@@ -7,23 +7,23 @@ inputs:
7
7
local-dev-mode :
8
8
description : run digger for local development?
9
9
required : false
10
- default : false
10
+ default : " false"
11
11
local-dev-cli-path :
12
12
description : The path to where the compiled digger cli on the self-hosted runner exists (absolute path)
13
13
required : false
14
- default : ' ./digger'
14
+ default : " ./digger"
15
15
ee :
16
16
description : use ee cli?
17
17
required : false
18
- default : ' false'
18
+ default : " false"
19
19
fips :
20
20
description : build with fips140 standard?
21
21
required : false
22
- default : ' false'
22
+ default : " false"
23
23
setup-aws :
24
24
description : Setup AWS
25
25
required : false
26
- default : ' false'
26
+ default : " false"
27
27
aws-access-key-id :
28
28
description : AWS access key id
29
29
required : false
@@ -47,7 +47,7 @@ inputs:
47
47
setup-google-cloud :
48
48
description : Setup google cloud
49
49
required : false
50
- default : ' false'
50
+ default : " false"
51
51
google-auth-credentials :
52
52
description : Service account key used got Google auth (mutually exclusive with 'google-workload-identity-provider' input)
53
53
required : false
@@ -66,7 +66,7 @@ inputs:
66
66
setup-azure :
67
67
description : Setup Azure
68
68
required : false
69
- default : ' false'
69
+ default : " false"
70
70
azure-client-id :
71
71
description : Azure Client ID to be used for Azure OIDC auth
72
72
required : false
@@ -79,15 +79,15 @@ inputs:
79
79
setup-terragrunt :
80
80
description : Setup terragrunt
81
81
required : false
82
- default : ' false'
82
+ default : " false"
83
83
setup-opentofu :
84
84
description : Setup OpenToFu
85
85
required : false
86
- default : ' false'
86
+ default : " false"
87
87
setup-pulumi :
88
88
description : Setup Pulumi
89
89
required : false
90
- default : ' false'
90
+ default : " false"
91
91
terragrunt-version :
92
92
description : Terragrunt version
93
93
required : false
@@ -104,15 +104,15 @@ inputs:
104
104
setup-terraform :
105
105
description : Setup terraform
106
106
required : false
107
- default : ' false'
107
+ default : " false"
108
108
terraform-version :
109
109
description : Terraform version
110
110
required : false
111
111
default : v1.5.5
112
112
configure-checkout :
113
113
description : Configure checkout. Beware that this will overwrite any changes in the working directory
114
114
required : false
115
- default : ' true'
115
+ default : " true"
116
116
upload-plan-destination :
117
117
description : Destination to upload the plan to. azure, gcp, github and aws are currently supported.
118
118
required : false
@@ -142,15 +142,15 @@ inputs:
142
142
setup-checkov :
143
143
description : Setup Checkov
144
144
required : false
145
- default : ' false'
145
+ default : " false"
146
146
checkov-version :
147
147
description : Checkov version
148
148
required : false
149
- default : ' 3.2.22'
149
+ default : " 3.2.22"
150
150
disable-locking :
151
151
description : Disable locking (deprecated, use pr_locks on digger.yml instead)
152
152
required : false
153
- default : ' false'
153
+ default : " false"
154
154
digger-filename :
155
155
description : Alternative Digger configuration file name
156
156
required : false
@@ -163,76 +163,75 @@ inputs:
163
163
digger-hostname :
164
164
description : Digger hostname
165
165
required : false
166
- default : ' https://cloud.digger.dev'
166
+ default : " https://cloud.digger.dev"
167
167
digger-organisation :
168
168
description : The name of your digger organisation
169
169
required : false
170
170
setup-tfenv :
171
171
description : Setup tfenv
172
172
required : false
173
- default : ' false'
173
+ default : " false"
174
174
post-plans-as-one-comment :
175
175
description : Post plans as one comment
176
176
required : false
177
- default : ' false'
177
+ default : " false"
178
178
reporting-strategy :
179
- description : ' comments_per_run or latest_run_comment, anything else will default to original behavior of multiple comments'
