Terramate

https://terramate.io/docs
Admin
Terramate is an IaC development platform that provides unified control, orchestration, and...
Tokens:71,150
Snippets:570
Trust Score:7.9
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install Terramate using Go (latest)

Source: https://terramate.io/docs/cli/installation

Installs the latest Terramate release using Go. Installs both terramate and terramate-ls into the Go binary folder.

```sh
go install github.com/terramate-io/terramate/cmd/...@latest
```

--------------------------------

### Install Terramate on Ubuntu/Debian via APT

Source: https://terramate.io/docs/cli/installation

Add the Terramate repository and install the CLI using apt.

```sh
# Add the Terramate repo to your sources
echo "deb [trusted=yes] https://repo.terramate.io/apt/ /" \
  | sudo tee /etc/apt/sources.list.d/terramate.list

apt update
apt install terramate
```

--------------------------------

### Install Terramate using asdf

Source: https://terramate.io/docs/cli/installation

Adds the terramate plugin and installs the latest version using asdf.

```sh
asdf plugin add terramate
asdf install terramate latest
```

--------------------------------

### Initialize a new repository for tmgen guide

Source: https://terramate.io/docs/cli/code-generation/tmgen

Initializes a new git repository named `tmgen-guide`.

```sh
git init tmgen-guide
```

--------------------------------

### Clone and Enter the terraform-aws-s3-bucket Module

Source: https://terramate.io/docs/catalyst/how-to/convert-module-to-component

Fetch the example module locally and change into its directory before scaffolding a component.

```sh
git clone https://github.com/terraform-aws-modules/terraform-aws-s3-bucket.git
cd terraform-aws-s3-bucket
```

--------------------------------

### Install Terramate using Go (specific version)

Source: https://terramate.io/docs/cli/installation

Installs Terramate using Go with a specific version tag. Replace <version> with any Terramate version tag.

```sh
go install github.com/terramate-io/terramate/cmd/...@<version>
```

--------------------------------

### Common GitLab CI Configuration with Setup, Tokens, Auth, and Variables

Source: https://terramate.io/docs/cli/automation/gitlab-ci

Common GitLab CI configuration file (gitlab-ci/.common.yml) that combines setup, ID tokens, authentication, and common variables. It installs Terraform and Terramate, defines both GITLAB_OIDC_TOKEN and TM_GITLAB_ID_TOKEN, authenticates to Google Cloud, and sets GIT_STRATEGY to clone with GIT_DEPTH 0.

```yaml
.setup:
  script:
    - apk add unzip git bash curl jq
    - wget https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip -O /tmp/terraform.zip
    - unzip /tmp/terraform.zip -d /tmp
    - mv /tmp/terraform /bin
    - wget https://github.com/terramate-io/terramate/releases/download/v0.9.1/terramate_0.9.1_linux_x86_64.tar.gz -O /tmp/terramate.tar.gz
    - tar xzf /tmp/terramate.tar.gz -C /tmp
    - mv /tmp/terramate /bin

.id_tokens:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
    TM_GITLAB_ID_TOKEN:
      aud: api.terramate.io

.auth:
  script:
    - echo ${GITLAB_OIDC_TOKEN} > `pwd`/.ci_job_jwt_file
    - gcloud iam workload-identity-pools create-cred-config projects/<CHANGEME:project_id>/locations/global/workloadIdentityPools/gitlab-ci/providers/gitlab-ci
      --service-account="<CHANGEME:service_account_email>"
      --output-file=`pwd`/.gcp_temp_cred.json
      --credential-source-file=`pwd`/.ci_job_jwt_file
    - gcloud auth login --cred-file=`pwd`/.gcp_temp_cred.json
    - export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json

.common:
  variables:
    GIT_STRATEGY: clone # clone entire repo instead of using fetch
    GIT_DEPTH: 0 # avoid shallow clone to give terramate all the info it needs
```

--------------------------------

### Install Terramate and Terraform with asdf

Source: https://terramate.io/docs/cli/automation/bitbucket-pipelines

Shell script to install required packages and tools using asdf. It installs unzip and jq, clones asdf, and adds Terraform and Terramate plugins. Requires a .tool-versions file with the specified versions.

```bash
#!/bin/bash

set -euo pipefail

apt-get install -y unzip jq
git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.14.0 && . ~/.asdf/asdf.sh
asdf plugin add terraform
asdf plugin add terramate
asdf install
```

