Skip to content

ci: gate production terragrunt applies behind service releases - #1105

Merged
panicboat merged 19 commits into
mainfrom
ci/production-release-pr
Oct 24, 2026
Merged

ci: gate production terragrunt applies behind service releases#1105
panicboat merged 19 commits into
mainfrom
ci/production-release-pr

Conversation

@panicboat

@panicboat panicboat commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Why

module を修正すると、その module を参照する全環境に同じ main merge で apply される。
そのため develop で確かめてから production に出す段階を踏めない。
production 以外は今までどおり main merge で apply し、production はサービスごとの release PR の merge（release 公開）で apply する形にする。

  • 設計: docs/superpowers/specs/2026-10-24-terragrunt-production-release-design.md
  • 実装計画: docs/superpowers/plans/2026-10-24-terragrunt-production-release.md

What

  • workflow-config.yaml の各環境に apply_trigger を持たせる。
    • master と develop は merge、production は release にする。
    • develop の aws_region は、state bucket の region に合わせて ap-northeast-1 にした（aws/github-oidc-auth/develop/env.hcl の us-east-1 には合わせていない）。
  • main への push では、apply_trigger == 'merge' の target だけに apply を割り当てる。
  • terragrunt-shared stack（aws/{service}）を追加し、modules/ や root.hcl の変更でも deploy:<service> が付くようにする。
    • release-please の branch（release-please--）ではラベル付与を走らせない。
  • release-please を aws/<service>/release-please-config.json ごとに動かす（monorepo と同じ方式）。
    • chore と refactor も CHANGELOG に出してリリース対象にする。
    • apply_trigger: merge の環境ディレクトリだけを変える commit は exclude-paths で release から外す。
      • production に変更がないのに release PR ができ、no-op の apply が走るのを避けるため。
      • modules/ や root.hcl は環境どうしで共有しているので除外しない。
  • auto-release--plan.yaml で release PR に production の plan を出す。
    • 出し直しは、その run の「Re-run all jobs」で行う。
  • auto-release--trigger.yaml で release 公開時に production を apply する。
    • 再実行は workflow_dispatch に tag を渡す。
    • apply job は GitHub environment production を宣言する。apply role の trust が main と environment:production しか許可していないため。
  • 現時点の production は monorepo で管理しているので、terragrunt stack の exclude に environment: production を置く。
    • deploy-actions の label-resolver も release-targets.sh も production を target にしないので、platform からは production を plan も apply もしない。
    • release-please の設定は残すので、release PR はできるが、merge しても何も apply しない。
    • platform で production を作り直すときは、exclude を外す。
  • 検証スクリプトとテストを scripts/terragrunt-release/ に置き、test-terragrunt-release.yaml で CI 実行する。

Merge 前に確認すること

  • この PR は aws/<service>/ に設定ファイルを追加するので、12 サービスに deploy:<service> が自動で付く。
    • merge すると master と develop の stack（github-oidc-auth など）が apply される。
    • apply したくない場合は、最後の push の後にラベルを外す。
  • これまで aws/ の module 変更は apply されていなかった。
    • master（cost-management など）に未 apply の差分があれば、この PR の plan に出る。
  • production は除外しているので、この PR でも merge 後でも production の plan / apply は走らない。
  • 旧方式の release PR chore(main): release 1.0.0 #890 は close 済み。

Test plan

  • bash scripts/terragrunt-release/test.sh が 33 件すべて PASS
  • validate-apply-trigger.sh と check-release-configs.sh が exit 0
  • actionlint は既存の target-environment エラー 1 件のみ
  • develop / production の plan・apply role の実在と trust を aws iam get-role で確認
  • この PR で、master / develop の存在する環境だけ plan が走り、production の plan が出ない
  • plan job が environment なし（github-environment が空）で動く
  • merge 後の main push で production の apply job が skip される
  • 次の module 変更 PR で、ラベルの自動付与 → merge 環境だけの apply → release PR の作成、の順に動く
  • release PR では plan job が、release 公開では apply job が、target が空なので skip される
  • （production の exclude を外した後）release PR に production の plan が出て、merge で production だけが apply される。--ref <tag> の workflow_dispatch で再実行できる
  • aws/github-oidc-auth/develop/ だけを変える PR の merge で、github-oidc-auth の release PR ができない
  • aws と kubernetes を同時に変える PR で、deploy-kubernetes が terragrunt-shared の target を実行しない

