Skip to content

Commit 9a36327

Browse files
ZIJZIJ
committed
Add With Opentofu page
1 parent fabaa4f commit 9a36327

File tree

3 files changed

+188
-11
lines changed

3 files changed

+188
-11
lines changed

‎docs/ce/getting-started/with-opentofu.mdx

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
---
2+
title: "With OpenTofu"
3+
---
4+
5+
In this tutorial, you will set up Digger to automate OpenTofu pull requests using Github Actions
6+
7+
# Prerequisites
8+
9+
- A GitHub repository with valid OpenTofu code
10+
- Your cloud provider credentials:
11+
- For AWS: [Hashicorp's AWS tutorial](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/aws-build)
12+
- For GCP: [Hashicorp's GCP tutorial](https://developer.hashicorp.com/terraform/tutorials/gcp-get-started/google-cloud-platform-build)
13+
14+
# Step 1: create your Digger account
15+
16+
Head to [ui.digger.dev](https://ui.digger.dev) and sign up using your preferred method.
17+
18+
You should see an empty dashboard after you sign up.
19+
20+
# Step 2: install the Digger GitHub App
21+
22+
Install the Digger [GitHub App](https://github.com/apps/digger-pro/installations/select_target) into your repository.
23+
24+
<Note>
25+
Digger GitHub App does not need access to your cloud account, it just starts jobs in your CI. All sensitive data stays in your CI job.
26+
27+
You can also [self-host Digger orchestrator](/ce/self-host/deploy-docker) with a private GiHub app and issue your own token
28+
29+
</Note>
30+
31+
# Step 3: Create Action Secrets with cloud credentials
32+
33+
In GitHub repository settings, go to Secrets and Variables - Actions. Create the following secrets:
34+
35+
<Tabs>
36+
<Tab title="AWS">
37+
- `AWS_ACCESS_KEY_ID` - `AWS_SECRET_ACCESS_KEY` You can also [use
38+
OIDC](/ce/cloud-providers/authenticating-with-oidc-on-aws) for AWS
39+
authentication.
40+
</Tab>
41+
<Tab title="GCP">
42+
- `GCP_CREDENTIALS` - contents of your GCP Service Account Key json file You
43+
can also [use OIDC](/gcp/federated-oidc-access/) for GCP authentication.
44+
</Tab>
45+
</Tabs>
46+
47+
# Step 4: Create digger.yml
48+
49+
This file contains Digger configuration and needs to be placed at the root level of your repository. Assuming your OpenTofu code is in the `prod` directory:
50+
51+
```
52+
projects:
53+
- name: production
54+
dir: prod
55+
```
56+
57+
# Step 5: Create Github Actions workflow file
58+
59+
Place it at `.github/workflows/digger_workflow.yml` (name is important!)
60+
61+
<Tabs>
62+
<Tab title="AWS">
63+
```yaml
64+
name: Digger Workflow
65+
66+
on:
67+
workflow_dispatch:
68+
inputs:
69+
spec:
70+
required: true
71+
run_name:
72+
required: false
73+
74+
run-name: '${{inputs.run_name}}'
75+
76+
jobs:
77+
digger-job:
78+
runs-on: ubuntu-latest
79+
permissions:
80+
contents: write # required to merge PRs
81+
actions: write # required for plan persistence
82+
id-token: write # required for workload-identity-federation
83+
pull-requests: write # required to post PR comments
84+
issues: read # required to check if PR number is an issue or not
85+
statuses: write # required to validate combined PR status
86+
87+
steps:
88+
- uses: actions/checkout@v4
89+
- name: ${{ fromJSON(github.event.inputs.spec).job_id }}
90+
run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
91+
- uses: diggerhq/digger@vLatest
92+
with:
93+
digger-spec: ${{ inputs.spec }}
94+
setup-aws: true
95+
setup-opentofu: true
96+
opentofu-version: 1.10.3
97+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
98+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
99+
env:
100+
GITHUB_CONTEXT: ${{ toJson(github) }}
101+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
102+
```
103+
104+
</Tab>
105+
<Tab title="GCP">
106+
```yaml
107+
name: Digger
108+
109+
on:
110+
workflow_dispatch:
111+
inputs:
112+
spec:
113+
required: true
114+
run_name:
115+
required: false
116+
117+
run-name: '${{inputs.run_name}}'
118+
119+
jobs:
120+
digger-job:
121+
name: Digger
122+
runs-on: ubuntu-latest
123+
permissions:
124+
contents: write # required to merge PRs
125+
actions: write # required for plan persistence
126+
id-token: write # required for workload-identity-federation
127+
pull-requests: write # required to post PR comments
128+
issues: read # required to check if PR number is an issue or not
129+
statuses: write # required to validate combined PR status
130+
steps:
131+
- uses: actions/checkout@v4
132+
- name: ${{ fromJSON(github.event.inputs.spec).job_id }}
133+
run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
134+
- id: 'auth'
135+
uses: 'google-github-actions/auth@v1'
136+
with:
137+
credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
138+
create_credentials_file: true
139+
- name: 'Set up Cloud SDK'
140+
uses: 'google-github-actions/setup-gcloud@v1'
141+
- name: 'Use gcloud CLI'
142+
run: 'gcloud info'
143+
- name: digger run
144+
uses: diggerhq/digger@vLatest
145+
with:
146+
digger-spec: ${{ inputs.spec }}
147+
setup-aws: false
148+
setup-opentofu: true
149+
opentofu-version: 1.10.3
150+
env:
151+
GITHUB_CONTEXT: ${{ toJson(github) }}
152+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
153+
```
154+
155+
This workflow includes additional steps for GCP:
156+
- Authenticate into GCP using Google's official [Auth action](https://github.com/google-github-actions/auth). Note the `create_credentials_file: true` option; without it, subsequent steps that rely on [Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc) will not work.
157+
- Set up Google Cloud SDK for use in the subsequent steps via Google's official [Setup-gcloud action](https://github.com/google-github-actions/setup-gcloud)
158+
- Verify that GCP is configured correctly by running `gcloud info`
159+
160+
</Tab>
161+
</Tabs>
162+
163+
# Step 6: Create a PR to verify that it works
164+
165+
OpenTofu will run an existing plan against your code.
166+
167+
Make any change to your OpenTofu code e.g. add a blank line. An action run should start (you can see log output in Actions). After some time you should see output of OpenTofu Plan added as a comment to your PR.
168+
169+
Then you can add a comment like `digger apply` and shortly after apply output will be added as comment too.
170+
171+
# Demo repositories
172+
173+
- [AWS demo repo](https://github.com/diggerhq/quickstart-actions-aws)
174+
- [GCP demo repo](https://github.com/diggerhq/demo-conftest-gcp/)