--------------------------------

### Install Terraform and Terramate in GitLab CI

Source: https://terramate.io/docs/cli/automation/gitlab-ci

Defines a GitLab CI hidden job `.setup` that installs required packages (unzip, git, bash, curl, jq) and downloads Terraform 1.9.0 and Terramate v0.9.1 into the container. Use this as a base for jobs that need Terraform and Terramate installed.

```yaml
.setup:
  script:
    - apk add unzip git bash curl jq
    - wget https://releases.hashicorp.com/terraform/1.9.0/terraform_1.9.0_linux_amd64.zip -O /tmp/terraform.zip
    - unzip /tmp/terraform.zip -d /tmp
    - mv /tmp/terraform /bin
    - wget https://github.com/terramate-io/terramate/releases/download/v0.9.1/terramate_0.9.1_linux_x86_64.tar.gz -O /tmp/terramate.tar.gz
    - tar xzf /tmp/terramate.tar.gz -C /tmp
    - mv /tmp/terramate /bin
```

--------------------------------

### Example Component Metadata

Source: https://terramate.io/docs/catalyst/how-to/convert-module-to-component

Example metadata to edit for your organization. Update `class`, `name`, and `version` to match your catalog.

```hcl
define component metadata {
  class   = "example.com/aws-s3-bucket"
  version = "1.0.0"
  name    = "AWS S3 Bucket"
    
   ...
}
```

--------------------------------

### Install Terramate shell completions

Source: https://terramate.io/docs/cli/installation

Installs autocompletion for bash, zsh, and fish shells. Run this command and open a new shell session to activate completions.

```sh
terramate install-completions
```

--------------------------------

### Example terramate_packages.json (remote)

Source: https://terramate.io/docs/catalyst/concepts/collections

Shows the structure of a remote catalog file that exposes bundles and components. This file must be placed at the repository root.

```json
[
  {
    "name": "My Catalog",
    "description": "Contains examples",
    "bundles": [
      {
        "path": "/bundles/my-bundle",
        "name": "Example bundle",
        "class": "my-org/my-bundle",
        "version": "1.0.0"
      }
    ],
    "components": [
      {
        "path": "/components/my-component",
        "name": "Example component",
        "class": "my-org/my-component",
        "version": "1.0.0"
      }
    ]
  }
]
```

--------------------------------

### lets block example

Source: https://terramate.io/docs/cli/code-generation/generate-file

Defines a temporary variable using a lets block within a generate_file block.

```hcl
lets {
  temp_a_plus_b = global.a + global.b
}
```

--------------------------------

### Example usage of terramate.bundles

Source: https://terramate.io/docs/catalyst/reference/variables

Example HCL code that uses `terramate.bundles` to build an options list, combining a default option with parent values derived from the bundle's export data.

```hcl
options = tm_concat(
  [{ name = "-- None --", value = null }],
  [for parent in tm_try(
    tm_joinlist("/",
      tm_tree(tm_values(
        terramate.bundles["terramate.io/tf-github-team"])[*].export.team_tuple.value
      )
    ),
    []) :
    { name = parent, value = tm_reverse(tm_split("/", parent))[0] }
  ]
)
```

