Action inputs and outputs

- uses: Tekchbila-Studios/infragram-action@v1

@v1 tracks the latest 1.x release. To make a supply-chain review easier, pin a full commit SHA instead. See the changelog for releases.

Requirements

Requirement	Notes
Linux runner	ubuntu-*, or any self-hosted Linux runner. x64 and arm64.
permissions: id-token: write	The only credential the Action uses.
Terraform on PATH	hashicorp/setup-terraform with terraform_wrapper: false.
Go on PATH	Builds the collector. Use actions/setup-go with go-version: stable.
curl, Node.js	Present on GitHub-hosted runners.
Activated repository	Install the GitHub App and activate the repository in the dashboard.

Inputs

working-directory

optional Default: .

The Terraform root module, relative to the repository root. terraform -chdir runs here, so var-files paths are relative to this directory.

plan-path

optional

Path to an existing binary plan (terraform plan -out=…). When set, the Action doesn’t plan: it runs terraform init -backend=false to install provider schemas, then reads this plan. var-files, vars and terraform-args are ignored. See Reuse an existing plan.

var-files

optional

Newline-separated .tfvars files, passed in order as -var-file. Later files override earlier ones. Entries starting with - are rejected.

var-files: |
  environments/common.tfvars
  environments/production.tfvars

vars

optional

Newline-separated key=value overrides, passed as -var. Each line is one argument, so spaces in values are kept. Entries must contain = and must not start with -.

vars: |
  region=eu-west-1
  cluster_name=platform blue

Caution

Visible in your workflow file and in plan output. Never use it for secrets. Use TF_VAR_* environment variables backed by GitHub secrets.

environment

optional

Names this build when one repository produces several per pull request. Builds replace each other within an environment, never across environments, and each environment gets its own pull request comment. Up to 40 characters: letters, digits, space, ., _, -. See Multiple environments.

terraform-args

optional

Extra arguments appended to terraform plan, split on whitespace. For example: -parallelism=20 -refresh=false. Must not contain secrets.

secret-scan

optional Default: block

What happens when Gitleaks flags the sanitized bundle: block, warn or off. Any other value fails the step before planning. See Secret scanning.

api-url

optional Default: https://infragr.am

The Infragr.am API base URL. You only need to change it if Infragr.am support asks you to.

Outputs

Output	Description
run-id	The build’s identifier, a UUID. Quote it in support requests.
run-url	Link to the build’s diagrams in the dashboard.

- id: diagram
  uses: Tekchbila-Studios/infragram-action@v1
- run: echo "Diagrams at ${{ steps.diagram.outputs.run-url }}"

Outputs are empty when the build was skipped at preflight.

What the step does, in order

1. Fails on non-Linux runners, or when secret-scan is invalid.
2. Requests an OIDC token for the audience infragr.am.
3. Preflight. Asks whether the repository is eligible. If it isn’t, logs a notice and exits successfully.
4. Builds the collector from source.
5. terraform init, then terraform plan, unless plan-path is set.
6. terraform show -json | infragram-collect produces bundle.json.
7. Gitleaks scan, according to secret-scan.
8. Upload. If the account is at its concurrent build limit, retries every 5–60 seconds for up to 5 minutes.
9. Writes the run ID to the log, an annotation, the job summary and the outputs.

Job summary

Every accepted build adds this to the workflow run’s summary page:

### Infragr.am diagram build

- Environment: `production`
- Run ID: `3f0c9a4e-6d1b-4f7e-9a51-2a8c0e7d4b12`
- Build: https://infragr.am/dashboard?section=diagrams&run=3f0c9a4e-…
- Quote the run ID when raising a support case.