Generic question: Execution based on the PR comments?

[gowgopal83]

Can the tf plan or tf apply commands (with arguments like working-directory/arg-workspace) be executed based on comments in a pull request?

[rdhar]

Hi @gowgopal83, great Q and I understand wanting the flexibility of triggering Terraform/OpenTofu commands directly via PR comments (i.e., issue_comment), similar to Atlantis PR automation.

This has come up a couple of times previously, and the main problem has been the issue_comment event trigger is woefully limited compared to the equivalent pull_request one. That's not to say it isn't possible, as demonstrated by this GitHub blog post on CI/CD automation with IssueOps.

In place of PR comments, I'd recommend PR label-based workflows to trigger actions, as shown in this example with run-plan and run-apply "commands" affecting how the workflow is run.

[gowgopal83]

Apologies for the delayed response. I followed the example and created the workflow below, which successfully runs the Terraform plan and posts the output to the PR. However, when I try to trigger it using /run-plan or run-plan as a PR comment, nothing happens. Am I missing something?

---
name: Terraform Plan on PR
on:
  pull_request:
    types: [opened, synchronize, labeled]

  workflow_dispatch:
    inputs:
      # checkov:skip=CKV_GHA_7
      # This workflow requires manual inputs for
      # tf_directory and tf_workspace for flexibility.
      command:
        description: "TF command (plan or apply)"
        required: true
        type: choice
        options:
          - plan
          - apply
        default: plan
      tf_directory:
        description: "Directory of the terraform code to plan"
        required: true
        default: "terraform/production"
        type: string
      tf_workspace:
        description: "Terraform workspace to use"
        required: true
        default: "default"
        type: string

permissions:
  actions: read
  checks: write
  contents: read
  pull-requests: write
  id-token: write

jobs:
  terraform_plan_on_pr:
    runs-on: dcloud-runner
    env:
      AWS_REGION: ${{ vars.DCLOUD_MANAGE_AWS_REGION }}
      TERRAFORM_IAM_ROLE_ARN: ${{ vars.DCLOUD_MANAGE_TF_IAM_ASSUME_ROLE }}
      GITHUB_APP_CREDS_SECRET_ARN: ${{ vars.DCLOUD_MANAGE_GH_RUNNER_SECRET_ARN }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Authenticate AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ env.TERRAFORM_IAM_ROLE_ARN }}
          role-session-name: "gh-tf-plan-pr-${{ github.run_id }}"

      - name: Generate GitHub App Token (for PR commenting and TF GitHub Provider)
        id: generate_app_token
        uses: actions/[email protected]
        with:
          app-id: ${{ secrets.GH_RUNNER_IAC_APP_ID }}
          private-key: ${{ secrets.GH_RUNNER_APP_PEM }}
          owner: ${{ github.repository_owner }}
          repositories: dcloud-vsphere-infra,tf_vsphere_vm

      - name: Authenticate Git for Terraform GitHub Provider
        run: |
          GHTOKEN="${{ steps.generate_app_token.outputs.token }}"
          git config --global \
          url."https://x-access-token:'${GHTOKEN}'@github.com/".insteadOf "https://github.com/"

      - name: Set Terraform Directory and Workspace
        id: set-vars
        run: |
          echo "TF_DIR=${{ github.event.inputs.tf_directory || 'terraform/production' }}" >> "$GITHUB_OUTPUT"
          echo "TF_WORKSPACE=${{ github.event.inputs.tf_workspace || 'default' }}" >> "$GITHUB_OUTPUT"

      - name: Find Pull Request Number
        id: find-pr
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            PR_NUMBER=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
          elif [ "${{ github.event_name }}" == "issue_comment" ]; then
            PR_NUMBER=$(jq --raw-output .issue.number "$GITHUB_EVENT_PATH")
          else
            BRANCH_NAME="${{ github.ref_name }}"
            PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --json number --jq '.[0].number')
          fi

          if [ -z "$PR_NUMBER" ]; then
            echo "No PR number found, exiting."
            exit 1
          fi
          echo "Found PR number: #${PR_NUMBER:-"none"}"
          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "1.10.5"
          terraform_wrapper: false

