From 8bfedb39706e08f44cf1bc60f123e8e2de60b2da Mon Sep 17 00:00:00 2001
From: Carlos Cobo <carlos@remotely.works>
Date: Mon, 14 Apr 2025 14:01:06 +0200
Subject: [PATCH] add ASCODE_PROVIDER_FORCE_LOCAL env var escape hatch to
 tf.provider

---
 .github/workflows/docker.yml | 48 +++++++++++++++++++++++++-----------
 .github/workflows/test.yml   |  4 +--
 starlark/types/provider.go   |  9 ++++---
 terraform/plugins.go         |  2 +-
 4 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index eae109b..0d2cdad 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -3,26 +3,46 @@ on:
   release:
     types:
       - created
+
+env:
+  DOCKER_BUILDKIT: 1
+  REGISTRY: "ghcr.io"
+
 jobs:
   docker:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
     steps:
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
+
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log In into GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Build image
-      uses: mr-smithers-excellent/docker-build-push@v2
+    - name: Extract Docker metadata
+      id: meta
+      uses: docker/metadata-action@v5
       with:
-        image: remotelyplatform/ascode
-        registry: docker.io
-        username: remotelyplatform
-        password: ${{ secrets.DOCKER_PASSWORD }}
+        images: remotely-works/ascode
 
-    - name: Tag image
-      uses: mr-smithers-excellent/docker-build-push@v2
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
       with:
-        image: remotelyplatform/ascode
-        registry: docker.io
-        tag: latest
-        username: remotelyplatform
-        password: ${{ secrets.DOCKER_PASSWORD }}
\ No newline at end of file
+        file: ./Dockerfile
+        context: .
+        pull: true
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 256db2f..65c9baf 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,8 +11,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.15.x, 1.16.x]
-        platform: [ubuntu-latest, macos-latest, windows-latest]
+        go-version: [1.16.x, 1.24.x]
+        platform: [ubuntu-latest]
     runs-on: ${{ matrix.platform }}
     steps:
 
diff --git a/starlark/types/provider.go b/starlark/types/provider.go
index 68381ba..a353820 100644
--- a/starlark/types/provider.go
+++ b/starlark/types/provider.go
@@ -2,13 +2,13 @@ package types
 
 import (
 	"fmt"
+	"os"
 	"strings"
 
-	"github.com/remotely-works/ascode/terraform"
-
 	"github.com/hashicorp/terraform/plugin"
 	"github.com/hashicorp/terraform/plugin/discovery"
 	"github.com/hashicorp/terraform/providers"
+	"github.com/remotely-works/ascode/terraform"
 	"go.starlark.net/starlark"
 	"go.starlark.net/syntax"
 )
@@ -124,7 +124,10 @@ var _ starlark.Comparable = &Provider{}
 
 // NewProvider returns a new Provider instance from a given type, version and name.
 func NewProvider(pm *terraform.PluginManager, typ, version, name string, cs starlark.CallStack) (*Provider, error) {
-	cli, meta, err := pm.Provider(typ, version, false)
+	forceLocalEnv := strings.TrimSpace(os.Getenv("ASCODE_PROVIDER_FORCE_LOCAL"))
+	forceLocal := strings.EqualFold(forceLocalEnv, "true") || forceLocalEnv == "1" || false
+
+	cli, meta, err := pm.Provider(typ, version, forceLocal)
 	if err != nil {
 		return nil, err
 	}
diff --git a/terraform/plugins.go b/terraform/plugins.go
index a8c33ba..f5c6889 100644
--- a/terraform/plugins.go
+++ b/terraform/plugins.go
@@ -28,7 +28,7 @@ type PluginManager struct {
 }
 
 // Provider returns a client and the metadata for a given provider and version,
-// first try to locate the provider in the local  path, if not found, it
+// first try to locate the provider in the local path, if not found, it
 // downloads it from terraform registry. If forceLocal just tries to find
 // the binary in the local filesystem.
 func (m *PluginManager) Provider(provider, version string, forceLocal bool) (*plugin.Client, discovery.PluginMeta, error) {