Upstream merge

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github:
+  - dflook

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,4 @@
+contact_links:
+  - name: Question
+    url: https://github.com/dflook/terraform-github-actions/discussions
+    about: Please ask questions as a new discussion if others would benefit from seeing the answer

.github/ISSUE_TEMPLATE/problem.yml

@@ -0,0 +1,44 @@
+name: Problem
+description: I'm having a problem using these actions
+labels:
+  - problem
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before creating an issue, enable debug logging by setting the `ACTIONS_STEP_DEBUG` secret to `true` and run the job again.
+  - type: textarea
+    id: description
+    attributes:
+      description: What is not working? What do you think should be happening instead?
+      label: Problem description
+    validations:
+      required: true
+
+  - type: input
+    id: terraform-version
+    attributes:
+      label: Terraform version
+      description: What terraform version are you using?
+      placeholder: 1.0.5
+
+  - type: input
+    id: backend
+    attributes:
+      label: Backend
+      description: What terraform backend are you using?
+      placeholder: s3
+
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Workflow YAML
+      description: Please copy and paste the relevant workflow yaml. This will be automatically formatted, so no need for backticks.
+      render: yaml
+
+  - type: textarea
+    id: workflow-logs
+    attributes:
+      label: Workflow log
+      description: Please copy and paste the relevant workflow log output. If this is long consider putting in a [gist](https://gist.github.com/). This will be automatically formatted, so no need for backticks.
+      render: shell

.github/ISSUE_TEMPLATE/suggestion.yml

@@ -0,0 +1,11 @@
+name: Suggestion
+description: I have a suggestion for an enhancement
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: suggestion
+    attributes:
+      label: Suggestion
+    validations:
+      required: true

.github/github_sucks.md

@@ -1,3 +1,4 @@
 Everytime I need to generate a push or synchronise event I will touch this file.
 This is usually because GitHub Actions has broken in some way.
 
+

.github/labels.yml

@@ -0,0 +1,30 @@
+- name: defect
+  color: d73a4a
+  description: Something isn't working
+
+- name: documentation
+  color: 0075ca
+  description: Improvements or additions to documentation
+
+- name: duplicate
+  color: cfd3d7
+  description: This issue or pull request already exists
+
+- name: enhancement
+  color: a2eeef
+  description: New feature or request
+
+- name: invalid
+  color: e4e669
+  description: This doesn't seem right
+
+- name: problem
+  color: BFD4F2
+
+- name: question
+  color: d876e3
+  description: Further information is requested
+
+- name: wontfix
+  color: ffffff
+  description: This will not be worked on

.github/release_template.md

@@ -1,6 +1,6 @@
 This is one of a suite of terraform related actions - find them at [dflook/terraform-github-actions](https://github.com/dflook/terraform-github-actions).
 
-You can see the changes for this release in the [CHANGELOG](https://github.com/dflook/terraform-github-actions/blob/master/CHANGELOG.md)
+You can see the changes for this release in the [CHANGELOG](https://github.com/dflook/terraform-github-actions/blob/main/CHANGELOG.md)
 
 You can specify the action version as:
 

.github/workflows/base-image.yaml

@@ -3,9 +3,12 @@ name: Update base image
 on:
   push:
     branches:
-      - master
+      - main
     paths:
       - image/Dockerfile-base
+      - .github/workflows/base-image.yaml
+  schedule:
+    - cron: 0 1 * * 1
 
 jobs:
   push_image:
@@ -24,9 +27,23 @@ jobs:
 
       - name: Base image
         run: |
-          docker build --tag dflook/terraform-github-actions-base -f image/Dockerfile-base image
+          docker pull --quiet debian:bullseye-slim
+          BASE_DIGEST="$(docker image inspect --format="{{index .RepoDigests 0}}" "debian:bullseye-slim" | sed 's/.*@//')"
+
+          docker build --tag dflook/terraform-github-actions-base -f image/Dockerfile-base \
+            --label org.opencontainers.image.created="$(date '+%Y-%m-%dT%H:%M:%S%z')" \
+            --label org.opencontainers.image.source="https://github.com/${{ github.repository }}" \
+            --label org.opencontainers.image.revision="${{ github.sha }}" \
+            --label org.opencontainers.image.base.name="docker.io/library/debian:bullseye-slim" \
+            --label org.opencontainers.image.base.digest="$BASE_DIGEST" \
+            --label build="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            image
 