🤖 Generated with Claude Code

https://claude.ai/code/session_01BZfNTtmPjmrDmh1MAMtiFS

@panicboat
docs(spec): design the terragrunt production release gate
48c321f 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
docs(spec): hold the apply trigger in workflow-config
71a01ac 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
docs(plan): plan the terragrunt production release gate
f81dfba 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: validate apply_trigger in workflow-config
b70b82e 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: apply only merge-triggered environments on push to main
0954d9e 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: detect changes to files shared across terragrunt environments
acaa236 
Changes under aws/<service>/ outside an environment directory (modules, root.hcl, CHANGELOG.md) matched no stack, so they received no deploy label. A terragrunt-shared stack now labels the service, and its target is excluded from every deploy job so it only triggers detection. The label dispatcher skips release-please PRs so their CHANGELOG.md updates do not plan every environment.

Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: resolve release targets from workflow-config
9ab7031 
Release tags and release-please branches name a service, and the services to release come from the apply_trigger: release environments in workflow-config. The executor gains optional ref and github-environment inputs so a release run can check out a tag and gate on an environment.

Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: release each terragrunt service with its own release-please config
6febc70 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: plan release environments on release pull requests
a8bb8f8 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: apply release environments when a service release is published
4f196f0 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: pin the merge-only apply gate in tests and serialize release runs
c7d0269 
Add tests that read auto-label--deploy-trigger.yaml for the merge-only apply
expression and the terragrunt-shared matrix excludes.
Serialize auto-release plan runs per release branch and apply runs per
working directory, and limit the resolve jobs to contents: read.
Print the rejected release tag or branch on a single line so a crafted value
cannot inject workflow commands.
Document shared-file detection and the release-please config requirement.

Signed-off-by: panicboat <panicboat@gmail.com>
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 0156480c-e9b1-4da6-b627-ba129ca3b1d9
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@panicboat-github-workflow-bot panicboat-github-workflow-bot Bot added deploy:alb Auto-generated deployment label deploy:eks-holmesgpt Auto-generated deployment label deploy:eks-karpenter Auto-generated deployment label deploy:eks-logs Auto-generated deployment label deploy:eks-metrics Auto-generated deployment label deploy:eks-secrets Auto-generated deployment label deploy:eks-traces Auto-generated deployment label deploy:eks Auto-generated deployment label deploy:github-oidc-auth Auto-generated deployment label deploy:iam-service-linked-roles Auto-generated deployment label deploy:secrets-manager Auto-generated deployment label deploy:vpc Auto-generated deployment label labels Oct 24, 2026
@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

❌ Plan Failed (eks-secrets/production)

CI link

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {

  # aws_iam_role_policy.secrets_access will be created
  + resource "aws_iam_role_policy" "secrets_access" {
      + id          = (known after apply)
      + name        = "secrets-access"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "secretsmanager:GetSecretValue",
                          + "secretsmanager:DescribeSecret",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:secretsmanager:ap-northeast-1:337169763788:secret:*"
                      + Sid      = "SecretsManagerRead"
                    },
                  + {
                      + Action    = "kms:Decrypt"
                      + Condition = {
                          + StringEquals = {
                              + "kms:ViaService" = "secretsmanager.ap-northeast-1.amazonaws.com"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "*"
                      + Sid       = "KmsDecryptForSecretsManager"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + pod_identity_role_arn  = (known after apply)
  + pod_identity_role_name = "eks-production-eso"
  • Create
    • aws_iam_role.pod_identity
    • aws_iam_role_policy.secrets_access
Change Result (Click me) 
Changes to Outputs:
  + pod_identity_role_arn  = (known after apply)
  + pod_identity_role_name = "eks-production-eso"

@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

❌ Plan Failed (eks-holmesgpt/production)

CI link

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {
  • Create
    • aws_iam_role.pod_identity
    • aws_iam_role_policy.bedrock_invoke
Change Result (Click me) 
Changes to Outputs:
  + pod_identity_role_arn  = (known after apply)
  + pod_identity_role_name = "eks-production-holmesgpt"

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {

@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

❌ Plan Failed (eks-karpenter/production)

