My Workflow :

When I wanted to start managing my Github with Terraform using the integrations/terraform-provider-github I felt that my terraform statefile should belong with the code, and not as a remote state in Azure/AWS/etc.

I couldn't find a suitable solution so I decided to roll my own:

It took me a while to figure out but I finally settled on keeping my state as a workflow artifact that is de/encrypted on each run. I decided to create my first action out of the whole thing only to find out that there actually was an #ActionsHackathon21 going on!

🚀 What this action does: 🚀

• 🛠️ First off, it downloads your repository with actions/checkout@v2 and then installs terraform using hashicorp/setup-terraform@v1.
• 📥 Using environment variables it downloads the most recent workflow artifact called terraformstatefile and decrypts using the user input variable encryptionkey.
  • If no artifact with that name is found (maybe it's your first run) then it proceeds with the following.
• 🏗️ It then proceeds to run terraform plan with any flags from the optional variable custom_plan_flags
• 🏢 Next it runs terraform apply with any flags from the optional variablecustom_apply_flags.
  • This can be skipped by setting the optional variable apply to false.
• 🗃️ If all is well then Terraform has now produced a statefile ./terraform.tfstate. This file is encrypted using the provided encryptionkey.
  • 🤫 I'd recommend getting this from a ${{secret.variable}} since the output isn't hidden.
• 💾 Finally the new statefile is uploaded as an artifact!

  - 🎉 Lather, rinse, repeat! 🎉

Submission Category:

DIY Deployments

Yaml File or Link to Code :

Here is an example to get you started:

steps:
- uses: sturlabragason/terraform_state_artifact@v1
    with:
        encryptionkey: ${{ secrets.encryptionkey }}