wip: feat: add resolve-stack-config and integrate with terraform-deploy - #262
Draft
stekern wants to merge 5 commits into
Draft
wip: feat: add resolve-stack-config and integrate with terraform-deploy#262stekern wants to merge 5 commits into
stekern wants to merge 5 commits into
Conversation
Introduces a new composite action `resolve-stack-config` that takes a JSON
array of `{pattern, envVars}` blocks plus a stack-dir, and emits a sourceable
env file when a pattern matches. `terraform-deploy` gains a `stack-config`
input and sources the resulting file before `terraform apply`, letting
callers inject provider-specific env vars (e.g., `TF_VAR_*`) on a per-stack
basis without provider-specific code in the action.
CI:
- Unit tests for resolve-stack-config (matching, schema validation,
shell-injection round-trip, file permissions, forward-compat).
- E2E through terraform-deploy: deploys two stacks, asserts that a
matching pattern injects a TF_VAR that reaches the Terraform output,
and that a non-matching pattern leaves the variable's default in place.
terraform-deploy currently references resolve-stack-config via a local path
so the integration can be tested in this repo's CI. Before tagging a release
the path must be swapped for a SHA-pinned URL — see TODO in
terraform-deploy/action.yml.
stekern
changed the title
stekern
marked this pull request as draft
May 15, 2026 13:45
…flow - Add resolve-stack-config to release-please-config.json packages - Add resolve-stack-config to .release-please-manifest.json at 0.0.0 (next feat commit will bump it to 0.1.0) - Add resolve-stack-config/* to the release workflow's path filter so changes to this action trigger a release-please run Mirrors the enrollment used for evaluate-automerge in 6732049 + e58cc1c.
…tern
`PurePosixPath.full_match("X/**")` requires at least one path segment
after `**`, so a flat stack-dir like `stack-match` did not match the
pattern `stack-match/**`. Switch to nested layout (`stacks/dev/app-match`)
which matches `stacks/dev/**`, mirroring realistic stack layouts where
stacks always live below `<env>/`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Do not merge as-is. Before merging, the
terraform-deploychanges need to be removed from this PR — see "Planned rollout" below.Summary
resolve-stack-config— takes a JSON array of{ pattern, envVars }blocks plus astack-dir, and emits a sourceable env file when a pattern matches. First-match-wins. Empty / non-matching input is a fast no-op (the resolve step is skipped, no Python runs, no file is created).evaluate-automergein feat: add evaluate-automerge composite action #215 + 6732049.The PR currently also touches
terraform-deployand adds an integration e2e job, but those changes are slated to be split out (see below).Planned rollout
terraform-deploychanges (terraform-deploy/action.ymlmodifications, thetest-e2e-terraform-deploy-stack-configCI job, and any related commits) from this PR.resolve-stack-config. Merge that to produce the firstresolve-stack-config-vX.Y.Ztag and SHA.terraform-deployto take astack-configinput and referencesoslokommune/composite-actions/resolve-stack-config@<sha>with the tag SHA. Adds the integration e2e job at that point.This avoids landing
terraform-deploywith a temporary local-path reference, and keeps the audit trail clean (one PR per enrolled action, one PR perterraform-deploychange).Test plan
test-resolve-stack-configjob passes (unit tests).terraform-deploychanges are removed.