--------------------------------

### Complete bitbucket-pipelines.yml for Terramate

Source: https://terramate.io/docs/cli/automation/bitbucket-pipelines

Full pipeline configuration for Terramate with preview, deploy, and drift detection steps. Includes OIDC authentication and uses helper scripts for installation, authentication, planning, applying, and commenting.

```yaml
image: google/cloud-sdk:latest

clone:
  depth: full

pipelines:
  pull-requests:
    '**':
      - step:
          name: Preview
          oidc: true
          script:
            - . ./bitbucket-scripts/install.sh
            - CHANGED_STACKS=$(terramate -C stacks/$STACKS_PATH list --changed)
            - if [[ -z "$CHANGED_STACKS" ]]; then echo "No changed stacks. Exiting."; exit 0; fi
            - echo -e "List of changed stacks:\n$CHANGED_STACKS"
            - export WIP=<WORKLOAD_IDENTITY_PROVIDER>
            - export SA=<SERVICE_ACCOUNT>
            - . ./bitbucket-scripts/gcp-oidc-auth.sh $WIP $SA
            - . ./bitbucket-scripts/terraform-plan.sh
            - export BB_USER=<BITBUCKET_USER>
            - . ./bitbucket-scripts/pr-comment.sh

  branches:
    main:
      - step:
          name: Deploy
          oidc: true
          script:
            - . ./bitbucket-scripts/install.sh
            - CHANGED_STACKS=$(terramate -C stacks/$STACKS_PATH list --changed)
            - if [[ -z "$CHANGED_STACKS" ]]; then echo "No changed stacks. Exiting."; exit 0; fi
            - echo -e "List of changed stacks:\n$CHANGED_STACKS"
            - export WIP=<WORKLOAD_IDENTITY_PROVIDER>
            - export SA=<SERVICE_ACCOUNT>
            - . ./bitbucket-scripts/gcp-oidc-auth.sh $WIP $SA
            - . ./bitbucket-scripts/terraform-apply.sh $STACKS_PATH

  custom:
    drift:
      - step:
          name: Drift Detection
          oidc: true
          script:
            - . ./bitbucket-scripts/install.sh
            - export WIP=<WORKLOAD_IDENTITY_PROVIDER>
            - export SA=<SERVICE_ACCOUNT>
            - . ./bitbucket-scripts/gcp-oidc-auth.sh $WIP $SA
            - . ./bitbucket-scripts/drift.sh
```

--------------------------------

### Run terraform init in all stacks with terramate run

Source: https://terramate.io/docs/cli/orchestration

Use the `terramate run` command to execute a single command across all stacks in the current configuration. This example runs `terraform init` in every stack.

```bash
terramate run terraform init
```

--------------------------------

### Basic instantiation with local source

Source: https://terramate.io/docs/cli/reference/blocks/component

Instantiates a component from a local directory path, providing input values for cidr_block and region.

```hcl
component "vpc" {
  source = "../components/vpc"

  inputs {
    cidr_block = "10.0.0.0/16"
    region     = "us-east-1"
  }
}

```

--------------------------------

### Add Terramate YUM repository and install

Source: https://terramate.io/docs/cli/installation

Adds the Terramate repository to YUM sources and installs the terramate package. This installs both the terramate CLI and terramate-ls language server.

```bash
sudo tee /etc/yum.repos.d/terramate.repo <<EOF
[terramate]
name=Terramate Repository
baseurl=https://repo.terramate.io/yum/
enabled=1
gpgcheck=0
EOF

dnf install terramate
```

--------------------------------

### Install Terramate on macOS with Homebrew

Source: https://terramate.io/docs/cli/installation

Use Homebrew to install Terramate CLI on macOS.

```sh
brew install terramate
```

--------------------------------

### Run hello world in all stacks

Source: https://terramate.io/docs/cli/orchestration/run-commands-in-stacks

Executes `echo "hello world"` in every stack reachable from the working directory, honoring the defined order of execution.

```hcl
terramate run echo "hello world"
```

--------------------------------

### Bundle instantiation in HCL

Source: https://terramate.io/docs/catalyst/concepts/bundles

Shows how a developer instantiates a bundle using HCL, an alternative to YAML.

```hcl
# file: bundle.tm.hcl or bundle.tm
bundle "my-svc" {
  source = "/bundles/example.com/my-bundle"
  inputs {
    name = "my-svc"
  }
}
```

--------------------------------

### Bitbucket Pipelines Preview Workflow (bitbucket-pipelines.yml)

Source: https://terramate.io/docs/cli/automation/bitbucket-pipelines/preview-workflow

YAML pipeline configuration for pull requests that runs a preview: installs dependencies, lists changed stacks, authenticates with GCP via OIDC, runs terraform plan, and posts a comment. Requires environment variables STACKS_PATH, WIP, SA, and the referenced scripts.

```yaml
pipelines:
  pull-requests:
    '**':
      - step:
          name: Preview
          oidc: true
          script:
            - . ./bitbucket-scripts/install.sh
            - CHANGED_STACKS=$(terramate -C stacks/$STACKS_PATH list --changed)
            - if [[ -z "$CHANGED_STACKS" ]]; then echo "No changed stacks. Exiting."; exit 0; fi
            - echo -e "List of changed stacks:\n$CHANGED_STACKS"
            - export WIP=projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<WIP_NAME>/providers/<WIPP_NAME>
            - export SA=<SERVICE_ACCOUNT_EMAIL>
            - . ./bitbucket-scripts/gcp-oidc-auth.sh $WIP $SA
            - . ./bitbucket-scripts/terraform-plan.sh
            - . ./bitbucket-scripts/pr-comment.sh
```

