
Closed
Externalize auth, OpenTofu support, multi-cloud backends, Node.js 24 actions#1andypotanin wants to merge 8 commits into
andypotanin wants to merge 8 commits into
Conversation
- state_backend: override backend type (s3, http, consul, etc.) - state_backend_config: key=value backend config lines - state_prefix_key: backend-specific path key (prefix for gcs, key for s3) 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Node.js 20 actions are deprecated (EOL June 2, 2026). v5 of both actions uses Node.js 24. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
v5 still runs on Node.js 20. v6 is required for Node.js 24 runtime. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the GitHub composite action to support a multi-cloud model where authentication is handled by the calling workflow, adds backend override inputs for non-GCS Terraform/OpenTofu state, and refreshes documentation/examples accordingly.
Changes:
- Removed built-in GCP/AWS auth inputs/steps and switched to environment-based credential detection (AWS/GCP/Azure) passed into the IaC container.
- Added state backend override inputs (
state_backend,state_backend_config,state_prefix_key) for multi-cloud backends. - Updated artifact upload action versions and rewrote README examples/architecture docs for the new model.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
action.yml |
Removes embedded auth steps, adds state backend inputs, and forwards detected cloud credentials into the container runtime. |
README.md |
Updates usage examples for externalized auth, adds multi-backend documentation, and refreshes config shape examples. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Add explicit default: "gcs" to state_backend input - Add :- fallback on AWS_SECRET_ACCESS_KEY to prevent unbound var error - Clarify README state_backend default column 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Placeholders corrected to match actual registry in placeholders.sh:
- #{Project} (not #{GcpProject}), #{Owner} (not #{GitOwner}),
#{Repository} (not #{GitRepository})
- Removed non-existent #{Namespace} and #{SharedProject}
Secret syntax: bare projects/{id}/secrets/{name} path, no gcp:// prefix
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Comment on lines
+73
to
+77
| description: "Override state backend type (e.g. s3, http, consul, azurerm). Unset = default gcs." | ||
| required: false | ||
| default: "gcs" | ||
| state_backend_config: | ||
| description: "Backend config as key=value lines (e.g. bucket=my-bucket newline region=us-east-1). Required when state_backend is set." |
Comment on lines
+477
to
+481
| if [[ -n "${GOOGLE_APPLICATION_CREDENTIALS:-}" && -f "${GOOGLE_APPLICATION_CREDENTIALS}" ]]; then | ||
| cp "${GOOGLE_APPLICATION_CREDENTIALS}" "$(pwd)/gcp-credentials.json" | ||
| chmod 644 "$(pwd)/gcp-credentials.json" | ||
| gcp_env+=(-e "GOOGLE_APPLICATION_CREDENTIALS=/github/workspace/gcp-credentials.json") | ||
| fi |
| - **Plan only = true** → preview changes without applying | ||
| - **Environment = production** + **Plan only = false** → blocked (safety guardrail) | ||
| - **Terraform action = destroy** + **Environment = production** → blocked | ||
| The action automatically resolves values matching the `projects/{id}/secrets/{name}` pattern to actual secret values at deploy time (requires `roles/secretmanager.secretAccessor` on the service account). |
|
Consolidated the compatible, backward-compatible parts of this PR into #2: optional caller-managed GCP credentials, state-backend pass-through, resilient AWS credential forwarding, and Node.js 24 action runtimes. The breaking full externalization and broad documentation rewrite were intentionally not carried over. Closing this PR in favor of #2 for one review path. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
state_backend,state_backend_config,state_prefix_key) for S3, azurerm, HTTP, Consulactions/checkoutto v5 andactions/upload-artifactto v6 for Node.js 24 (Node.js 20 deprecated June 2, 2026)Test plan
🤖 Generated with Claude Code