### v0 Example: Terraform apply with component-path Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md This example shows the v0 usage of the action, including the `component-path` input and various other configuration inputs that are now managed by the `atmos-gitops-config-path` in v1. ```yaml - name: Terraform apply uses: cloudposse/github-action-atmos-terraform-apply@v0 with: component: "foobar" stack: "plat-ue2-sandbox" component-path: "components/terraform/s3-bucket" terraform-apply-role: "arn:aws:iam::111111111111:role/acme-core-gbl-identity-gitops" terraform-state-bucket: "acme-core-ue2-auto-gitops" terraform-state-role: "arn:aws:iam::999999999999:role/acme-core-ue2-auto-gitops-gha" terraform-state-table: "acme-core-ue2-auto-gitops" aws-region: "us-east-2" ``` -------------------------------- ### GitHub Action Atmos Terraform Apply Version Compatibility Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt Examples of using different versions of the `cloudposse/github-action-atmos-terraform-apply` action, showing the required `atmos` version and notable changes for each major version. ```yaml # v5 (current) - uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ ``` ```yaml # v2 (legacy — config in atmos.yaml, not gitops yaml) - uses: cloudposse/github-action-atmos-terraform-apply@v2 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ atmos-version: "1.63.0" ``` ```yaml # v0 (deprecated — all config inline) - uses: cloudposse/github-action-atmos-terraform-apply@v0 with: component: "foobar" stack: "plat-ue2-sandbox" component-path: "components/terraform/s3-bucket" terraform-apply-role: "arn:aws:iam::111111111111:role/acme-core-gbl-identity-gitops" terraform-state-bucket: "acme-core-ue2-auto-gitops" terraform-state-role: "arn:aws:iam::999999999999:role/acme-core-ue2-auto-gitops-gha" terraform-state-table: "acme-core-ue2-auto-gitops" aws-region: "us-east-2" ``` -------------------------------- ### Check Terraform Apply Action Output Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This example shows how to capture and use the `status` output from the `cloudposse/github-action-atmos-terraform-apply` action in subsequent workflow steps. The `status` output can be either 'succeeded' or 'failed'. ```yaml jobs: apply: runs-on: ubuntu-latest steps: - name: Terraform Apply id: apply uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ - name: Check apply result run: | echo "Apply status: ${{ steps.apply.outputs.status }}" # outputs: "succeeded" or "failed" - name: Assert success (used in CI integration tests) uses: nick-fields/assert-action@v2 with: expected: "succeeded" actual: "${{ steps.apply.outputs.status }}" ``` -------------------------------- ### Full GitOps Workflow: Plan on PR, Apply on Merge Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This example demonstrates a complete GitOps workflow using `cloudposse/github-action-atmos-terraform-plan` for planning on pull request events and `cloudposse/github-action-atmos-terraform-apply` for applying changes upon merging. Both actions share common inputs like `component`, `stack`, `sha`, and `atmos-config-path`. ```yaml # .github/workflows/gitops.yml name: "GitOps: Plan on PR, Apply on Merge" on: pull_request: types: [opened, synchronize, reopened] branches: [main] pull_request_target: types: [closed] branches: [main] permissions: id-token: write contents: read pull-requests: write jobs: # ── Plan on PR open / update ────────────────────────────────────────────── plan: if: github.event_name == 'pull_request' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Plan Atmos Component uses: cloudposse/github-action-atmos-terraform-plan@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ sha: ${{ github.event.pull_request.head.sha }} # ── Apply on PR merge ───────────────────────────────────────────────────── apply: if: github.event_name == 'pull_request' && github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Apply Atmos Component id: apply uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ sha: ${{ github.event.pull_request.head.sha }} - name: Notify on failure if: steps.apply.outputs.status == 'failed' run: echo "::error::Terraform apply failed for foobar/plat-ue2-sandbox" ``` -------------------------------- ### GitHub Action Workflow Example Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md Example GitHub Actions workflow to trigger the `atmos-terraform-apply` action. It specifies permissions for AWS role assumption and hardcodes the component and stack for the apply job. This action is typically triggered by specific Git events or manual dispatch. ```yaml name: "atmos-terraform-apply" on: workflow_dispatch: pull_request: types: - closed branches: - main # These permissions are required for GitHub to assume roles in AWS permissions: id-token: write contents: read jobs: apply: runs-on: ubuntu-latest steps: - name: Terraform Apply uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ ``` -------------------------------- ### Configure GitHub Action for Terraform Apply Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt Example workflow demonstrating how to use the `cloudposse/github-action-atmos-terraform-apply` action. It includes required and optional inputs for component, stack, and configuration