--------------------------------

### Specify Terraform and Terramate versions in .tool-versions

Source: https://terramate.io/docs/cli/automation/bitbucket-pipelines

Defines the versions of Terraform and Terramate to be installed by asdf. This file is required by the install script.

```plaintext
terraform 1.9.3
terramate 0.11.5
```

--------------------------------

### Create a new stack with terramate create

Source: https://terramate.io/docs/cli/code-generation/tmgen

Creates a new stack named `example-stack`.

```sh
terramate create example-stack
```

--------------------------------

### Define a promotion chain with environment blocks

Source: https://terramate.io/docs/cli/reference/blocks/environment

Three `environment` blocks in separate files (`environments/dev.tm.hcl`, `environments/staging.tm.hcl`, `environments/prod.tm.hcl`) define a promotion chain from dev to staging to production using the `promote_from` argument.

```hcl
# environments/dev.tm.hcl
environment {
  id          = "dev"
  name        = "Development"
  description = "Development environment for testing changes"
}
```

```hcl
# environments/staging.tm.hcl
environment {
  id           = "staging"
  name         = "Staging"
  description  = "Pre-production environment"
  promote_from = "dev"
}
```

```hcl
# environments/prod.tm.hcl
environment {
  id           = "prod"
  name         = "Production"
  description  = "Production environment"
  promote_from = "staging"
}
```

--------------------------------

### Install Terramate Agent Skills

Source: https://terramate.io/docs/cli/installation

Installs Terramate Agent Skills for AI coding agents like Claude Code, Cursor, Codex, or OpenCode. Provides best-practice guidance for Terraform, OpenTofu, and Terramate.

```sh
npx skills add terramate-io/agent-skills
```

--------------------------------

### Create a Component from a module

Source: https://terramate.io/docs/catalyst/tutorials/create-a-component-and-bundle

Run terramate component create in the module directory to scaffold a Component. Requires a Terraform/OpenTofu module directory with variables.

```sh
cd path/to/module
terramate component create
```

--------------------------------

### Example terraform output -json for vpc stack

Source: https://terramate.io/docs/cli/orchestration/outputs-sharing

Example output of terraform output -json in the vpc stack. The expression outputs.vpc_id.value from the input block returns the string "<value>" from this JSON output.

```json
{
  "vpc_id": {
    "description": "The AWS VPC id",
    "value": "<value>",
    "sensitive": false
  }
}
```

--------------------------------

### Scaffold and generate in one step

Source: https://terramate.io/docs/catalyst/how-to/instantiate-bundle-cli

Use `terramate scaffold --generate` to scaffold the bundle and run `terramate generate` in a single command.

```sh
terramate scaffold --generate
```

--------------------------------

### Terraform plan script (terraform-plan.sh)

Source: https://terramate.io/docs/cli/automation/bitbucket-pipelines

Runs `terraform init` and `terraform plan` on changed stacks, syncing a preview with `--sync-preview` and saving the plan to `out.tfplan`. Uses `-detailed-exitcode` to detect changes.

```bash
#!/bin/bash

terramate run --changed -- terraform init -lock-timeout=5m
terramate run \
  --changed \
  --sync-preview \
  --terraform-plan-file=out.tfplan \
  -- \
  terraform plan -lock-timeout=5m -detailed-exitcode -out out.tfplan

```

--------------------------------

### Example: defining globals and using in stack

Source: https://terramate.io/docs/cli/reference/blocks/globals

Example from the documentation showing a stack configuration that defines a global variable `terraform.version` and uses it in the run environment. The `globals` block is defined at the stack level, and the value is accessed via `global.terraform.version`.

```hcl
# stacks/bob/stack.tm.hcl

stack {
  name        = "Bob"
  description = "Bob's first stack"
  id          = "f4b30f69-9f40-49b0-ab98-395ff07c784f"
}

globals "terraform" {
  version = "1.8.0"
}

terramate {
  config {
    run {
      env {
        TERRAFORM_VERSION = global.terraform.version
      }
    }
  }
}
```