CI link

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {


Error: no matching EC2 VPC found

  with module.vpc.data.aws_vpc.this,
  on ../../vpc/lookup/main.tf line 1, in data "aws_vpc" "this":
   1: data "aws_vpc" "this" {


Error: no matching RDS DB Subnet Group found

  with module.vpc.data.aws_db_subnet_group.this,
  on ../../vpc/lookup/main.tf line 31, in data "aws_db_subnet_group" "this":
  31: data "aws_db_subnet_group" "this" {
  • Create
    • module.system_critical.aws_iam_role.this[0]
    • module.system_critical.aws_iam_role_policy_attachment.additional["ssm"]

⚠️ Warnings

Warning: Value derived from a deprecated source

  on ../../vpc/lookup/outputs.tf line 3, in output "vpc":
   3:   value       = data.aws_vpc.this

This value's attribute ipv6_association_id is derived from
data.aws_vpc.this.ipv6_association_id, which is deprecated with the following
message:

ipv6_association_id is deprecated. Use ipv6_cidr_block_associations instead.

Warning: Value derived from a deprecated source

  on ../../vpc/lookup/outputs.tf line 3, in output "vpc":
   3:   value       = data.aws_vpc.this

This value's attribute ipv6_cidr_block is derived from
data.aws_vpc.this.ipv6_cidr_block, which is deprecated with the following
message:

ipv6_cidr_block is deprecated. Use ipv6_cidr_block_associations instead.

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {


Error: no matching EC2 VPC found

  with module.vpc.data.aws_vpc.this,
  on ../../vpc/lookup/main.tf line 1, in data "aws_vpc" "this":
   1: data "aws_vpc" "this" {


Error: no matching RDS DB Subnet Group found

  with module.vpc.data.aws_db_subnet_group.this,
  on ../../vpc/lookup/main.tf line 31, in data "aws_db_subnet_group" "this":
  31: data "aws_db_subnet_group" "this" {

@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Plan Result (github-oidc-auth/master)

CI link

No changes. Your infrastructure matches the configuration.

@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

❌ Plan Failed (eks-traces/production)

CI link

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {
  • Create
    • aws_iam_role.pod_identity
    • aws_iam_role_policy.s3_access
    • module.s3.aws_s3_bucket.this[0]
    • module.s3.aws_s3_bucket_lifecycle_configuration.this[0]
    • module.s3.aws_s3_bucket_public_access_block.this[0]
    • module.s3.aws_s3_bucket_server_side_encryption_configuration.this[0]
    • module.s3.aws_s3_bucket_versioning.this[0]
Change Result (Click me) 
Changes to Outputs:
  + bucket_name            = (known after apply)
  + bucket_path_prefix     = "production"
  + pod_identity_role_arn  = (known after apply)
  + pod_identity_role_name = "eks-production-tempo"

Error: reading EKS Cluster (eks-production): couldn't find resource

  with module.eks.data.aws_eks_cluster.this,
  on ../../eks/lookup/main.tf line 1, in data "aws_eks_cluster" "this":
   1: data "aws_eks_cluster" "this" {

@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Plan Result (github-oidc-auth/develop)

CI link

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 0 to add, 0 to change, 1 to destroy.
  • Delete
    • aws_cloudwatch_log_group.github_actions_logs
Change Result (Click me) 
  # aws_cloudwatch_log_group.github_actions_logs will be destroyed
  # (because aws_cloudwatch_log_group.github_actions_logs is not in configuration)
  - resource "aws_cloudwatch_log_group" "github_actions_logs" {
      - arn                         = "arn:aws:logs:us-east-1:270242382571:log-group:/github-actions/github-oidc-auth-develop" -> null
      - deletion_protection_enabled = false -> null
      - id                          = "/github-actions/github-oidc-auth-develop" -> null
      - log_group_class             = "STANDARD" -> null
      - name                        = "/github-actions/github-oidc-auth-develop" -> null
      - region                      = "us-east-1" -> null
      - retention_in_days           = 7 -> null
      - skip_destroy                = false -> null
      - tags                        = {
          - "Component"   = "github-oidc-auth"
          - "Environment" = "develop"
          - "LogGroup"    = "github-oidc-auth-develop-github-actions"
          - "ManagedBy"   = "terraform"
          - "Owner"       = "panicboat"
          - "Project"     = "github-oidc-auth"
          - "Repository"  = "panicboat/platform"
        } -> null
      - tags_all                    = {
          - "Component"   = "github-oidc-auth"
          - "Environment" = "develop"
          - "LogGroup"    = "github-oidc-auth-develop-github-actions"
          - "ManagedBy"   = "terraform"
          - "Owner"       = "panicboat"
          - "Project"     = "github-oidc-auth"
          - "Repository"  = "panicboat/platform"
        } -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  - cloudwatch_log_group_arn  = "arn:aws:logs:us-east-1:270242382571:log-group:/github-actions/github-oidc-auth-develop" -> null
  - cloudwatch_log_group_name = "/github-actions/github-oidc-auth-develop" -> null