179
+ description : " comments_per_run or latest_run_comment, anything else will default to original behavior of multiple comments"
180
180
required : false
181
- default : ' comments_per_run'
181
+ default : " comments_per_run"
182
182
mode :
183
- description : ' manual, drift-detection or otherwise'
183
+ description : " manual, drift-detection or otherwise"
184
184
required : false
185
- default : ' '
185
+ default : " "
186
186
no-backend :
187
- description : ' run cli-only, without an orchestrator backend'
187
+ description : " run cli-only, without an orchestrator backend"
188
188
required : false
189
- default : ' false'
189
+ default : " false"
190
190
command :
191
- description : ' digger plan or digger apply in case of manual mode'
191
+ description : " digger plan or digger apply in case of manual mode"
192
192
required : false
193
- default : ' '
193
+ default : " "
194
194
project :
195
- description : ' project name for digger to run in case of manual mode'
195
+ description : " project name for digger to run in case of manual mode"
196
196
required : false
197
- default : ' '
197
+ default : " "
198
198
drift-detection-slack-notification-url :
199
- description : ' drift-detection slack drift url'
199
+ description : " drift-detection slack drift url"
200
200
required : false
201
- default : ' '
201
+ default : " "
202
202
drift-detection-advanced-slack-notification-url :
203
- description : ' drift-detection slack drift url (advanced mode, ee only)'
203
+ description : " drift-detection slack drift url (advanced mode, ee only)"
204
204
required : false
205
- default : ' '
205
+ default : " "
206
206
cache-dependencies :
207
207
description : " Leverage actions/cache to cache dependencies to speed up execution"
208
208
required : false
209
- default : ' false'
209
+ default : " false"
210
210
terraform-cache-dir :
211
211
description : " allows overriding of the terraform cache dir which defaults to ${github.workspace}/cache"
212
212
required : false
213
- default : ' '
213
+ default : " "
214
214
cache-dependencies-s3 :
215
215
description : " Use S3 for caching terraform/terragrunt dependencies"
216
216
required : false
217
- default : ' false'
217
+ default : " false"
218
218
cache-dependencies-s3-bucket :
219
219
description : " S3 bucket name for caching without the leading s3 (e.g. mybucket)"
220
220
required : false
221
- default : ' '
221
+ default : " "
222
222
cache-dependencies-s3-bucket-prefix :
223
223
description : " S3 bucket prefix for caching (e.g. cache)"
224
224
required : false
225
- default : ' '
225
+ default : " "
226
226
cache-dependencies-s3-region :
227
227
description : " AWS region for S3 cache bucket"
228
228
required : false
229
- default : ' us-east-1'
230
-
229
+ default : " us-east-1"
231
230
232
231
digger-spec :
233
232
description : " (orchestrator only) the spec to pass onto digger cli"
234
233
required : false
235
- default : ' '
234
+ default : " "
236
235
237
236
outputs :
238
237
output :
@@ -270,7 +269,7 @@ runs:
270
269
- name : Set up Google Auth Using A Service Account Key
271
270
uses : google-github-actions/auth@v2
272
271
with :
273
- credentials_json : ' ${{ inputs.google-auth-credentials }}'
272
+ credentials_json : " ${{ inputs.google-auth-credentials }}"
274
273
if : ${{ inputs.setup-google-cloud == 'true' && inputs.google-auth-credentials != '' }}
275
274
276
275
- name : Set up Google Auth Using Workload Identity Federation
@@ -339,14 +338,14 @@ runs:
339
338
BUCKET="${{ inputs.cache-dependencies-s3-bucket }}"
340
339
REGION="${{ inputs.cache-dependencies-s3-region }}"
341
340
PREFIX="${{ inputs.cache-dependencies-s3-bucket-prefix }}"
342
-
341
+
343
342
SCRIPT_PATH="${{ github.action_path }}/scripts/s3-cache-download.bash"
344
343
if [ ! -f "$SCRIPT_PATH" ]; then
345
344
echo "::error::S3 cache download script not found at $SCRIPT_PATH"
346
345
echo "Please make sure the script exists and is properly installed."