--------------------------------

### Bundle instantiation in YAML

Source: https://terramate.io/docs/catalyst/concepts/bundles

Shows how a developer instantiates a bundle using YAML, the default format. The file is typically generated via `terramate scaffold`.

```yaml
# file: bundle.tm.yml or bundle.tm.yaml
apiVersion: terramate.io/cli/v1
kind: BundleInstance
metadata:
  name: my-svc
spec:
  source: /bundles/example.com/my-bundle
  inputs:
    name: my-svc
```

--------------------------------

### stack_filter block example

Source: https://terramate.io/docs/cli/code-generation/generate-file

Filters stacks for code generation using project path patterns with globbing.

```hcl
stack_filter {
  project_paths = [
    "/path/to/specific/stack", # match exact path
    "/path/to/some/stacks/*",  # match stacks in a directory
    "/path/to/many/stacks/**", # match all stacks within a tree
  ]
}
```

--------------------------------

### Terragrunt Preview Workflow Steps

Source: https://terramate.io/docs/cli/automation/github-actions/preview-workflow

GitHub Actions steps for previewing Terragrunt changes in changed Terramate stacks. Includes optional AWS OIDC authentication (commented alternatives for GCP and Azure), then runs terramate run to initialize, validate, and plan with --sync-preview and --terraform-plan-file=out.tfplan. Requires a prior step that outputs changed stacks (steps.list.outputs.stdout).

```yaml
# # Comment this step out if not using AWS
      - name: Configure AWS credentials via OIDC
        if: steps.list.outputs.stdout
        id: auth
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: CHANGEME_AWS_REGION
          role-to-assume: CHANGEME_IAM_ROLE_ARN

      # # Uncomment this if using Google Cloud
      # - name: Authenticate to Google Cloud
      #   if: steps.list.outputs.stdout
      #   id: auth
      #   uses: google-github-actions/auth@v2
      #   with:
      #     workload_identity_provider: CHANGEME_WORKLOAD_IDENTITY_PROVIDER
      #     service_account: CHANGEME_SERVICE_ACCOUNT_EMAIL

      # # Uncomment this if using Microsoft Azure
      # - name: Configure Azure credentials
      #   if: steps.list.outputs.stdout
      #   id: auth
      #   uses: azure/login@v2
      #   with:
      #     client-id: CHANGEME_AZURE_CLIENT_ID
      #     tenant-id: CHANGEME_AZURE_TENANT_ID
      #     subscription-id: CHANGEME_AZURE_SUBSCRIPTION_ID

      - name: Initialize Terragrunt in changed stacks
        if: steps.list.outputs.stdout
        id: init
        run: |
          terramate run \
           --parallel 1 \
           --changed \
           -- \
           terragrunt init -lock-timeout=5m

      - name: Validate Terragrunt configuration in changed stacks
        if: steps.list.outputs.stdout
        id: validate
        run: |
          terramate run \
            --parallel 5 \
            --changed \
            -- \
            terragrunt validate

      - name: Plan Terragrunt changes in changed stacks
        if: steps.list.outputs.stdout
        id: plan
        run: |
          terramate run \
            --parallel 5 \
            --changed \
            --sync-preview \
            --terraform-plan-file=out.tfplan \
            --terragrunt \
            --continue-on-error \
            -- \
            terragrunt plan -out out.tfplan -detailed-exitcode -lock=false
        env:
          GITHUB_TOKEN: ${{ github.token }}
```

--------------------------------

### generate_file block example

Source: https://terramate.io/docs/cli/code-generation/generate-file

Defines a generate_file block that generates a JSON file using a global variable.

```hcl
generate_file "hello_world.json" {
  content = tm_jsonencode({"hello" = "${global.world}"})
}
```

--------------------------------

### Basic component instantiation with source and inputs

Source: https://terramate.io/docs/cli/reference/blocks/component

Defines a component instantiation with a source reference and an inputs block. The source can be a local directory or a remote reference.

```hcl
component "my-component" {
  source = "github.com/org/catalog//components/my-component?ref=v1.0.0"

  inputs {
    name       = "my-service"
    visibility = "public"
  }
}

```

--------------------------------

### Iterate through all bundle instances with tm_bundles

Source: https://terramate.io/docs/catalyst/how-to/reference-bundle-values-in-codegen

Use `tm_bundles` to iterate through all instances of a bundle class. The example collects the aliases of each instance.

```hcl
# Iterate through all instances of a class
[for b in tm_bundles("example.com/my-bundle/v1") : b.alias]
```

