{"id":13840182,"url":"https://github.com/getporter/terraform-mixin","last_synced_at":"2026-03-01T14:05:44.116Z","repository":{"id":43376590,"uuid":"173365486","full_name":"getporter/terraform-mixin","owner":"getporter","description":"A Terraform Mixin for Porter","archived":false,"fork":false,"pushed_at":"2026-01-13T21:55:09.000Z","size":2083,"stargazers_count":16,"open_issues_count":16,"forks_count":22,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-01-13T23:59:06.923Z","etag":null,"topics":["mixin","porter","terraform"],"latest_commit_sha":null,"homepage":"https://getporter.org/mixins/terraform","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/getporter.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-03-01T20:43:20.000Z","updated_at":"2026-01-13T21:50:38.000Z","dependencies_parsed_at":"2024-01-20T21:48:56.017Z","dependency_job_id":"e9b9afdd-b3ba-4068-bf6a-81d8731c710b","html_url":"https://github.com/getporter/terraform-mixin","commit_stats":{"total_commits":118,"total_committers":19,"mean_commits":"6.2105263157894735","dds":0.6016949152542372,"last_synced_commit":"5ddc53b1375d52072f44446e25d3c872e636065d"},"previous_names":["deislabs/porter-terraform"],"tags_count":32,"template":false,"template_full_name":null,"purl":"pkg:github/getporter/terraform-mixin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getporter%2Fterraform-mixin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getporter%2Fterraform-mixin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getporter%2Fterraform-mixin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getporter%2Fterraform-mixin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getporter","download_url":"https://codeload.github.com/getporter/terraform-mixin/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getporter%2Fterraform-mixin/sbom","scorecard":{"id":332761,"data":{"date":"2025-08-11","repo":{"name":"github.com/getporter/terraform-mixin","commit":"a2acb00b135b1479a6fc35c0673ee2bbfd3b4dcf"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.3,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/terraform-mixin.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/terraform-mixin.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/getporter/terraform-mixin/terraform-mixin.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/terraform-mixin.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/getporter/terraform-mixin/terraform-mixin.yml/main?enable=pin","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact canary not signed: https://api.github.com/repos/getporter/terraform-mixin/releases/41139364","Warn: release artifact v1.0.6 not signed: https://api.github.com/repos/getporter/terraform-mixin/releases/196599620","Warn: release artifact latest not signed: https://api.github.com/repos/getporter/terraform-mixin/releases/41139733","Warn: release artifact v1.0.5 not signed: https://api.github.com/repos/getporter/terraform-mixin/releases/189918295","Warn: release artifact canary does not have provenance: https://api.github.com/repos/getporter/terraform-mixin/releases/41139364","Warn: release artifact v1.0.6 does not have provenance: https://api.github.com/repos/getporter/terraform-mixin/releases/196599620","Warn: release artifact latest does not have provenance: https://api.github.com/repos/getporter/terraform-mixin/releases/41139733","Warn: release artifact v1.0.5 does not have provenance: https://api.github.com/repos/getporter/terraform-mixin/releases/189918295"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-18T03:58:43.980Z","repository_id":43376590,"created_at":"2025-08-18T03:58:43.980Z","updated_at":"2025-08-18T03:58:43.980Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29970546,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T13:32:00.443Z","status":"ssl_error","status_checked_at":"2026-03-01T13:32:00.084Z","response_time":124,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["mixin","porter","terraform"],"created_at":"2024-08-04T17:00:43.259Z","updated_at":"2026-03-01T14:05:44.096Z","avatar_url":"https://github.com/getporter.png","language":"Go","funding_links":[],"categories":["Implementations"],"sub_categories":["Porter"],"readme":"# Terraform Mixin for Porter\n\nThis is a Terraform mixin for [Porter](https://porter.sh).\n\n[![porter/terraform-mixin](https://github.com/getporter/terraform-mixin/actions/workflows/terraform-mixin.yml/badge.svg?branch=main)](https://github.com/getporter/terraform-mixin/actions/workflows/terraform-mixin.yml)\n\n\u003cimg src=\"https://porter.sh/images/mixins/terraform.svg\" align=\"right\" width=\"150px\"/\u003e\n\n## Install via Porter\n\nThis will install the latest mixin release via the Porter CLI.\n\n```\nporter mixin install terraform\n```\n\n## Build from source\n\nFollowing commands build the terraform mixin.