347
346
exit 1
348
347
fi
349
-
348
+
350
349
chmod +x "$SCRIPT_PATH"
351
350
"$SCRIPT_PATH" "$BUCKET" "$PREFIX" "$REGION" "$TF_PLUGIN_CACHE_DIR"
352
351
if : ${{ inputs.cache-dependencies-s3 == 'true' }}
@@ -395,7 +394,7 @@ runs:
395
394
- name : setup go
396
395
uses : actions/setup-go@v5
397
396
with :
398
- go-version-file : ' ${{ github.action_path }}/cli/go.mod'
397
+ go-version-file : " ${{ github.action_path }}/cli/go.mod"
399
398
cache : false
400
399
if : ${{ !startsWith(github.action_ref, 'v') }}
401
400
@@ -434,7 +433,6 @@ runs:
434
433
mkdir -p $GITHUB_WORKSPACE/cache
435
434
shell : bash
436
435
437
-
438
436
- name : build and run digger
439
437
if : ${{ !startsWith(github.action_ref, 'v') && inputs.local-dev-mode == 'false' }}
440
438
shell : bash
@@ -464,28 +462,28 @@ runs:
464
462
INPUT_DRIFT_DETECTION_ADVANCED_SLACK_NOTIFICATION_URL : ${{ inputs.drift-detection-advanced-slack-notification-url }}
465
463
466
464
NO_BACKEND : ${{ inputs.no-backend }}
467
- DEBUG : ' true'
465
+ DEBUG : " true"
468
466
TG_PROVIDER_CACHE : ${{ (inputs.cache-dependencies == 'true' || inputs.cache-dependencies-s3 == 'true') && 1 || 0 }}
469
467
TERRAGRUNT_PROVIDER_CACHE : ${{ (inputs.cache-dependencies == 'true' || inputs.cache-dependencies-s3 == 'true') && 1 || 0 }}
470
468
TF_PLUGIN_CACHE_DIR : ${{ env.TF_PLUGIN_CACHE_DIR }}
471
469
TG_PROVIDER_CACHE_DIR : ${{ env.TF_PLUGIN_CACHE_DIR }}
472
470
TERRAGRUNT_PROVIDER_CACHE_DIR : ${{ env.TF_PLUGIN_CACHE_DIR }}
473
471
DIGGER_RUN_SPEC : ${{inputs.digger-spec}}
474
472
run : |
475
- if [[ ${{ inputs.ee }} == "true" ]]; then
476
- cd $GITHUB_ACTION_PATH/ee/cli
477
- else
478
- cd $GITHUB_ACTION_PATH/cli
479
- fi
480
- if [[ ${{ inputs.fips }} == "true" ]]; then
481
- export GODEBUG=fips140=only
482
- export GOFIPS140=v1.0.0
483
- fi
484
- go build -o digger ./cmd/digger
485
- chmod +x digger
486
- PATH=$PATH:$(pwd)
487
- cd $GITHUB_WORKSPACE
488
- digger
473
+ if [[ ${{ inputs.ee }} == "true" ]]; then
474
+ cd $GITHUB_ACTION_PATH/ee/cli
475
+ else
476
+ cd $GITHUB_ACTION_PATH/cli
477
+ fi
478
+ if [[ ${{ inputs.fips }} == "true" ]]; then
479
+ export GODEBUG=fips140=only
480
+ export GOFIPS140=v1.0.0
481
+ fi
482
+ go build -o digger ./cmd/digger
483
+ chmod +x digger
484
+ PATH=$PATH:$(pwd)
485
+ cd $GITHUB_WORKSPACE
486
+ digger
489
487
490
488
- name : run digger
491
489
if : ${{ startsWith(github.action_ref, 'v') && inputs.local-dev-mode == 'false' }}
@@ -525,10 +523,10 @@ runs:
525
523
shell : bash
526
524
run : |
527
525
set -euo pipefail
528
-
526
+
529
527
echo "🔧 Downloading Digger CLI..."