           docker tag dflook/terraform-github-actions-base danielflook/terraform-github-actions-base:latest
-          docker push danielflook/terraform-github-actions-base:latest
+          docker push --quiet danielflook/terraform-github-actions-base:latest
+
+          IMAGE_DIGEST="$(docker image inspect --format="{{index .RepoDigests 0}}" "danielflook/terraform-github-actions-base:latest" | sed 's/.*@//')"
+          echo "::set-output name=digest::$IMAGE_DIGEST"
+
           docker tag dflook/terraform-github-actions-base danielflook/terraform-github-actions-base:$GITHUB_RUN_ID
-          docker push danielflook/terraform-github-actions-base:$GITHUB_RUN_ID
+          docker push --quiet danielflook/terraform-github-actions-base:$GITHUB_RUN_ID

.github/workflows/labels.yaml

@@ -0,0 +1,20 @@
+name: Update labels
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - .github/labels.yml
+
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Run Labeler
+        uses: crazy-max/ghaction-github-labeler@52525cb66833763f651fc34e244e4f73b6e07ff5
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pull_request_review.yaml

@@ -0,0 +1,34 @@
+name: pull_request_review test
+
+on:
+  - pull_request_review
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    name: Apply approved changes on pull_request_review
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Plan
+        uses: ./terraform-plan
+        with:
+          label: pull_request_review
+          path: tests/workflows/pull_request_review
+
+      - name: Apply
+        uses: ./terraform-apply
+        id: output
+        with:
+          label: pull_request_review
+          path: tests/workflows/pull_request_review
+
+      - name: Verify outputs
+        run: |
+          if [[ "${{ steps.output.outputs.output_string }}" != "the_string" ]]; then
+            echo "::error:: output s not set correctly"
+            exit 1
+          fi

.github/workflows/pull_request_review_trigger.yaml

@@ -0,0 +1,27 @@
+name: Trigger pull_request_review
+
+on:
+  - pull_request
+
+jobs:
+  required_version:
+    runs-on: ubuntu-latest
+    name: pull_request_review
+    steps:
+      - name: Trigger pull_request_review event
+        run: |
+          cat >review.json <<EOF
+          {
+            "body": "Triggering pull_request_review event...",
+            "event": "COMMENT"
+          }
+          EOF
+
+          curl \
+            --request POST \
+            -H "Authorization: token ${{ secrets.REVIEW_GITHUB_TOKEN }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "User-Agent: terraform-github-actions" \
+            -H "Content-Type: application/json" \
+            --data-binary @review.json \
+            ${{ github.event.pull_request.url }}/reviews

.github/workflows/pull_request_target.yaml

@@ -0,0 +1,34 @@
+name: pull_request_target test
+
+on:
+  - pull_request_target
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    name: Apply approved changes on pull_request_target
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Plan
+        uses: ./terraform-plan
+        with:
+          label: pull_request_target
+          path: tests/workflows/pull_request_target
+
+      - name: Apply
+        uses: ./terraform-apply
+        id: output
+        with:
+          label: pull_request_target
+          path: tests/workflows/pull_request_target
+
+      - name: Verify outputs
+        run: |
+          if [[ "${{ steps.output.outputs.output_string }}" != "the_string" ]]; then
+            echo "::error:: output s not set correctly"
+            exit 1
+          fi

.github/workflows/release.yaml

@@ -2,85 +2,78 @@ name: Release
 
 on:
   release:
-    types: [released]
+    types:
+      - released
 
 jobs:
   image:
     runs-on: ubuntu-latest
-    name: Publish Docker Image
+    name: Release Actions
     env:
-      GITHUB_TOKEN: ${{ github.token }}
-      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
     steps:
       - name: Checkout
         uses: actions/checkout@v2
 
       - name: Registry login
+        env:
+          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
         run: |
-          echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u dflook --password-stdin
+          echo $GITHUB_TOKEN | docker login ghcr.io -u dflook --password-stdin
           echo $DOCKER_TOKEN | docker login --username danielflook --password-stdin
 
-      - name: Action image
+      - name: Build action image
+        id: image_build
         run: |
-          docker build --tag dflook/terraform-github-actions-base -f image/Dockerfile-base image
+          RELEASE_TAG="${{ github.event.release.tag_name }}"
 