@panicboat-github-workflow-bot panicboat-github-workflow-bot Bot added deploy:eks-holmesgpt Auto-generated deployment label deploy:eks-karpenter Auto-generated deployment label deploy:eks-logs Auto-generated deployment label deploy:eks-metrics Auto-generated deployment label deploy:eks-secrets Auto-generated deployment label deploy:eks-traces Auto-generated deployment label deploy:eks Auto-generated deployment label deploy:github-oidc-auth Auto-generated deployment label deploy:iam-service-linked-roles Auto-generated deployment label deploy:secrets-manager Auto-generated deployment label deploy:vpc Auto-generated deployment label labels Oct 24, 2026
@panicboat panicboat mentioned this pull request Oct 24, 2026
Closed
@panicboat
docs: re-run release applies on the release tag ref
7d10204 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat-github-workflow-bot panicboat-github-workflow-bot Bot removed deploy:github-oidc-auth Auto-generated deployment label deploy:vpc Auto-generated deployment label deploy:eks Auto-generated deployment label deploy:alb Auto-generated deployment label deploy:eks-logs Auto-generated deployment label deploy:eks-metrics Auto-generated deployment label deploy:eks-traces Auto-generated deployment label deploy:eks-secrets Auto-generated deployment label deploy:iam-service-linked-roles Auto-generated deployment label deploy:eks-holmesgpt Auto-generated deployment label labels Oct 24, 2026
@panicboat panicboat mentioned this pull request Oct 24, 2026
Merged
3 of 7 tasks
@panicboat
docs: plan excluding production from platform terragrunt runs
9a6bdca 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
ci: exclude production from platform terragrunt runs
127acd2 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat
docs: describe which runs skip excluded environments
7a91333 
Signed-off-by: panicboat <panicboat@gmail.com>
@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

✅ Apply Succeeded (github-oidc-auth/develop)

CI link

Apply complete! Resources: 0 added, 0 changed, 1 destroyed.
Details (Click me) 
Oct 24 13:26:21.506 INF download and unarchive the package program=aqua version=2.64.0 env=linux/amd64 exe_name=terragrunt package_name=gruntwork-io/terragrunt package_version=v1.0.2 registry=standard

Initializing the backend...

Successfully configured the backend "s3"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/aws versions matching "6.68.0"...
- Finding hashicorp/tls versions matching "~> 4.4"...
- Installing hashicorp/tls v4.4.2 to the shared cache directory...
- Installing hashicorp/aws v6.68.0 to the shared cache directory...
- Installed hashicorp/tls v4.4.2 (signed, key ID 0C0AF313E5FD9F80)
- Using hashicorp/tls v4.4.2 from the shared cache directory
- Installed hashicorp/aws v6.68.0 (signed, key ID 0C0AF313E5FD9F80)
- Using hashicorp/aws v6.68.0 from the shared cache directory

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.

OpenTofu has been successfully initialized!

You may now begin working with OpenTofu. Try running "tofu plan" to see
any changes that are required for your infrastructure. All OpenTofu commands
should now work.

