Releases: suzuki-shunsuke/tfcmt
v4.9.1
Pull Requests | Issues | v4.9.0...v4.9.1
Fix
#1187 #1257 #1258 Exit commands with non zero exit code if any error such as API rate limit happens
This update changes the exit code of tfcmt when an error happens.
The exit code was same with the exit code of terraform plan
and terraform apply
.
This means tfcmt might have exited with zero even if tfcmt failed to post a comment due to some reason such as API rate limit.
This was not a bug but a expected behavior.
But this behaviour was dangerous because people might have missed unexpected changes.
So this update changes the behaviour as tfcmt exits with non zero if any error such as API rate limit happens.
v4.9.0
Pull Requests | Issues | v4.8.0...v4.9.0
Features
#1083 #1115 Support masking sensitive data
You can mask sensitive data in outputs of terraform.
This feature prevents the leak of sensitive data.
The following outputs are masked.
- Standard output of terraform command
- Standard error output of terraform command
- Pull request comment of
tfcmt plan
andtfcmt apply
- local files created by
--output
option
Caution
Even if you maske secrets using this feature, secrets are still stored in Terraform States.
Please see also Sensitive Data in State.
You can use environment variables TFCMT_MASKS
and TFCMT_MASKS_SEPARATOR
.
TFCMT_MASKS
: A list of masks. Masks are joined byTFCMT_MASKS_SEPARATOR
TFCMT_MASKS_SEPARATOR
: A separator of masks. The default value is,
The format of each mask is ${type}:${value}
.
${type}
must be either env
or regexp
.
If ${type}
is env
, ${value}
is a masked environment variable name.
If ${type}
is regexp
, ${value}
is a masked regular expression.
e.g. Mask GitHub access tokens and the environment variable DATADOG_API_KEY
.
export TFCMT_MASKS='env:GITHUB_TOKEN,env:DATADOG_API_KEY,regexp:ghp_[^ ]+'
tfcmt plan -- terraform plan
e.g. Change the separator to /
.
export TFCMT_MASKS_SEPARATOR=/
export TFCMT_MASKS='env:GITHUB_TOKEN/env:DATADOG_API_KEY/regexp:ghp_[^ ]+'
All matching strings are replaced with ***
.
Replacements are done in order of TFCMT_MASKS
, so the result depends on the order of TFCMT_MASKS
.
For example, if TFCMT_MASKS
is regexp:foo,regexp:foo.*
, regexp:foo.*
has no meaning because all foo
are replaced with ***
before replacing foo.*
with ***
so foo.*
doesn't match with anything.
Example
This example creates a resource google_cloudbuild_trigger.
This resource has a GitHub Access token as a field substitutions._GH_TOKEN
.
main.tf
resource "google_cloudbuild_trigger" "filename_trigger" {
location = "us-central1"
trigger_template {
branch_name = "main"
repo_name = "my-repo"
}
substitutions = {
_GH_TOKEN = var.gh_token # Secret
}
filename = "cloudbuild.yaml"
}
variable "gh_token" {
type = string
description = "GitHub Access token"
}
terraform {
required_providers {
google = {
source = "hashicorp/google"
version = "5.13.0"
}
}
}
If you run terraform plan
without masking, the secret would be leaked.
To prevent the leak, let's mask the secret.
export TFCMT_MASKS=env:TF_VAR_gh_token # Mask the environment variable TF_VAR_gh_token
Please see _GH_TOKEN
in the output of tfcmt plan
and the pull request comment.
You can confirm _GH_TOKEN
is masked as ***
properly.
$ tfcmt plan -- terraform plan
tfcmt plan -- terraform plan
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# google_cloudbuild_trigger.filename_trigger will be created
+ resource "google_cloudbuild_trigger" "filename_trigger" {
+ create_time = (known after apply)
+ filename = "cloudbuild.yaml"
+ id = (known after apply)
+ location = "us-central1"
+ name = (known after apply)
+ project = "hello"
+ substitutions = {
+ "_GH_TOKEN" = "***"
}
+ trigger_id = (known after apply)
+ trigger_template {
+ branch_name = "main"
+ project_id = (known after apply)
+ repo_name = "my-repo"
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
Terraform sensitive input variables and outputs and sensitive function
Terraform itself has features to prevent sensitive data from being leaked.
- https://developer.hashicorp.com/terraform/tutorials/configuration-language/sensitive-variables
- https://developer.hashicorp.com/terraform/language/functions/sensitive
- https://developer.hashicorp.com/terraform/language/values/outputs#sensitive-suppressing-values-in-cli-output
- https://developer.hashicorp.com/terraform/language/values/variables#suppressing-values-in-cli-output
- https://www.hashicorp.com/blog/terraform-0-14-adds-the-ability-to-redact-sensitive-values-in-console-output
- https://www.hashicorp.com/blog/announcing-hashicorp-terraform-0-15-general-availability
So first you should use these features.