-          RELEASE_TAG=$(cat $GITHUB_EVENT_PATH | jq -r  '.release.tag_name' $GITHUB_EVENT_PATH)
+          docker pull --quiet danielflook/terraform-github-actions-base:latest
+          BASE_DIGEST="$(docker image inspect --format="{{index .RepoDigests 0}}" "danielflook/terraform-github-actions-base:latest" | sed 's/.*@//')"
 
           docker build --tag dflook/terraform-github-actions \
             --label org.opencontainers.image.created="$(date '+%Y-%m-%dT%H:%M:%S%z')" \
-            --label org.opencontainers.image.source="github.com/${{ github.repository }}.git" \
+            --label org.opencontainers.image.source="https://github.com/${{ github.repository }}" \
             --label org.opencontainers.image.revision="${{ github.sha }}" \
-            --label vcs-ref="$RELEASE_TAG" \
-            --label build="$GITHUB_RUN_ID" \
+            --label org.opencontainers.image.base.name="docker.io/danielflook/terraform-github-actions-base:latest" \
+            --label org.opencontainers.image.base.digest="$BASE_DIGEST" \
+            --label build="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
             image
 
-          docker tag dflook/terraform-github-actions docker.pkg.github.com/dflook/terraform-github-actions/action:$RELEASE_TAG
-          docker push docker.pkg.github.com/dflook/terraform-github-actions/action:$RELEASE_TAG
+          docker tag dflook/terraform-github-actions ghcr.io/dflook/terraform-github-actions:$RELEASE_TAG
+          docker push --quiet ghcr.io/dflook/terraform-github-actions:$RELEASE_TAG
 
           docker tag dflook/terraform-github-actions danielflook/terraform-github-actions:$RELEASE_TAG
-          docker push danielflook/terraform-github-actions:$RELEASE_TAG
+          docker push --quiet danielflook/terraform-github-actions:$RELEASE_TAG
 
-  release_actions:
-    runs-on: ubuntu-latest
-    name: Release Actions
-    env:
-      GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
-      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-    needs: image
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
+          echo "::set-output name=digest::$(docker image inspect --format="{{index .RepoDigests 0}}" "danielflook/terraform-github-actions:$RELEASE_TAG")"
 
-      - name: Action image
+      - name: Release actions
         run: |
-          export RELEASE_TAG=$(cat $GITHUB_EVENT_PATH | jq -r  '.release.tag_name' $GITHUB_EVENT_PATH)
+          export RELEASE_TAG="${{ github.event.release.tag_name }}"
+          export major=`echo $RELEASE_TAG | cut -d. -f1`
+          export minor=`echo $RELEASE_TAG | cut -d. -f2`
 
           git config --global user.name "Daniel Flook"
           git config --global user.email "daniel@flook.org"
 
-          for action in $(find . -name action.yaml -printf "%h\n" | sed 's/^.\///'); do
+          for action in $(cd $GITHUB_WORKSPACE && find . -name action.yaml -printf "%h\n" | sed 's/^.\///'); do
 
             if git clone https://dflook:$GITHUB_TOKEN@github.com/dflook/$action.git "$HOME/$action"; then
               echo "Releasing dflook/$action@$RELEASE_TAG"
 
-              rsync -r $action/ $HOME/$action
-
-              sed -i "s|../image/Dockerfile|docker://danielflook/terraform-github-actions:$RELEASE_TAG|" $HOME/$action/action.yaml
+              rsync -r $GITHUB_WORKSPACE/$action/ $HOME/$action
 
-              export major=`echo $RELEASE_TAG | cut -d. -f1`
-              export minor=`echo $RELEASE_TAG | cut -d. -f2`
+              sed -i "s|../image/Dockerfile|docker://${{ steps.image_build.outputs.digest }}|" $HOME/$action/action.yaml
 
-              (cd "$HOME/$action" \
-               && git add -A \
-               && git commit -m "$RELEASE_TAG" \
-               && git tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG" \
-               && git tag --force -a -m"$RELEASE_TAG" "$major" \
-               && git tag --force -a -m"$RELEASE_TAG" "$major.$minor" \
-               && git push --force \
-               && git push --force --tags
-              )
+              git -C "$HOME/$action" add -A
+              git -C "$HOME/$action" commit -m "$RELEASE_TAG"
+              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG"
+              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major"
+              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major.$minor"
+              git -C "$HOME/$action" push --force
+              git -C "$HOME/$action" push --force --tags
 
-              cat .github/release_template.md \
+              cat $GITHUB_WORKSPACE/.github/release_template.md \
                | envsubst \
                | jq --slurp --raw-input --arg RELEASE_TAG "$RELEASE_TAG" '{"tag_name": $RELEASE_TAG, "name": $RELEASE_TAG, "body": . }' \
                | curl -X POST \