terraform-github-actions

terraform-github-actions copied to clipboard

I've noticed that when the add_github_comment is true, the variables reported in the comment on the Pull Request might contain sensitive data.

I think the action should either mask the variables that are considered sensitive from terraform.

Yes, this is planned soon. This is noted in the docs. If you set a label, then the variables won't be shown in the comment.

Just ran into this myself for the first time :)

I much prefer the layout of the comments when a label is not set.

e.g.

nice and clear what exactly plan is based on

missing important info in my opinion

Ideal for me we would have the no-label layout with anything either marked sensitive in the terraform config or coming from a github secret masked?

Yes, this is planned soon. This is noted in the docs. If you set a label, then the variables won't be shown in the comment.

@dflook I could find the reference in the documentation but I'm afraid I have no idea what this means ... could you give an example on how to modify the below such that the content of secret is not visible in the PR comment?

... snip ...
    - name: Terraform Plan
      uses: dflook/[email protected]
      id: terraform-plan
      with:
        path: .github/_scratch/xxxxxxxxxxx
        variables: |-
        name =  "some value"
        secret = "${{ secrets.MY_SECRET_VALUE }}"
... snip ...

Hi @JelleSmet-TomTom, it would look something like this:

    - name: Terraform Plan
      uses: dflook/[email protected]
      id: terraform-plan
      with:
        label: production
        path: .github/_scratch/xxxxxxxxxxx
        variables: |-
        name =  "some value"
        secret = "${{ secrets.MY_SECRET_VALUE }}"

where the label is whatever makes sense for that plan. It should be the same in the dflook/terraform-apply step, if there is one.

Oh ok, I'll try this out tomorrow. It's somewhat odd/not intuitive this cause & effect exists. Tnx @dflook for the project & support

Hi @dflook I'm afraid I can't seem to achieve that by setting a label value?

So to summarize and to check if I understood the behavior correctly:

Terraform variables which have the sensitive property set will have their value masked in the pull request comment added by the dflook action once a random value is assigned to the label parameter of the dflook/terraform-plan and dflook/terraform-apply actions.

edit: it seems the moment I set label the complete variables section is missing from the PR comment?

There is no masking at all at the moment. Without a label, the comment contains the variables. With a label, the comment contains only the label.

ok got it .. thank you so much for clarifying!

v1.31.0 has been released which masks sensitive variables in the PR comment