But even if these features are available, it still makes sense for tfcmt to mask sensitive data.
Please imagine the situation that platform engineers manage Terraform workflows and product teams manage Terraform codes in a Monorepo.
Then platform engineers need to prevent sensitive data from being leaked, but if product teams forget to protect them with sensitive
flags, sensitive data would be leaked.
By protecting sensitive data using tfcmt, platform engineers can prevent sensitive data from being leaked while delegating the management of Terraform codes to product teams.
tfcmt's masking feature works as a guardrail.
v4.9.0-2
Changes from v4.9.0-1
56dfca4 fix(mask): Change the default separator from ;
to ,
Features
#1083 #1115 support masking secrets
You can mask secrets in outputs of terraform.
This feature prevents the leak of secrets.
The following outputs are masked.
- Standard output of terraform command
- Standard error output of terraform command
- Pull request comment of
tfcmt plan
andtfcmt apply
- local files created by
--output
option
Caution
Even if you maske secrets using this feature, secrets are still stored in Terraform States.
Please see also Sensitive Data in State.
You can use environment variables TFCMT_MASKS
and TFCMT_MASKS_SEPARATOR
.
TFCMT_MASKS
: A list of masks. Masks are joined byTFCMT_MASKS_SEPARATOR
TFCMT_MASKS_SEPARATOR
: A separator of masks. The default value is,
The format of each mask is ${type}:${value}
.
${type}
must be either env
or regexp
.
If ${type}
is env
, ${value}
is a masked environment variable name.
If ${type}
is regexp
, ${value}
is a masked regular expression.
e.g. Mask GitHub access tokens and the environment variable DATADOG_API_KEY
.
export TFCMT_MASKS="env:GITHUB_TOKEN,env:DATADOG_API_KEY,regexp:ghp_[^ ]+"
tfcmt plan -- terraform plan
e.g. Change the separator to /
.
export TFCMT_MASKS_SEPARATOR=/
export TFCMT_MASKS="env:GITHUB_TOKEN/env:DATADOG_API_KEY/regexp:ghp_[^ ]+"
All matching strings are replaced with ***
.
Replacements are done in order of TFCMT_MASKS
, so the result depends on the order of TFCMT_MASKS
.
For example, if TFCMT_MASKS
is regexp:foo,regexp:foo.*
, regexp:foo.*
has no meaning because all foo
are replaced with ***
before replacing foo.*
with ***
so foo.*
doesn't match with anything.
Example
This example creates a resource google_cloudbuild_trigger.
This resource has a GitHub Access token as a field substitutions._GH_TOKEN
.
main.tf
resource "google_cloudbuild_trigger" "filename_trigger" {
location = "us-central1"
trigger_template {
branch_name = "main"
repo_name = "my-repo"
}
substitutions = {
_GH_TOKEN = var.gh_token # Secret
}
filename = "cloudbuild.yaml"
}
variable "gh_token" {
type = string
description = "GitHub Access token"
}
terraform {
required_providers {
google = {
source = "hashicorp/google"
version = "5.13.0"
}
}
}
If you run terraform plan
without masking, the secret would be leaked.
To prevent the leak, let's mask the secret.
export TFCMT_MASKS=env:TF_VAR_gh_token # Mask the environment variable TF_VAR_gh_token
Please see _GH_TOKEN
in the output of tfcmt plan
and the pull request comment.
You can confirm _GH_TOKEN
is masked as ***
properly.
$ tfcmt plan -- terraform plan
tfcmt plan -- terraform plan
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# google_cloudbuild_trigger.filename_trigger will be created
+ resource "google_cloudbuild_trigger" "filename_trigger" {
+ create_time = (known after apply)
+ filename = "cloudbuild.yaml"
+ id = (known after apply)
+ location = "us-central1"
+ name = (known after apply)
+ project = "hello"
+ substitutions = {
+ "_GH_TOKEN" = "***"
}
+ trigger_id = (known after apply)
+ trigger_template {
+ branch_name = "main"
+ project_id = (known after apply)
+ repo_name = "my-repo"
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
v4.9.0-1
Features
#1083 #1115 support masking secrets
You can mask secrets in outputs of terraform.
This feature prevents the leak of secrets.
The following outputs are masked.
- Standard output of terraform command
- Standard error output of terraform command
- Pull request comment of
tfcmt plan
andtfcmt apply
- local files created by
--output
option
Caution
Even if you maske secrets using this feature, secrets are still stored in Terraform States.
Please see also Sensitive Data in State.
You can use environment variables TFCMT_MASKS
and TFCMT_MASKS_SEPARATOR
.
TFCMT_MASKS
: A list of masks. Masks are joined byTFCMT_MASKS_SEPARATOR
TFCMT_MASKS_SEPARATOR
: A separator of masks. The default value is;
The format of each mask is ${type}:${value}
.
${type}
must be either env
or regexp
.
