fix(ci): secure Terraform backend configuration and workflow permissions#253
fix(ci): secure Terraform backend configuration and workflow permissions#253
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Caution Review failedThe pull request is closed. 📝 WalkthroughWalkthroughMakes GCP_PROJECT_ID a required workflow input, adds a pre-auth step that generates a GCS Terraform backend.tf using that project ID, grants id-token: write permission to three deploy jobs, updates the stored production backend.tf placeholder, and refreshes short-term insights in docs. Changes
Sequence Diagram(s)mermaid GH->>Repo: checkout Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
|
View your CI Pipeline Execution ↗ for commit c973175
☁️ Nx Cloud last updated this comment at |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/teams-kernel-workflows-deploy-team.yml:
- Around line 94-108: The workflow step "Generate Terraform Backend
Configuration" writes backend.tf using the GCP_PROJECT_ID secret but doesn't
validate it; add a guard that checks the environment variable GCP_PROJECT_ID
before creating backend.tf and fail fast with a clear error and non-zero exit if
it's empty (or alternatively mark GCP_PROJECT_ID as required in the
workflow_call inputs); ensure the check references the same env var name
(GCP_PROJECT_ID) and that the error message names the failing step ("Generate
Terraform Backend Configuration") and the target file (backend.tf).
🧹 Nitpick comments (1)
teams/kernel/iac/production/backend.tf (1)
3-5: Add a short placeholder notice to reduce local confusion.
Line 3-Line 5 now uses a placeholder bucket; consider a brief note that CI overwrites this file during deploys.✍️ Suggested clarification
terraform { backend "gcs" { # The Google Cloud Storage backend + # NOTE: Placeholder only — CI generates the real backend.tf during deploy. bucket = "project-id-placeholder-tfstate" # The name of the bucket to store the state file prefix = "production" # The path to the state file within the bucket
|
1 participant
What and why was modified?
id-token: writeto reusable workflow callersSecurity improvements:
How was it modified?
GitHub Actions Workflow Updates
id-token: writepermission todeploy-kernel,deploy-people, anddeploy-thingsjobsTerraform Backend Configuration
teams/kernel/iac/bootstrap/project-setup.shto.github/workflows/teams-kernel-workflows-deploy-team.ymlterraform initGit Configuration
backend.tfto.gitignorealongside other Terraform-generated files (tfplan, tfstate, etc.)Reference links and evaluation steps
Review updated workflows in
.github/workflows/:teams-kernel-workflows-deploy.yml- Added permissions to deployment jobsteams-kernel-workflows-deploy-team.yml- Added backend.tf generation stepVerify bootstrap script cleanup:
teams/kernel/iac/bootstrap/project-setup.sh- Backend generation removedTest the deployment workflow:
Experiment Record
Next step
Consider extending this pattern to other environment configurations (e.g., people team, things team backend setups) to ensure consistent security practices across all team deployments.
Summary by CodeRabbit