--------------------------------

### Generated file header example

Source: https://terramate.io/docs/cli/code-generation

Shows the header that Terramate adds to generated files, indicating that manual edits will be overwritten by 'terramate generate'.

```hcl
// TERRAMATE: GENERATED AUTOMATICALLY DO NOT EDIT
....
```

--------------------------------

### Terraform Setup Action with wrapper disabled

Source: https://terramate.io/docs/cli/automation/github-actions

Disables the Terraform wrapper to avoid conflicts and preserve exit codes for Terramate Cloud synchronization.

```yaml
- uses: hashicorp/setup-terraform@v3
  with:
    terraform_wrapper: false

```

--------------------------------

### condition attribute example

Source: https://terramate.io/docs/cli/reference/blocks/generate-hcl

Sets a condition attribute using Terramate functions to control code generation. The condition must render to a boolean and supports Terramate variables and functions.

```hcl
condition = tm_anytrue([
   tm_contains(terramate.stack.tags, "my-tag"), # only render if tag is set
   tm_try(global.render_stack, false),          # only render if `render_stack` is `true`
])
```

--------------------------------

### condition attribute example

Source: https://terramate.io/docs/cli/code-generation/generate-file

Shows how to use the condition attribute to conditionally generate files based on stack tags and global variables. Uses tm_anytrue, tm_contains, and tm_try functions.

```hcl
condition = tm_anytrue([
   tm_contains(terramate.stack.tags, "my-tag"), # only render if tag is set
   tm_try(global.render_stack, false), # only render if `render_stack` is `true`
])
```

--------------------------------

### Define global terramate_data

Source: https://terramate.io/docs/cli/code-generation/generate-hcl

Defines a global variable used in the partial evaluation examples. This global is referenced in generate_hcl blocks to demonstrate how Terramate references are evaluated while unknown references are preserved.

```hcl
globals {
  terramate_data = "terramate_data"
}
```

--------------------------------

### OpenTofu Deployment Workflow

Source: https://terramate.io/docs/cli/automation/github-actions/deployment-workflow

GitHub Actions workflow for deploying OpenTofu stacks with Terramate. Includes steps for checking out code, installing Terramate and OpenTofu, listing changed stacks, optional cloud authentication (AWS, GCP, Azure), running tofu init and apply. Requires setting CHANGEME_ placeholders for cloud credentials.

```yaml
name: OpenTofu Deployment

on:
  push:
    branches:
      - main

jobs:
  deploy:
    name: Deploy OpenTofu changes in changed Terramate stacks

    permissions:
      id-token: write
      contents: read

    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
          fetch-depth: 0

      - name: Install Terramate
        uses: terramate-io/terramate-action@v3
        with:
          version: "0.14.0"

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@v2
        with:
          tofu_version: 1.9.0
          tofu_wrapper: false

      - name: List changed stacks
        id: list
        run: terramate list --changed

      # # Comment this step out if not using AWS
      - name: Configure AWS credentials via OIDC
        if: steps.list.outputs.stdout
        id: auth
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: CHANGEME_AWS_REGION
          role-to-assume: CHANGEME_IAM_ROLE_ARN

      # # Uncomment this if using Google Cloud
      # - name: Authenticate to Google Cloud
      #   if: steps.list.outputs.stdout
      #   id: auth
      #   uses: google-github-actions/auth@v2
      #   with:
      #     workload_identity_provider: CHANGEME_WORKLOAD_IDENTITY_PROVIDER
      #     service_account: CHANGEME_SERVICE_ACCOUNT_EMAIL

      # # Uncomment this if using Microsoft Azure
      # - name: Configure Azure credentials
      #   if: steps.list.outputs.stdout
      #   id: auth
      #   uses: azure/login@v2
      #   with:
      #     client-id: CHANGEME_AZURE_CLIENT_ID
      #     tenant-id: CHANGEME_AZURE_TENANT_ID
      #     subscription-id: CHANGEME_AZURE_SUBSCRIPTION_ID

      - name: Run OpenTofu init in each changed stacks
        if: steps.list.outputs.stdout
        id: init
        run: |
          terramate run \
            --parallel 1 \
            --changed \
            -- \
            tofu init

      - name: Apply planned changes on changed stacks
        if: steps.list.outputs.stdout
        id: apply
        run: |
          terramate run \
            --parallel 5 \
            --changed \
            -- \
            tofu apply -input=false -auto-approve -lock-timeout=5m
```
Tokens:
Raw