If ${type}
is env
, ${value}
is a masked environment variable name.
If ${type}
is regexp
, ${value}
is a masked regular expression.
e.g. Mask GitHub access tokens and the environment variable DATADOG_API_KEY
.
export TFCMT_MASKS="env:GITHUB_TOKEN;env:DATADOG_API_KEY;regexp:ghp_[^ ]+"
tfcmt plan -- terraform plan
e.g. Change the separator to /
.
export TFCMT_MASKS_SEPARATOR=/
export TFCMT_MASKS="env:GITHUB_TOKEN/env:DATADOG_API_KEY/regexp:ghp_[^ ]+"
All matching strings are replaced with ***
.
Replacements are done in order of TFCMT_MASKS
, so the result depends on the order of TFCMT_MASKS
.
For example, if TFCMT_MASKS
is regexp:foo;regexp:foo.*
, regexp:foo.*
has no meaning because all foo
are replaced with ***
before replacing foo.*
with ***
so foo.*
doesn't match with anything.
Example
This example creates a resource google_cloudbuild_trigger.
This resource has a GitHub Access token as a field substitutions._GH_TOKEN
.
main.tf
resource "google_cloudbuild_trigger" "filename_trigger" {
location = "us-central1"
trigger_template {
branch_name = "main"
repo_name = "my-repo"
}
substitutions = {
_GH_TOKEN = var.gh_token # Secret
}
filename = "cloudbuild.yaml"
}
variable "gh_token" {
type = string
description = "GitHub Access token"
}
terraform {
required_providers {
google = {
source = "hashicorp/google"
version = "5.13.0"
}
}
}
If you run terraform plan
without masking, the secret would be leaked.
To prevent the leak, let's mask the secret.
export TFCMT_MASKS=env:TF_VAR_gh_token # Mask the environment variable TF_VAR_gh_token
Please see _GH_TOKEN
in the output of tfcmt plan
and the pull request comment.
You can confirm _GH_TOKEN
is masked as ***
properly.
$ tfcmt plan -- terraform plan
tfcmt plan -- terraform plan
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# google_cloudbuild_trigger.filename_trigger will be created
+ resource "google_cloudbuild_trigger" "filename_trigger" {
+ create_time = (known after apply)
+ filename = "cloudbuild.yaml"
+ id = (known after apply)
+ location = "us-central1"
+ name = (known after apply)
+ project = "hello"
+ substitutions = {
+ "_GH_TOKEN" = "***"
}
+ trigger_id = (known after apply)
+ trigger_template {
+ branch_name = "main"
+ project_id = (known after apply)
+ repo_name = "my-repo"
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
v4.8.0
Pull Requests | Issues | v4.7.3...v4.8.0
Features
#1090 #1091 Support passing GitHub Access token via the environment variable TFCMT_GITHUB_TOKEN
In addition to the environment variable GITHUB_TOKEN
, tfcmt supports the environment variable TFCMT_GITHUB_TOKEN
too.
v4.8.0-1
v4.7.3
Pull Requests | Issues | v4.7.2...v4.7.3
Bug Fixes
#1073 Fix a bug code blocks are broken if "```" are used in the command output @jemiam
When triple backticks are in results for terraform command, wrapCode method uses HTML tags(pre + code) to escape it.
But currently these tags are also escaped so it doesn't work as intended.
New Contributor 🎉
Thank you for your contirbution!
v4.7.2
Pull Requests | Issues | v4.7.1...v4.7.2
Fixes
#1061 #1062 Change the default template to fix the issue that emojis aren't rendered
Recently, some emojis in tfcmt's comments aren't rendered properly.
We guess this is a bug of GitHub itself.
- https://github.com/orgs/community/discussions/77605
- https://github.com/orgs/community/discussions/77606
We found the bug doesn't occur if we remove emojis from the end of lines.
Before
### :warning: Resource Deletion will happen :warning:
After
### :warning: Resource Deletion will happen
Until the bug will be fixed, we'll remove emojis from the end of lines.
Others
Update dependencies
#1058 chore(deps): update dependency golang/go to v1.21.5
v4.7.1
Pull Requests | Issues | v4.7.0...v4.7.1
Others
#959 chore(deps): update dependency golang/go to v1.21.3
#960 fix(deps): update module github.com/google/go-cmp to v0.6.0
v4.7.0
Pull Requests | Issues | v4.6.1...v4.7.0
We roughly checked if tfcmt worked with OpenTofu, then we fixed some issues that tfcmt didn't work with OpenTofu.
We tested tfcmt with OpenTofu v1.6.0-alpha2.
tfcmt seems to work with OpenTofu.
You can simply replace Terraform CLI with OpenTofu CLI.
$ tfcmt plan -- tofu plan
$ tfcmt apply -- tofu apply
But we didn't check deeply. We just checked roughly.
And we don't promise OpenTofu Support for now.
We primary support Terraform.