terraform-plan output file (-out)

[lucjross]

I'd like the plan to be both commented in the PR and output to a plan file consumable by apply. Can it do that?

[dflook]

The dflook/terraform-plan action doesn't output a plan file that can be used to apply. Can you tell me about your use case?

Any plan generated by dflook/terraform-plan could be no longer correct by the time it is applied. The dflook/terraform-apply action is designed to generate a fresh plan and apply it. By default, it checks if it matches the previously generated plan before applying.

[lucjross]

ok, thanks. my idea is: upon pull_request opened/updated events, generate the plan and save it to a cloud bucket (by the PR number) in terraform-readable format, and also put it in a PR comment in human-readable format. later, upon a pull_request closed and merged event, retrieve the plan for that PR from the bucket and apply it.

does this plugin compare the human-readable outputs of plan and apply, whenever apply generates a plan? i'm not clear on how that should work, particularly when vars/var files are involved.

[dflook]

It sounds like you want something like this example workflow.

Storing the output plan file in an automated workflow is not actually very useful. Consider if there are two PR's that each have a plan. If either of those is merged and applied, the other plan is outdated.

dflook/terraform-plan will generate a plan and add a comment to the PR.
dflook/terraform-apply will also generate a plan, and compare it to the comment on the PR. If they are the same it will be applied.
Both dflook/terraform-plan and dflook/terraform-apply need to have the same input values, including variables and var_file.

[lucjross]

oh, gotcha. i had missed that distinction between the plan types. thank you for clarifying! and for the handy tools 😎

[kishaningithub]

What happens if they are different?

[dflook]

If dflook/terraform-apply compares it's generated plan to the comment on the PR and they don't match, the apply operation is not attempted and the job fails. The workflow log should tell you what has changed since the PR comment has been approved. The comment will also be updated to say that it was not applied.