If you ever set or change modules or backend configuration for OpenTofu,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
data.tls_certificate.github: Reading...
data.tls_certificate.github: Read complete after 0s [id=6bcf7b7f2005c947073a003ff3b596f7fcc8066f]
data.aws_caller_identity.current: Reading...
aws_iam_openid_connect_provider.github[0]: Refreshing state... [id=arn:aws:iam::270242382571:oidc-provider/token.actions.githubusercontent.com]
aws_cloudwatch_log_group.github_actions_logs: Refreshing state... [id=/github-actions/github-oidc-auth-develop]
data.aws_caller_identity.current: Read complete after 0s [id=270242382571]
aws_iam_policy.terragrunt_state_lock: Refreshing state... [id=arn:aws:iam::270242382571:policy/github-oidc-auth-develop-terragrunt-state-lock]
aws_iam_role.apply: Refreshing state... [id=github-oidc-auth-develop-github-actions-apply-role]
aws_iam_role.plan: Refreshing state... [id=github-oidc-auth-develop-github-actions-plan-role]
aws_iam_role_policy_attachment.apply_administrator_access: Refreshing state... [id=github-oidc-auth-develop-github-actions-apply-role/arn:aws:iam::aws:policy/AdministratorAccess]
aws_iam_role_policy_attachment.plan_read_only: Refreshing state... [id=github-oidc-auth-develop-github-actions-plan-role/arn:aws:iam::aws:policy/ReadOnlyAccess]
aws_iam_role_policy_attachment.plan_state_lock: Refreshing state... [id=github-oidc-auth-develop-github-actions-plan-role/arn:aws:iam::270242382571:policy/github-oidc-auth-develop-terragrunt-state-lock]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  - destroy

OpenTofu will perform the following actions:

  # aws_cloudwatch_log_group.github_actions_logs will be destroyed
  # (because aws_cloudwatch_log_group.github_actions_logs is not in configuration)
  - resource "aws_cloudwatch_log_group" "github_actions_logs" {
      - arn                         = "arn:aws:logs:us-east-1:270242382571:log-group:/github-actions/github-oidc-auth-develop" -> null
      - deletion_protection_enabled = false -> null
      - id                          = "/github-actions/github-oidc-auth-develop" -> null
      - log_group_class             = "STANDARD" -> null
      - name                        = "/github-actions/github-oidc-auth-develop" -> null
      - region                      = "us-east-1" -> null
      - retention_in_days           = 7 -> null
      - skip_destroy                = false -> null
      - tags                        = {
          - "Component"   = "github-oidc-auth"
          - "Environment" = "develop"
          - "LogGroup"    = "github-oidc-auth-develop-github-actions"
          - "ManagedBy"   = "terraform"
          - "Owner"       = "panicboat"
          - "Project"     = "github-oidc-auth"
          - "Repository"  = "panicboat/platform"
        } -> null
      - tags_all                    = {
          - "Component"   = "github-oidc-auth"
          - "Environment" = "develop"
          - "LogGroup"    = "github-oidc-auth-develop-github-actions"
          - "ManagedBy"   = "terraform"
          - "Owner"       = "panicboat"
          - "Project"     = "github-oidc-auth"
          - "Repository"  = "panicboat/platform"
        } -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  - cloudwatch_log_group_arn  = "arn:aws:logs:us-east-1:270242382571:log-group:/github-actions/github-oidc-auth-develop" -> null
  - cloudwatch_log_group_name = "/github-actions/github-oidc-auth-develop" -> null
aws_cloudwatch_log_group.github_actions_logs: Destroying... [id=/github-actions/github-oidc-auth-develop]
aws_cloudwatch_log_group.github_actions_logs: Destruction complete after 1s

Apply complete! Resources: 0 added, 0 changed, 1 destroyed.

Outputs:

allowed_environments = tolist([
  "develop",
])
apply_role_arn = "arn:aws:iam::270242382571:role/github-oidc-auth-develop-github-actions-apply-role"
apply_role_name = "github-oidc-auth-develop-github-actions-apply-role"
github_org = "panicboat"
github_repos = tolist([
  "monorepo",
  "platform",
])
oidc_provider_arn = "arn:aws:iam::270242382571:oidc-provider/token.actions.githubusercontent.com"
oidc_provider_url = "https://token.actions.githubusercontent.com"
plan_role_arn = "arn:aws:iam::270242382571:role/github-oidc-auth-develop-github-actions-plan-role"
plan_role_name = "github-oidc-auth-develop-github-actions-plan-role"

@panicboat-github-workflow-bot

panicboat-github-workflow-bot Bot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

✅ Apply Succeeded (github-oidc-auth/master)

CI link

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
Details (Click me) 
Oct 24 13:26:22.061 INF download and unarchive the package program=aqua version=2.64.0 env=linux/amd64 exe_name=terragrunt package_name=gruntwork-io/terragrunt package_version=v1.0.2 registry=standard

Initializing the backend...

