digger
digger copied to clipboard
Action job starts but reports "no changes"
User:
I have been testing Digger with backend, but on every PR ( even with just adding an empty line) a GHA job would run just to tell me No changes in terraform. Also closing a PR or merging would trigger a new GHA job just to unlock the project.
I used the workflow_dispatch provided in the documentation:
on:
workflow_dispatch:
inputs:
id:
description: 'run identifier'
required: false
job:
required: true
comment_id:
required: true
I am using the latest version I suppose
name: Digger Workflow
on:
workflow_dispatch:
inputs:
id:
description: 'run identifier'
required: false
job:
required: true
comment_id:
required: true
jobs:
digger-job:
runs-on: ubuntu-latest
permissions:
contents: write # required to merge PRs
actions: write # required for plan persistence
id-token: write # required for workload-identity-federation
pull-requests: write # required to post PR comments
statuses: write # required to validate combined PR status
steps:
- uses: actions/checkout@v4
- name: digger run
uses: diggerhq/[email protected]
with:
setup-aws: true
aws-role-to-assume: arn:aws:sts::{AccountID}:assumed-role/{RoleName}/{FunctionName}
aws-region: us-east-1
digger-hostname: 'https://cloud.digger.dev/'
digger-organisation: 'digger'
digger-token: ${{ secrets.DIGGER_TOKEN }}
setup-checkov: true
env:
GITHUB_CONTEXT: ${{ toJson(github) }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Another issue is that the defined workflow in digger.ml is not being detected:
Running 'digger plan' for project 'development' (workflow: )
GitHub context parsed successfully
Error while fetching user teams for CI service: failed to list github teams: GET https://api.github.com/orgs/<orgname>/teams: 403 Resource not accessible by integration []
WARNING: teams failed to be fetched, passing an empty list instead for access policy checks
DEBUG: passing the following input policy: map[action:digger plan approvals:[] organisation:<orngame> planPolicyViolations:[] project:development teams:[] user:<username>] ||| text:
package digger
default allow = true
allow = (count(input.planPolicyViolations) == 0)
Running 'digger plan' for project 'development' (workflow: )
Error while fetching user teams for CI service: failed to list github teams: GET https://api.github.com/orgs/<orgname>/teams: 403 Resource not accessible by integration []
WARNING: teams failed to be fetched, passing an empty list instead for access policy checks
Digger.yml:
projects:
- name: development
dir: dev
workflow: default
- name: sandbox
dir: test
workflow: default
workflows:
default:
plan:
steps:
- init
- plan
- run: checkov -d . --framework terraform --soft-fail | tee -a $DIGGER_OUT
Logs from the runner:
With orchestrator backend: Running 'digger plan' for project 'test' (workflow: )
No backend: Running 'digger plan' for project 'test' (workflow: default)