\n\n```bash\ngit clone https://github.com/getporter/terraform-mixin.git\ncd terraform-mixin\n# Learn about Mage in our CONTRIBUTING.md\ngo run mage.go EnsureMage\nmage build\n```\n\nThen, to install the resulting mixin into PORTER_HOME, execute\n`mage install`\n\n## Mixin Configuration\n\n```yaml\nmixins:\n- terraform:\n    clientVersion: 1.0.3\n    workingDir: myinfra\n    initFile: providers.tf\n    installHost: install.example.com\n    providerHost: providers.example.com\n```\n\n### clientVersion\n\nThe Terraform client version can be specified via the `clientVersion` configuration when declaring this mixin.\n\n### workingDir\n\nThe `workingDir` configuration setting is the relative path to your terraform files. Defaults to \"terraform\".\n\n### initFile\n\nTerraform providers are installed into the bundle during porter build.\nWe recommend that you put your provider declarations into a single file, e.g. \"terraform/providers.tf\".\nThen use `initFile` to specify the relative path to this file within workingDir.\nThis will dramatically improve Docker image layer caching and performance when building, publishing and installing the bundle.\n\u003e Note: this approach isn't suitable when using terraform modules as those need to be \"initilized\" as well but aren't specified in the `initFile`. You shouldn't specifiy an `initFile` in this situation.\n\n### installHost\n\nOptional host that mirrors the official terraform installation at\n`https://releases.hashicorp.com/*` in order to install in an air-gapped\nenvironment.\n\n### providerHost\n\nOptional host to use as a network mirror when installing terraform providers.\nThis needs to conform to the [Terraform registry\nprotocol](https://www.terraform.io/docs/internals/provider-registry-protocol.html).\n\n### User Agent Opt Out\n\nWhen you declare the mixin, you can disable the mixin from customizing the azure user agent string\n\n```yaml\nmixins:\n- terraform:\n    userAgentOptOut: true\n```\n\nBy default, the terraform mixin adds the porter and mixin version to the user agent string used by the azure provider.\nWe use this to understand which version of porter and the mixin are being used by a bundle, and assist with troubleshooting.\nBelow is an example of what the user agent string looks like:\n\n```\nAZURE_HTTP_USER_AGENT=\"getporter/porter/v1.0.0 getporter/terraform/v1.2.3\"\n```\n\nYou can add your own custom strings to the user agent string by editing your [template Dockerfile] and setting the AZURE_HTTP_USER_AGENT environment variable.\n\n[template Dockerfile]: https://getporter.org/bundle/custom-dockerfile/\n\n## Terraform state\n\n### Let Porter do the heavy lifting\n\nThe simplest way to use this mixin with Porter is to let Porter track the Terraform [state](https://www.terraform.io/docs/state/index.html) as actions are executed.  This can be done via a parameter of type `file` that has a source of a corresponding output (of the same `file` type).  Each time the bundle is executed, the output will capture the updated state file and inject it into the next action via its parameter correlate.\n\nHere is an example setup that works with Porter v0.38:\n\n```yaml\nparameters:\n  - name: tfstate\n    type: file\n    # This designates the path within the installer to place the parameter value\n    path: /cnab/app/terraform/terraform.tfstate\n    # Here we tell Porter that the value for this parameter should come from the 'tfstate' output\n    source:\n      output: tfstate\n\noutputs:\n  - name: tfstate\n    type: file\n    # This designates the path within the installer to read the output from\n    path: /cnab/app/terraform/terraform.tfstate\n```\n\nIf you are working with the Porter v1 prerelease, use the new state section:\n\n```yaml\nstate:\n  - name: tfstate\n    path: terraform/terraform.tfstate\n  - name: tfvars\n    path: terraform/terraform.tfvars.json\n```\n\nThe [TabbyCats Tracker bundle](https://github.com/carolynvs/tabbycat-demo) is a good example of how to use the terraform mixin with the Porter v1 prerelease.\n\nThe specified path inside the installer (`/cnab/app/terraform/terraform.tfstate`) should be where Terraform will be looking to read/write its state.  For a full example bundle using this approach, see the [basic-tf-example](examples/basic-tf-example).\n\n### Remote Backends\n\nAlternatively, state can be managed by a remote backend.  When doing so, each action step needs to supply the remote backend config via `backendConfig`.  In the step examples below, the configuration has key/value pairs according to the [Azurerm](https://www.terraform.io/docs/backends/types/azurerm.html) backend.\n\n## Terraform variables file\n\nBy default the mixin will create a default\n[`terraform.tfvars.json`](https://www.terraform.io/docs/language/values/variables.html#variable-definitions-tfvars-files)\nfile from the `vars` block during during the install step.