530
528
echo "Runner OS: ${{ runner.os }}, Arch: ${{ runner.arch }}, Action Ref: ${actionref}"
531
-
529
+
532
530
if [[ ${{ inputs.ee }} == "true" ]]; then
533
531
if [[ ${{ inputs.fips }} == "true" ]]; then
534
532
DOWNLOAD_URL="https://github.com/diggerhq/digger/releases/download/${actionref}/digger-ee-cli-${{ runner.os }}-${{ runner.arch }}-fips"
@@ -538,9 +536,9 @@ runs:
538
536
else
539
537
DOWNLOAD_URL="https://github.com/diggerhq/digger/releases/download/${actionref}/digger-cli-${{ runner.os }}-${{ runner.arch }}"
540
538
fi
541
-
539
+
542
540
echo "Downloading from: $DOWNLOAD_URL"
543
-
541
+
544
542
if ! curl -sL --fail "$DOWNLOAD_URL" -o digger; then
545
543
echo "Failed to download Digger CLI from $DOWNLOAD_URL"
546
544
echo ""
@@ -555,26 +553,26 @@ runs:
555
553
echo "- Try using a different release version"
556
554
exit 1
557
555
fi
558
-
556
+
559
557
if [[ ! -f digger || ! -s digger ]]; then
560
558
echo "Downloaded file is empty or doesn't exist"
561
559
exit 1
562
560
fi
563
-
561
+
564
562
chmod +x digger
565
-
563
+
566
564
if [[ ! -x digger ]]; then
567
565
echo "Failed to make digger executable"
568
566
exit 1
569
567
fi
570
-
568
+
571
569
echo "Successfully downloaded and prepared Digger CLI"
572
570
PATH=$PATH:$(pwd)
573
571
cd $GITHUB_WORKSPACE
574
572
digger
575
573
576
574
- name : run digger in local dev mode
577
- if : ${{ inputs.local-dev-mode == 'true' }}
575
+ if : ${{ inputs.local-dev-mode == 'true' }}
578
576
env :
579
577
actionref : ${{ github.action_ref }}
580
578
PLAN_UPLOAD_DESTINATION : ${{ inputs.upload-plan-destination }}
@@ -613,10 +611,10 @@ runs:
613
611
set -euo pipefail
614
612
615
613
cd $GITHUB_WORKSPACE
616
-
614
+
617
615
echo "🚀 Running digger..."
618
616
RAW="${{ inputs.local-dev-cli-path }}"
619
-
617
+
620
618
# Validate path to prevent command injection
621
619
if [[ "$RAW" =~ [^a-zA-Z0-9_./-] ]]; then
622
620
echo "❌ Invalid characters in local-dev-cli-path"
@@ -632,7 +630,7 @@ runs:
632
630
633
631
BIN="$DIR/digger"
634
632
[[ -x "$BIN" ]] || { echo "❌ digger not executable at $BIN"; exit 1; }
635
-
633
+
636
634
$BIN
637
635
echo "✅ digger completed"
638
636
@@ -649,14 +647,14 @@ runs:
649
647
BUCKET="${{ inputs.cache-dependencies-s3-bucket }}"
650
648
REGION="${{ inputs.cache-dependencies-s3-region }}"
651
649
PREFIX="${{ inputs.cache-dependencies-s3-bucket-prefix }}"
652
-
650
+
653
651
SCRIPT_PATH="${{ github.action_path }}/scripts/s3-cache-upload.bash"
654
652
if [ ! -f "$SCRIPT_PATH" ]; then
655
653
echo "::error::S3 cache upload script not found at $SCRIPT_PATH"
656
654
echo "Please make sure the script exists and is properly installed."
657
655
exit 1
658
656
fi
659
-
657
+
660
658
chmod +x "$SCRIPT_PATH"
661
659
"$SCRIPT_PATH" "$BUCKET" "$PREFIX" "$REGION" "$TF_PLUGIN_CACHE_DIR"
662
660
if : ${{ always() && inputs.cache-dependencies-s3 == 'true' }}
0 commit comments