Skip to content

Terraform PR CI

Auto-generated by scripts/generate_docs.py — edit the workflow YAML, not this file.

File: .github/workflows/terraform-ci.yml

Description

Workflow: terraform-ci.yml — Terraform PR CI Gate

Triggered on every pull request that modifies .tf or .tfvars files.

Purpose: catch Terraform validation errors and surface AI-powered triage

reports as PR comments before any code merges to main.

Pipeline:

  1. detect-changes — identifies which module directories changed
  2. terraform-plan — fan-out matrix: validate + plan each changed module
  3. AI Triage — analyses plan output and posts a structured PR comment

Triggers

Trigger types: pull_request

Pull Request Trigger

Paths: **.tf**,.tfvars, .github/workflows/terraform-ci.yml, .github/workflows/terraform-run-and-collect.sh, .github/workflows/copilot-triage.sh

Permissions

  • id-token: write
  • contents: read
  • pull-requests: write

Jobs

detect-changes — Detect Changed Modules

Property Value
Runs on ubuntu-latest

Outputs:

  • matrix — ${{ steps.set-matrix.outputs.matrix }}
  • is_mubadala — ${{ steps.check-mubadala.outputs.is_mubadala }}

Steps:

| Step | Action / Detail

---|---|---
1 | Checkout repository | actions/checkout@v4
2 | Get changed files | ./.github/actions/changed-files
3 | Check for Mubadala changes | Inline script: is_mubadala=false
4 | Determine Changed Modules | Inline script: changed_modules=()

flexible-vmss-disk-guard — Guard | No hardcoded /dev/sdX in IaC

Property Value
Runs on ubuntu-latest

Steps:

| Step | Action / Detail

---|---|---
1 | Checkout | actions/checkout@v4
2 | Reject hardcoded /dev/sdX as Rhapsody data-disk path | Inline script: MATCHES=$(grep -rnE '"/dev/sd[a-z]"\ | =/dev/sd[a-z]\b' \\

terraform-plan — Plan | ${{ matrix.module }}

Property Value
Runs on ubuntu-latest
Depends on detect-changes

Condition: needs.detect-changes.outputs.matrix != '[]'

Strategy:

  • fail-fast: False
  • include: 52 entries

Steps:

| Step | Action / Detail

---|---|---
1 | Checkout | actions/checkout@v4
2 | Set up Terraform | hashicorp/setup-terraform@v3
3 | Install tflint | Inline script: curl -sL https://raw.githubusercontent.com/terraform-linters/tflint/master/insta…
4 | Install jq | Inline script: sudo apt-get update && sudo apt-get install -y jq
5 | Set up Node (for Copilot CLI) (conditional) | actions/setup-node@v4
6 | Install & configure Copilot CLI (conditional) | Inline script: npm install -g @github/copilot
7 | Authenticate Copilot CLI (conditional) | Inline script: if [ -z "${COPILOT_PAT_KEY:-}" ]; then
8 | Set Environment Variables | Inline script: if [[ "$IS_MUBADALA" == "true" ]]; then
9 | Run Terraform and collect logs | Inline script: bash .github/workflows/terraform-run-and-collect.sh
10 | AI Triage (conditional) | Inline script: bash .github/workflows/copilot-triage.sh
11 | Post Triage Report as PR Comment (conditional) | Inline script: {
12 | Check Terraform execution status (conditional) | Inline script: echo "::error::Terraform plan or static analysis failed for module ${MODULE_NAME…
13 | Cleanup gh/copilot auth (conditional) | Inline script: gh auth logout -h github.com \ | \ | true

Secrets Referenced

  • COPILOT_PAT_KEY
  • GEMINI_API_KEY
  • OPENAI_API_KEY

Composite Actions Used

_📋Auto-Generated Documentation | Team: Azure Infrastructure | Generated by: AI Documentation Engine | Date: 2026-08-14 22:10 UTC _