\n\nTo use this file, a `tfvars` file parameter and output must be added to persist it for subsequent steps.\n\nThis can be disabled by setting `disableVarFile` to `true` during install.\n\nHere is an example setup using the tfvar file:\n\n```yaml\nparameters:\n  - name: tfvars\n    type: file\n    # This designates the path within the installer to place the parameter value\n    path: /cnab/app/terraform/terraform.tfvars.json\n    # Here we tell Porter that the value for this parameter should come from the 'tfvars' output\n    source:\n      output: tfvars\n  - name: foo\n    type: string\n    applyTo:\n      - install \n  - name: baz\n    type: string\n    default: blaz\n    applyTo:\n      - install \n\noutputs:\n  - name: tfvars\n    type: file\n    # This designates the path within the installer to read the output from\n    path: /cnab/app/terraform/terraform.tfvars.json\n    \ninstall:\n  - terraform:\n      description: \"Install Azure Key Vault\"\n      vars:\n        foo: bar\n        baz: biz\n      outputs:\n      - name: vault_uri\nupgrade: # No var block required\n  - terraform:\n      description: \"Install Azure Key Vault\"\n      outputs:\n      - name: vault_uri\nuninstall: # No var block required\n  - terraform:\n      description: \"Install Azure Key Vault\"\n      outputs:\n      - name: vault_uri\n```\n\nand with var file disabled\n\n```yaml\nparameters:\n  - name: foo\n    type: string\n    applyTo:\n      - install \n  - name: baz\n    type: string\n    default: blaz\n    applyTo:\n      - install \n\ninstall:\n  - terraform:\n      description: \"Install Azure Key Vault\"\n      disableVarFile: true\n      vars:\n        foo: bar\n        baz: biz\n      outputs:\n      - name: vault_uri\nuninstall: # Var block required\n  - terraform:\n      description: \"Install Azure Key Vault\"\n      vars:\n        foo: bar\n        baz: biz\n```\n\n## Examples\n\n### Install\n\n```yaml\ninstall:\n  - terraform:\n      description: \"Install Azure Key Vault\"\n      backendConfig:\n        key: \"mybundle.tfstate\"\n        storage_account_name: \"mystorageacct\"\n        container_name: \"mycontainer\"\n        access_key: \"myaccesskey\"\n      outputs:\n      - name: vault_uri\n```\n\n### Upgrade\n\n```yaml\nupgrade:\n  - terraform:\n      description: \"Upgrade Azure Key Vault\"\n      backendConfig:\n        key: \"mybundle.tfstate\"\n        storage_account_name: \"mystorageacct\"\n        container_name: \"mycontainer\"\n        access_key: \"myaccesskey\"\n      outputs:\n      - name: vault_uri\n```\n\n### Invoke\n\nAn invoke step is used for any custom action (not one of `install`, `upgrade` or `uninstall`).\n\nBy default, the command given to `terraform` will be the step name.  Here it is `show`,\nresulting in `terraform show` with the provided configuration.\n\n```yaml\nshow:\n  - terraform:\n      description: \"Invoke 'terraform show'\"\n      backendConfig:\n        key: \"mybundle.tfstate\"\n        storage_account_name: \"mystorageacct\"\n        container_name: \"mycontainer\"\n        access_key: \"myaccesskey\"\n```\n\nOr, if the step name does not match the intended terraform command, the command\ncan be supplied via the `arguments:` section, like so:\n\n```yaml\nprintVersion:\n  - terraform:\n      description: \"Invoke 'terraform version'\"\n      arguments:\n        - version\n```\n\n### Uninstall\n\n```yaml\nuninstall:\n  - terraform:\n      description: \"Uninstall Azure Key Vault\"\n      backendConfig:\n        key: \"mybundle.tfstate\"\n        storage_account_name: \"mystorageacct\"\n        container_name: \"mycontainer\"\n        access_key: \"myaccesskey\"\n```\n\nSee further examples in the [Examples](examples) directory\n\n## Step Outputs\n\nAs seen above, outputs can be declared for a step.  All that is needed is the name of the output.\n\nFor each output listed, `terraform output \u003coutput name\u003e` is invoked to fetch the output value\nfrom the state file for use by Porter. Outputs can be saved to the filesystem so that subsequent\nsteps can use the file by specifying the `destinationFile` field. This is particularly useful\nwhen your terraform module creates a Kubernetes cluster. In the example below, the module\ncreates a cluster, and then writes the kubeconfig to /root/.kube/config so that the rest of the\nbundle can immediately use the cluster.\n\n```yaml\ninstall:\n  - terraform:\n      description: \"Create a Kubernetes cluster\"\n      outputs:\n      - name: kubeconfig\n        destinationFile: /root/.kube/config\n```\n\nSee the Porter [Outputs documentation](https://porter.sh/wiring/#outputs) on how to wire up\noutputs for use in a bundle.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgetporter%2Fterraform-mixin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgetporter%2Fterraform-mixin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgetporter%2Fterraform-mixin/lists"}