path, along with settings for SHA, Atmos version, and plan storage. ```yaml # .github/workflows/apply.yml name: "atmos-terraform-apply" on: pull_request: types: [closed] branches: [main] workflow_dispatch: permissions: id-token: write # required for OIDC AWS authentication contents: read jobs: apply: runs-on: ubuntu-latest steps: - name: Terraform Apply uses: cloudposse/github-action-atmos-terraform-apply@v5 with: # -- Required -- component: "foobar" # Atmos component name stack: "plat-ue2-sandbox" # Atmos stack name atmos-config-path: ./rootfs/usr/local/etc/atmos/ # -- Optional -- sha: ${{ github.event.pull_request.head.sha }} # default: github.sha atmos-version: ">= 1.186.0" # default: ">= 1.186.0" skip-checkout: "false" # set true if checkout runs earlier plan-storage: "true" # set false to skip S3/DynamoDB retrieval skip-plandiff: "false" # set true to skip plan-diff validation debug: "false" # enables verbose action logging infracost-api-key: ${{ secrets.INFRACOST_API_KEY }} branding-logo-image: "https://cloudposse.com/logo-300x69.svg" branding-logo-url: "https://cloudposse.com/" identity: "" # Atmos Pro auth identity token: ${{ github.token }} # for downloading atmos releases ``` -------------------------------- ### Stack-Level GitOps Settings Override Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This example shows how to override global GitOps integration settings (artifact storage, IAM roles) for a specific Atmos stack. The global defaults in `atmos.yaml` must still be present. ```yaml # stacks/catalog/my-component.yaml components: terraform: foobar: settings: github: actions_enabled: true # must be true for this action to run integrations: github: gitops: artifact-storage: bucket: cptest-plat-ue2-auto-gitops table: cptest-plat-ue2-auto-gitops-plan-storage role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-plat-ue2-auto-gitops-gha role: plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-plat-gbl-identity-gitops apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-plat-gbl-identity-gitops vars: example: blue ``` -------------------------------- ### AWS GitOps Configuration Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md Configure GitOps integrations for AWS, specifying Terraform and OpenTofu versions, artifact storage details, and IAM roles for plan and apply operations. This setup is typically placed in `atmos.yaml`. ```yaml integrations: github: gitops: opentofu-version: 1.7.3 terraform-version: 1.5.2 infracost-enabled: false artifact-storage: region: us-east-2 bucket: cptest-core-ue2-auto-gitops table: cptest-core-ue2-auto-gitops-plan-storage role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha role: plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops # Set `apply` empty if you don't want to assume IAM role before terraform apply apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops matrix: sort-by: .stack_slug group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-") ``` -------------------------------- ### Stack Level GitOps Configuration Override Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md Override GitOps integration settings on a stack level by defining `settings.integrations`. This example shows how to specify artifact storage and IAM roles for a specific Terraform component. ```yaml components: terraform: foobar: settings: integrations: github: gitops: artifact-storage: bucket: cptest-plat-ue2-auto-gitops table: cptest-plat-ue2-auto-gitops-plan-storage role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-plat-ue2-auto-gitops-gha role: # Set `plan` empty if you don't want to assume IAM role before terraform plan plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-plat-gbl-identity-gitops apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-plat-gbl-identity-gitops ``` -------------------------------- ### Migrate to v1: Use atmos-gitops-config-path Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md When migrating to v1, use the `atmos-gitops-config-path` input to specify the location of your Atmos GitOps configuration file. This replaces several v0 inputs. ```yaml - name: Terraform apply uses: cloudposse/github-action-atmos-terraform-apply@v1 with: atmos-gitops-config-path: ./.github/config/atmos-gitops.yaml component: "foobar" stack: "plat-ue2-sandbox" ``` -------------------------------- ### Enable OpenTofu in Atmos Configuration Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md To enable OpenTofu, set the `opentofu-version` in `atmos.yaml` and configure `components.terraform.command` to `tofu`. This ensures Atmos uses OpenTofu for Terraform operations. ```yaml components: terraform: command: tofu ... integrations: github: gitops: opentofu-version: 1.7.3 ... ``` -------------------------------- ### Apply Skipping Plan Drift Detection (Faster) Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This method applies changes by directly using a previously stored plan, skipping the re-planning and diffing step. This is faster but less safe as it doesn't validate against the current state. ```yaml - name: Apply stored plan directly uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ skip-plandiff: "true" # applies retrieved plan without re-validation ``` -------------------------------- ### Enable