Successfully configured the backend "s3"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/tls versions matching "~> 4.4"...
- Finding hashicorp/aws versions matching "6.68.0"...
- Installing hashicorp/tls v4.4.2 to the shared cache directory...
- Installing hashicorp/aws v6.68.0 to the shared cache directory...
- Installed hashicorp/tls v4.4.2 (signed, key ID 0C0AF313E5FD9F80)
- Using hashicorp/tls v4.4.2 from the shared cache directory
- Installed hashicorp/aws v6.68.0 (signed, key ID 0C0AF313E5FD9F80)
- Using hashicorp/aws v6.68.0 from the shared cache directory

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.

OpenTofu has been successfully initialized!

You may now begin working with OpenTofu. Try running "tofu plan" to see
any changes that are required for your infrastructure. All OpenTofu commands
should now work.

If you ever set or change modules or backend configuration for OpenTofu,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
Acquiring state lock. This may take a few moments...
data.tls_certificate.github: Reading...
data.tls_certificate.github: Read complete after 0s [id=6bcf7b7f2005c947073a003ff3b596f7fcc8066f]
data.aws_caller_identity.current: Reading...
aws_iam_openid_connect_provider.github[0]: Refreshing state... [id=arn:aws:iam::559744160976:oidc-provider/token.actions.githubusercontent.com]
data.aws_caller_identity.current: Read complete after 0s [id=559744160976]
aws_iam_policy.terragrunt_state_lock: Refreshing state... [id=arn:aws:iam::559744160976:policy/github-oidc-auth-master-terragrunt-state-lock]
aws_iam_role.plan: Refreshing state... [id=github-oidc-auth-master-github-actions-plan-role]
aws_iam_role.apply: Refreshing state... [id=github-oidc-auth-master-github-actions-apply-role]
aws_iam_role.bedrock[0]: Refreshing state... [id=github-oidc-auth-master-github-actions-bedrock-role]
aws_iam_role_policy_attachment.plan_read_only: Refreshing state... [id=github-oidc-auth-master-github-actions-plan-role/arn:aws:iam::aws:policy/ReadOnlyAccess]
aws_iam_role_policy_attachment.plan_state_lock: Refreshing state... [id=github-oidc-auth-master-github-actions-plan-role/arn:aws:iam::559744160976:policy/github-oidc-auth-master-terragrunt-state-lock]
aws_iam_role_policy_attachment.apply_administrator_access: Refreshing state... [id=github-oidc-auth-master-github-actions-apply-role/arn:aws:iam::aws:policy/AdministratorAccess]
aws_iam_role_policy.bedrock_invoke[0]: Refreshing state... [id=github-oidc-auth-master-github-actions-bedrock-role:bedrock-invoke]

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

allowed_environments = tolist([
  "master",
])
apply_role_arn = "arn:aws:iam::559744160976:role/github-oidc-auth-master-github-actions-apply-role"
apply_role_name = "github-oidc-auth-master-github-actions-apply-role"
bedrock_role_arn = "arn:aws:iam::559744160976:role/github-oidc-auth-master-github-actions-bedrock-role"
github_org = "panicboat"
github_repos = tolist([
  "monorepo",
  "platform",
])
oidc_provider_arn = "arn:aws:iam::559744160976:oidc-provider/token.actions.githubusercontent.com"
oidc_provider_url = "https://token.actions.githubusercontent.com"
plan_role_arn = "arn:aws:iam::559744160976:role/github-oidc-auth-master-github-actions-plan-role"
plan_role_name = "github-oidc-auth-master-github-actions-plan-role"

@panicboat panicboat mentioned this pull request Oct 24, 2026
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

deploy:alb Auto-generated deployment label deploy:eks Auto-generated deployment label deploy:eks-holmesgpt Auto-generated deployment label deploy:eks-karpenter Auto-generated deployment label deploy:eks-logs Auto-generated deployment label deploy:eks-metrics Auto-generated deployment label deploy:eks-secrets Auto-generated deployment label deploy:eks-traces Auto-generated deployment label deploy:github-oidc-auth Auto-generated deployment label deploy:iam-service-linked-roles Auto-generated deployment label deploy:secrets-manager Auto-generated deployment label deploy:vpc Auto-generated deployment label

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@panicboat