‎docs/ce/getting-started/with-terraform.mdx

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ You should see an empty dashboard after you sign up.
1919

2020
# Step 2: install the Digger GitHub App
2121

22-
Install the Digger [GitHub App](https://github.com/apps/digger-cloud/installations/select_target) into your repository.
22+
Install the Digger [GitHub App](https://github.com/apps/digger-pro/installations/select_target) into your repository.
2323

2424
<Note>
2525
Digger GitHub App does not need access to your cloud account, it just starts jobs in your CI. All sensitive data stays in your CI job.
@@ -34,15 +34,13 @@ In GitHub repository settings, go to Secrets and Variables - Actions. Create the
3434

3535
<Tabs>
3636
<Tab title="AWS">
37-
- `AWS_ACCESS_KEY_ID`
38-
- `AWS_SECRET_ACCESS_KEY`
39-
40-
You can also [use OIDC](/ce/cloud-providers/authenticating-with-oidc-on-aws) for AWS authentication.
37+
- `AWS_ACCESS_KEY_ID` - `AWS_SECRET_ACCESS_KEY` You can also [use
38+
OIDC](/ce/cloud-providers/authenticating-with-oidc-on-aws) for AWS
39+
authentication.
4140
</Tab>
4241
<Tab title="GCP">
43-
- `GCP_CREDENTIALS` - contents of your GCP Service Account Key json file
44-
45-
You can also [use OIDC](/gcp/federated-oidc-access/) for GCP authentication.
42+
- `GCP_CREDENTIALS` - contents of your GCP Service Account Key json file You
43+
can also [use OIDC](/gcp/federated-oidc-access/) for GCP authentication.
4644
</Tab>
4745
</Tabs>
4846

@@ -95,12 +93,14 @@ Place it at `.github/workflows/digger_workflow.yml` (name is important!)
9593
digger-spec: ${{ inputs.spec }}
9694
setup-aws: true
9795
setup-terraform: true
96+
terraform-version: 1.5.5
9897
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
9998
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
10099
env:
101100
GITHUB_CONTEXT: ${{ toJson(github) }}
102101
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
103102
```
103+
104104
</Tab>
105105
<Tab title="GCP">
106106
```yaml
@@ -146,15 +146,17 @@ Place it at `.github/workflows/digger_workflow.yml` (name is important!)
146146
digger-spec: ${{ inputs.spec }}
147147
setup-aws: false
148148
setup-terraform: true
149+
terraform-version: 1.5.5
149150
env:
150151
GITHUB_CONTEXT: ${{ toJson(github) }}
151152
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
152153
```
153-
154+
154155
This workflow includes additional steps for GCP:
155156
- Authenticate into GCP using Google's official [Auth action](https://github.com/google-github-actions/auth). Note the `create_credentials_file: true` option; without it, subsequent steps that rely on [Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc) will not work.
156157
- Set up Google Cloud SDK for use in the subsequent steps via Google's official [Setup-gcloud action](https://github.com/google-github-actions/setup-gcloud)
157158
- Verify that GCP is configured correctly by running `gcloud info`
159+
158160
</Tab>
159161
</Tabs>
160162

@@ -169,4 +171,4 @@ Then you can add a comment like `digger apply` and shortly after apply output wi
169171
# Demo repositories
170172

171173
- [AWS demo repo](https://github.com/diggerhq/quickstart-actions-aws)
172-
- [GCP demo repo](https://github.com/diggerhq/demo-conftest-gcp/)
174+
- [GCP demo repo](https://github.com/diggerhq/demo-conftest-gcp/)

‎docs/mint.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,8 @@
4444
{
4545
"group": "Getting Started",
4646
"pages": [
47-
"ce/getting-started/with-terraform"
47+
"ce/getting-started/with-terraform",
48+
"ce/getting-started/with-opentofu"
4849
]
4950
},
5051
{

0 commit comments

Comments
 (0)