Infracost in atmos.yaml Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt Configure Infracost to be enabled for cost diff calculation within the GitHub GitOps integration. Specify artifact storage details and IAM roles for plan and apply operations. ```yaml integrations: github: gitops: terraform-version: 1.5.2 infracost-enabled: true # enables cost diff calculation artifact-storage: region: us-east-2 bucket: cptest-core-ue2-auto-gitops table: cptest-core-ue2-auto-gitops-plan-storage role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha role: plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops ``` -------------------------------- ### Atmos Configuration to Enable OpenTofu Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This configuration enables OpenTofu by setting `components.terraform.command` to `tofu` and specifying the `opentofu-version`. It includes settings for artifact storage and IAM roles, similar to Terraform configurations. ```yaml # atmos.yaml — enable OpenTofu base_path: "tests/opentofu" components: terraform: command: "tofu" # instructs atmos to invoke `tofu` instead of `terraform` base_path: "components/terraform" apply_auto_approve: false deploy_run_init: true init_run_reconfigure: true auto_generate_backend_file: true integrations: github: gitops: opentofu-version: 1.7.3 # version of opentofu/opentofu to install infracost-enabled: false artifact-storage: region: us-east-2 bucket: cptest-core-ue2-auto-gitops table: cptest-core-ue2-auto-gitops-plan-storage role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha role: plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops ``` -------------------------------- ### Apply with Plan Drift Detection (Default) Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This is the default and most secure way to apply changes. It re-plans the Terraform configuration and compares it against the current state before applying. ```yaml - name: Apply with plan drift detection uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ skip-plandiff: "false" # default — re-plans and compares before applying ``` -------------------------------- ### Terraform Apply Workflow Step with Infracost Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt A GitHub Actions workflow step that uses the `cloudposse/github-action-atmos-terraform-apply` action to apply Terraform changes, with Infracost enabled for cost diff calculation. ```yaml - name: Terraform Apply (with cost diff) uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ infracost-api-key: ${{ secrets.INFRACOST_API_KEY }} ``` -------------------------------- ### Azure GitOps Configuration Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md Configure GitOps integrations for Azure, specifying Terraform and OpenTofu versions and artifact storage details for Azure Blob Storage and Cosmos DB. The `role` section is omitted as it's AWS-specific. ```yaml integrations: github: gitops: opentofu-version: 1.7.3 terraform-version: 1.5.2 infracost-enabled: false artifact-storage: plan-repository-type: azureblob blob-account-name: tfplans blob-container-name: plans metadata-repository-type: cosmos cosmos-container-name: terraform-plan-storage cosmos-database-name: terraform-plan-storage cosmos-endpoint: "https://my-cosmo-account.documents.azure.com:443/" # We remove the `role` section as it is AWS specific matrix: sort-by: .stack_slug group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-") ``` -------------------------------- ### Original Atmos Configuration for v1 Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md This is the deprecated v1 configuration file format for atmos-gitops.yaml, which has been replaced by settings within atmos.yaml and GitHub Actions inputs. ```yaml atmos-version: 1.45.3 atmos-config-path: ./rootfs/usr/local/etc/atmos/ terraform-state-bucket: cptest-core-ue2-auto-gitops terraform-state-table: cptest-core-ue2-auto-gitops terraform-state-role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha terraform-plan-role: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops terraform-apply-role: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops terraform-version: 1.5.2 aws-region: us-east-2 enable-infracost: false sort-by: .stack_slug group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-") ``` -------------------------------- ### Atmos Configuration for AWS GitOps Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This configuration sets up GitOps integrations for Terraform on AWS, specifying artifact storage in S3 and DynamoDB, and IAM roles for plan and apply operations. ```yaml # atmos.yaml (AWS) base_path: "." components: terraform: base_path: "components/terraform" apply_auto_approve: false deploy_run_init: true init_run_reconfigure: true auto_generate_backend_file: true stacks: base_path: "stacks" included_paths: - "orgs/**/*" excluded_paths: - "**/_defaults.yaml" name_pattern: "{tenant}-{environment}-{stage}" integrations: github: gitops: terraform-version: 1.5.7 # Terraform version to install infracost-enabled: false # set true to enable cost diffs artifact-storage: region: us-east-2 bucket: cptest-core-ue2-auto-gitops # S3 bucket for plan files table: cptest-core-ue2-auto-gitops-plan-storage # DynamoDB table