      - name: Provision TF via pull request
        id: terraform
        continue-on-error: true
        uses: op5dev/[email protected]
        with:
          command: ${{ inputs.command != '' && inputs.command || contains(github.event.pull_request.labels.*.name, 'run-apply') && 'apply' || 'plan' }}
          arg-backend-config: manage-account.ini
          arg-workspace: ${{ steps.set-vars.outputs.TF_WORKSPACE }}
          working-directory: ${{ steps.set-vars.outputs.TF_DIR  }}
          pr-number: ${{ steps.find-pr.outputs.pr_number }}
        env:
          GITHUB_ENTERPRISE_TOKEN: ${{ steps.generate_app_token.outputs.token }}
          TF_LOG: ERROR

      - name: Remove label
        if: |
          contains(github.event.pull_request.labels.*.name, 'run-plan') ||
          contains(github.event.pull_request.labels.*.name, 'run-apply')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ steps.find-pr.outputs.pr_number }}
          PR_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'run-plan') && 'run-plan' || 'run-apply' }}
        run: |
          gh api \
            /repos/${{ github.repository_owner }}/${{ github.event.repository.name }}/issues/"${PR_NUMBER}"/labels/"${PR_LABEL}" \
            --method DELETE
```

[rdhar]

For one thing, I don't see on: issue_comment event trigger to trigger the workflow in the first place.

For another thing, this project currently doesn't support issue_comment trigger for these reasons, and recommends the use of PR labels in its place.

[gowgopal83]

@rdhar Thank you for the details. Yes, labelling is working, but is there a way to pass the argument like ( tf_directory and tf_workspace) when the workflow triggered by PR labels ?

[rdhar]

You could choose a label-naming convention which marries both of these parameters. For example:

• accounts-dev
• accounts-prod
• database-dev

Then use one of many methods to query PR labels followed by some bash to split the string on - hyphen delimiter and pass into subsequent Terraform jobs/steps.

# For a single input
input="accounts-dev"
service=${input%%-*}  # captures everything before the first hyphen
env=${input##*-}      # captures everything after the last hyphen
echo "Service: $service, Environment: $env"

# For multiple inputs
for input in accounts-dev accounts-prod database-dev; do
  service=${input%%-*}
  env=${input##*-}
  echo "Service: $service, Environment: $env"
done

[gowgopal83]

Appreciate it. My requirements are slightly different, as I need to create the label to be generic for multiple environments. I've updated the workflow to parse the description, and it now integrates properly with the label.

- name: Parse PR Description for Arguments
        id: parse-pr-args
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const body = context.payload.pull_request.body || "";
            const tfDirMatch = body.match(/tf_directory=([a-zA-Z0-9/_-]+)/);
            const tfWorkspaceMatch = body.match(/tf_workspace=([a-zA-Z0-9/_-]+)/);
            const tfDir = tfDirMatch ? tfDirMatch[1] : "terraform/production";
            const tfWorkspace = tfWorkspaceMatch ? tfWorkspaceMatch[1] : "default";
            core.setOutput("TF_DIR", tfDir);
            core.setOutput("TF_WORKSPACE", tfWorkspace);

      - name: Set Terraform Directory and Workspace
        id: set-vars
        run: |
          echo "TF_DIR=${{ steps.parse-pr-args.outputs.TF_DIR }}" >> "$GITHUB_OUTPUT"
          echo "TF_WORKSPACE=${{ steps.parse-pr-args.outputs.TF_WORKSPACE }}" >> "$GITHUB_OUTPUT"

The description has the values for the arguments like below:

tf_directory=dcloud_core
tf_workspace=sng-dev