You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
CORE-6214: let Terraform Checks fetch private git modules over SSH - #172
CORE-6214 moves OpenSesame/identity-infrastructure onto Repo Checks. Its Terraform roots and terraform/modules/common-config use module sources from the private OpenSesame/devops-terraform-modules repository over SSH. run_terraform_checks 1.0.3 takes no
secrets, so init:terraform can't download them, and the Terraform job would always fail at
Initialize there. A contract exception doesn't help, because CI still runs init.
run_terraform_checks 1.1.0:
takes an optional ORG_READ_ONLY_SSH_KEY secret;
when the secret is set, installs it with configure-github-ssh 1.0.0, which pins GitHub's host
keys, just before Initialize, as run_repo_validation and tf_plan_single_root do;
removes the key and SSH config right after Initialize, even when Initialize fails, so Validate,
tflint and Checkov never run with the org key installed;
skips Initialize and Validate if SSH setup fails, so the Summary shows them as ❌ setup failed;
without the secret, skips the SSH steps and behaves exactly as before.
run_repo_checks 1.1.0 passes the ORG_READ_ONLY_SSH_KEY secret it already declares for Standard
through to the Terraform job.
The READMEs, including the run_terraform_checks Contract section, and both changelogs are updated.
Versioning
Yes
v:wf/run_terraform_checks/1.1.0
v:wf/run_repo_checks/1.1.0
Both are minor bumps: a new optional secret, with no change when it isn't passed.
Dependencies of PR
None. identity-infrastructure's CORE-6214 Repo Checks onboarding needs this released first.
Testing
npm run check passes: actionlint, zizmor, markdownlint, prettier, eslint and 293 tests.
New tests check that SSH is set up only when the secret is set and only before Initialize, that
the cleanup runs between Initialize and Validate/Lint/Scan, and that Repo Checks passes the
secret to the Terraform job.
The version label validator passes locally with both labels.
Not yet run against a real root with private modules; the identity-infrastructure onboarding
PR will do that.
Terraform checks can now access private GitHub modules using an optional read-only SSH key. The temporary SSH configuration is removed after initialization, including if the workflow is cancelled.
Without the key, behavior remains unchanged. If SSH setup fails, initialization and validation are skipped.
Documentation
Updated workflow usage instructions and release notes to describe the optional key and private-module support.
run_terraform_checks took no secrets, so init:terraform couldn't
download module sources from private github.com repositories, such as
[email protected]:OpenSesame/devops-terraform-modules.git//... that
identity-infrastructure uses. Repo Checks' Terraform job would always
fail at Initialize there, and a contract exception doesn't help because
CI still runs init.
run_terraform_checks now takes an optional ORG_READ_ONLY_SSH_KEY. When
it is set, configure-github-ssh 1.0.0 installs it with GitHub's pinned
host keys just before Initialize, as run_repo_validation and
tf_plan_single_root do, and the key and SSH config are removed right
after, so Validate, tflint and Checkov never run with the org key
installed. If SSH setup fails, Initialize and Validate are skipped.
Without the secret the job behaves as before. run_repo_checks passes
the secret it already declares for Standard through to the Terraform
job.
Releases run_terraform_checks 1.1.0 and run_repo_checks 1.1.0, which
calls it from the same commit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
No actionable comments were generated in the recent review.
Walkthrough
The repository checks workflow now forwards an optional SSH key to Terraform checks. Terraform checks configure SSH credentials for initialization when the key is present, then remove them after initialization. Tests and release documentation cover the updated workflow.
Changes: Terraform SSH module access
Layer / File(s)
Summary
Forward the key and manage SSH credentials .github/workflows/run_repo_checks.yml, .github/workflows/run_terraform_checks.yml, .github/workflows/TESTS/*, .github/workflows/READMES/*, .github/workflows/CHANGELOGS/*
The repository workflow passes ORG_READ_ONLY_SSH_KEY to Terraform checks. Terraform checks conditionally configure SSH credentials before initialization and remove them afterward. Tests assert the secret mapping, step order, conditions, and cleanup commands. Documentation and changelogs describe the optional key, its limits, and version 1.1.0.
sequenceDiagram
participant RepoChecks as run_repo_checks
participant TerraformChecks as run_terraform_checks
participant SSHSetup as SSH setup
participant TerraformInit as Terraform initialization
RepoChecks->>TerraformChecks: Pass ORG_READ_ONLY_SSH_KEY
TerraformChecks->>SSHSetup: Configure credentials when key is present
SSHSetup-->>TerraformChecks: Report setup outcome
TerraformChecks->>TerraformInit: Initialize when setup did not fail
TerraformChecks->>SSHSetup: Remove credentials after initialization when setup succeeded
Loading
Possibly related PRs
OpenSesame/core-github-actions#159: This PR updates the workflows and contracts introduced by #159 to support an optional SSH key for private Git modules.
OpenSesame/core-github-actions#160: Both PRs configure SSH credentials from ORG_READ_ONLY_SSH_KEY and remove the configuration after use.
The key is forwarded to Terraform checks and configured for GitHub SSH module access. No merge-blocking issue is established.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the main change: letting Terraform Checks fetch private git modules over SSH. The changeset adds an optional ORG_READ_ONLY_SSH_KEY secret to run_terraform_checks, configures SSH before…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: letting Terraform Checks fetch private git modules over SSH. The changeset adds an optional ORG_READ_ONLY_SSH_KEY secret to run_terraform_checks, configures SSH before Initialize, removes it afterward, and forwards the secret from run_repo_checks. The title also carries the CORE-6214 ticket identifier, which is acceptable for scanning history.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 78a76dfb-be1c-493b-8ba7-43f9b593b408
Commits
Reviewing files that changed from the base of the PR and between c002f3d and 794b399.
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
Jira: https://opensesame.atlassian.net/browse/CORE-6214
Description of Changes
CORE-6214 moves OpenSesame/identity-infrastructure onto Repo Checks. Its Terraform roots and
terraform/modules/common-configuse module sources from the privateOpenSesame/devops-terraform-modulesrepository over SSH.run_terraform_checks1.0.3 takes nosecrets, so
init:terraformcan't download them, and the Terraform job would always fail atInitialize there. A contract exception doesn't help, because CI still runs init.
run_terraform_checks1.1.0:ORG_READ_ONLY_SSH_KEYsecret;configure-github-ssh1.0.0, which pins GitHub's hostkeys, just before Initialize, as
run_repo_validationandtf_plan_single_rootdo;tflint and Checkov never run with the org key installed;
run_repo_checks1.1.0 passes theORG_READ_ONLY_SSH_KEYsecret it already declares for Standardthrough to the Terraform job.
The READMEs, including the
run_terraform_checksContract section, and both changelogs are updated.Versioning
v:wf/run_terraform_checks/1.1.0v:wf/run_repo_checks/1.1.0Both are minor bumps: a new optional secret, with no change when it isn't passed.
Dependencies of PR
None. identity-infrastructure's CORE-6214 Repo Checks onboarding needs this released first.
Testing
npm run checkpasses: actionlint, zizmor, markdownlint, prettier, eslint and 293 tests.the cleanup runs between Initialize and Validate/Lint/Scan, and that Repo Checks passes the
secret to the Terraform job.
PR will do that.
🤖 Generated with Claude Code
Summary by CodeRabbit