role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha plan-repository-type: s3 # "s3" (default) or "azureblob" metadata-repository-type: dynamo # "dynamo" (default) or "cosmos" role: plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops # Set apply to "" to skip role assumption before terraform apply matrix: sort-by: .stack_slug group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-") ``` -------------------------------- ### Original GitHub Workflow for v1 Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md This is the deprecated v1 GitHub Actions workflow configuration for the atmos-terraform-apply action, which used atmos-gitops-config-path. ```yaml - name: Plan Atmos Component uses: cloudposse/github-action-atmos-terraform-apply@v1 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-gitops-config-path: "./.github/config/atmos-gitops.yaml" ``` -------------------------------- ### Migrate Atmos Configuration to v2 (YAML) Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md Update your atmos.yaml file to include GitOps integration settings for v2. This includes artifact storage, IAM roles, and Terraform version. ```yaml # ... your existing configuration integrations: github: gitops: terraform-version: 1.5.2 infracost-enabled: false artifact-storage: region: us-east-2 bucket: cptest-core-ue2-auto-gitops table: cptest-core-ue2-auto-gitops-plan-storage role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha role: plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops matrix: sort-by: .stack_slug group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-") ``` -------------------------------- ### Update GitHub Workflow for v2 Source: https://github.com/cloudposse/github-action-atmos-terraform-apply/blob/main/README.md Modify your GitHub Actions workflow to use the v2 of the atmos-terraform-apply action and specify the atmos-config-path. This replaces the older atmos-gitops-config-path. ```yaml - name: Plan Atmos Component uses: cloudposse/github-action-atmos-terraform-apply@v2 with: component: "foobar" stack: "plat-ue2-sandbox" atmos-config-path: ./rootfs/usr/local/etc/atmos/ atmos-version: 1.63.0 ``` -------------------------------- ### Atmos Configuration for Azure GitOps Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This configuration specifies GitOps integrations for Azure, using Azure Blob Storage for plan files and Cosmos DB for metadata. The AWS-specific IAM role section is omitted. ```yaml # atmos.yaml (Azure) integrations: github: gitops: opentofu-version: 1.7.3 terraform-version: 1.5.2 infracost-enabled: false artifact-storage: plan-repository-type: azureblob blob-account-name: tfplans # Azure Storage account blob-container-name: plans # Blob container metadata-repository-type: cosmos cosmos-container-name: terraform-plan-storage cosmos-database-name: terraform-plan-storage cosmos-endpoint: "https://my-cosmo-account.documents.azure.com:443/" matrix: sort-by: .stack_slug group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-") ``` -------------------------------- ### Apply Atmos Pro Component Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This configuration enables Atmos Pro orchestration for a component. It requires `settings.pro.enabled: true` and `settings.github.actions_enabled: false` in the component's configuration. An optional Atmos Pro auth identity token can be provided via the `identity` input. ```yaml # Workflow step invoking apply for an Atmos Pro component - name: Apply Atmos Pro Component id: current uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar-atmos-pro" stack: "plat-ue2-sandbox" atmos-config-path: ${{ runner.temp }} sha: ${{ inputs.sha }} identity: ${{ secrets.ATMOS_PRO_IDENTITY }} # optional Atmos Pro auth token ``` -------------------------------- ### Apply with Plan Storage Disabled Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt When `plan-storage` is set to `false`, the action bypasses S3/DynamoDB for plan retrieval. This mode does not require artifact storage credentials and is suitable for simplified environments or components not using central plan storage. ```yaml # Integration test: apply with plan storage disabled - name: Apply Atmos Component (no plan storage) uses: cloudposse/github-action-atmos-terraform-apply@v5 with: component: "foobar/plan-storage" stack: "plat-ue2-sandbox" atmos-config-path: ${{ runner.temp }} plan-storage: false # skips S3 plan retrieval and DynamoDB metadata debug: true sha: ${{ inputs.sha }} ``` -------------------------------- ### Plan Diff Validation Configuration Source: https://context7.com/cloudposse/github-action-atmos-terraform-apply/llms.txt This configuration snippet demonstrates how to control plan diff validation. Setting `skip-plandiff: true` bypasses the re-run of `atmos terraform plan` and `atmos terraform plan-diff`, applying the stored plan directly. ```yaml # By default (`skip-plandiff: false`), the action re-runs `atmos terraform plan` before applying and calls `atmos terraform plan-diff` to compare the new plan with the stored approved plan. If the plans differ, the workflow fails and posts a diff summary to the PR. Set `skip-plandiff: true` to apply the stored plan directly without re-validation. ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.