https://github.com/dflook/tofu-unlock-state
GitHub action to unlock previously locked OpenTofu state
https://github.com/dflook/tofu-unlock-state
Last synced: 3 months ago
JSON representation
GitHub action to unlock previously locked OpenTofu state
- Host: GitHub
- URL: https://github.com/dflook/tofu-unlock-state
- Owner: dflook
- Created: 2023-10-23T17:04:24.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2025-02-28T19:03:48.000Z (over 1 year ago)
- Last Synced: 2025-02-28T22:53:37.049Z (over 1 year ago)
- Size: 11.7 KB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
Awesome Lists containing this project
README
# tofu-unlock-state action
This is one of a suite of OpenTofu related actions - find them at [dflook/terraform-github-actions](https://github.com/dflook/terraform-github-actions).
Force unlocks an OpenTofu remote state.
## Inputs
* `path`
Path to the OpenTofu root module that defines the remote state to unlock
- Type: string
- Optional
- Default: The action workspace
* `workspace`
OpenTofu workspace to unlock the remote state for
- Type: string
- Optional
- Default: `default`
* `backend_config`
List of OpenTofu backend config values, one per line.
```yaml
with:
backend_config: token=${{ secrets.BACKEND_TOKEN }}
```
- Type: string
- Optional
* `backend_config_file`
List of OpenTofu backend config files to use, one per line.
Paths should be relative to the GitHub Actions workspace
```yaml
with:
backend_config_file: prod.backend.tfvars
```
- Type: string
- Optional
* `lock_id`
The ID of the state lock to release.
- Type: string
- Required
## Environment Variables
* `GITHUB_DOT_COM_TOKEN`
This is used to specify a token for GitHub.com when the action is running on a GitHub Enterprise instance.
This is only used for downloading OpenTofu binaries from GitHub.com.
If this is not set, an unauthenticated request will be made to GitHub.com to download the binary, which may be rate limited.
- Type: string
- Optional
* `TERRAFORM_CLOUD_TOKENS`
API tokens for cloud hosts, of the form `=`. Multiple tokens may be specified, one per line.
These tokens may be used with the `remote` backend and for fetching required modules from the registry.
e.g:
```yaml
env:
TERRAFORM_CLOUD_TOKENS: app.terraform.io=${{ secrets.TF_CLOUD_TOKEN }}
```
With other registries:
```yaml
env:
TERRAFORM_CLOUD_TOKENS: |
app.terraform.io=${{ secrets.TF_CLOUD_TOKEN }}
tofu.example.com=${{ secrets.TF_REGISTRY_TOKEN }}
```
- Type: string
- Optional
* `TERRAFORM_SSH_KEY`
A SSH private key that OpenTofu will use to fetch git/mercurial module sources.
This should be in PEM format.
For example:
```yaml
env:
TERRAFORM_SSH_KEY: ${{ secrets.TERRAFORM_SSH_KEY }}
```
- Type: string
- Optional
* `TERRAFORM_HTTP_CREDENTIALS`
Credentials that will be used for fetching modules sources with `git::http://`, `git::https://`, `http://` & `https://` schemes.
Credentials have the format `=:`. Multiple credentials may be specified, one per line.
Each credential is evaluated in order, and the first matching credentials are used.
Credentials that are used by git (`git::http://`, `git::https://`) allow a path after the hostname.
Paths are ignored by `http://` & `https://` schemes.
For git module sources, a credential matches if each mentioned path segment is an exact match.
For example:
```yaml
env:
TERRAFORM_HTTP_CREDENTIALS: |
example.com=dflook:${{ secrets.HTTPS_PASSWORD }}
github.com/dflook/terraform-github-actions.git=dflook-actions:${{ secrets.ACTIONS_PAT }}
github.com/dflook=dflook:${{ secrets.DFLOOK_PAT }}
github.com=graham:${{ secrets.GITHUB_PAT }}
```
- Type: string
- Optional
* `TERRAFORM_PRE_RUN`
A set of commands that will be ran prior to `tofu init`. This can be used to customise the environment before running OpenTofu.
The runtime environment for these actions is subject to change in minor version releases. If using this environment variable, specify the minor version of the action to use.
The runtime image is currently based on `debian:bookworm`, with the command run using `bash -xeo pipefail`.
For example:
```yaml
env:
TERRAFORM_PRE_RUN: |
# Install latest Azure CLI
curl -skL https://aka.ms/InstallAzureCLIDeb | bash
# Install postgres client
apt-get install -y --no-install-recommends postgresql-client
```
- Type: string
- Optional
## Example usage
```yaml
name: "Unlock state"
on:
workflow_dispatch:
inputs:
path:
description: "Path to the OpenTofu root module"
required: true
lock_id:
description: "Lock ID to be unlocked"
required: true
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
jobs:
unlock:
name: Unlock
runs-on: ubuntu-latest
steps:
- name: Checkout current branch
uses: actions/checkout@v4
- name: OpenTofu Unlock
uses: dflook/tofu-unlock-state@v2
with:
path: ${{ github.event.inputs.path }}
lock_id: ${{ github.event.inputs.lock_id }}
```