Troubleshooting

Search this page for the exact text from your workflow log.

Contacting support

Every accepted build prints a run ID. It is in the job summary, the annotations, and the log as Infragr.am run ID: …. Include it when you open a ticket from Support in the dashboard. It is how a build is found.

The step is green but nothing was built

The Action checks eligibility before it plans. A build that wouldn’t be accepted ends successfully with a notice, so it doesn’t break your pull request checks:

Notice: Infragr.am skipped this run: <reason>.

Reason	Fix
repository_not_activated	Install the GitHub App on the repository, then click Activate in Repositories in the dashboard.
repository_inactive	The repository was deactivated. Activate it again in the dashboard.
quota_exhausted	This month’s builds are used up. Upgrade in Billing, or wait until the 1st (UTC). See Plans and limits.
rate_limited	The account started an unusual number of builds in the last 24 hours. It clears by itself.

Setup errors

GitHub OIDC unavailable. Add 'id-token: write' to workflow permissions.

Add this permission to the workflow or the job:

permissions:
  contents: read
  id-token: write

If a job sets its own permissions, it replaces the workflow-level ones, so id-token: write has to appear there too.

Pull requests from forks don’t get an OIDC token under pull_request. That is a GitHub restriction, and the build can’t run for them.

Infragr.am Action currently supports Linux runners only.

Use runs-on: ubuntu-latest, or any Linux runner.

terraform is required. Run hashicorp/setup-terraform before this action.

Add hashicorp/setup-terraform@v4 before the Action, or make sure terraform is on PATH on your self-hosted runner.

Go is required to build the auditable collector.

Add actions/setup-go@v7 with go-version: stable. The collector is built from source on every run, so its code can be reviewed.

secret-scan must be one of: block, warn, off.

Fix the secret-scan input. This is checked before planning, so you find out in seconds.

vars entries must be key=value. / var-files entries must be file paths.

Each line of vars must contain =, and no line in vars or var-files can start with -. To pass Terraform flags, use terraform-args.

Plan errors

Error: Invalid count argument

Warning: No diagram for infrastructure: Terraform cannot plan it, because a count
or for_each depends on values that only exist after apply.

Terraform can’t plan a root whose count or for_each depends on a value that doesn’t exist yet, such as an IPAM-allocated CIDR or the ID of a resource still to be created. The Action reports this as a warning and exits successfully. Apply what those counts depend on first, or point the Action at a root that can be planned.

terraform plan failed with exit 1. Its output is above.

The plan failed for an ordinary reason. Terraform’s error is in the log right above this line. Common causes:

• No credentials. No valid credential sources found: add a cloud login step.
• Not authorized to perform sts:AssumeRoleWithWebIdentity: the role’s trust policy doesn’t match this repository. See why two sub entries.
• A var file not found. var-files paths are relative to working-directory, not the repository root.
• Required variable not set. Provide it in var-files, vars, or a TF_VAR_* environment variable.

infragram-collect: decode Terraform plan JSON: …

Set terraform_wrapper: false on hashicorp/setup-terraform. The wrapper rewrites Terraform’s stdout, and the Action reads that output from a pipe.

Terraform plan does not exist: …

plan-path points at a missing file. Paths are relative to the repository root. Check where actions/download-artifact extracted the file.

Scan errors

Gitleaks found a potential secret in sanitized output; nothing was uploaded.

Something that looks like a secret survived sanitization, usually in a tag, a name or a description. Nothing left the runner. See Handling a finding.

Gitleaks could not complete the scan (exit N); nothing was uploaded.

The scanner itself failed. This fails in every mode, because an incomplete scan isn’t a passing one. Re-run the job. If it keeps failing, check that the runner can reach github.com to download Gitleaks.

Gitleaks checksum verification failed.

The downloaded Gitleaks archive didn’t match the pinned SHA-256. Re-run the job. If it persists, a proxy may be rewriting downloads. Contact support with the run log.

Upload errors

Infragr.am API returned HTTP 403: Install the Infragr.am GitHub App and activate this repository first.

The repository was deactivated, or the app was uninstalled, between preflight and upload. Activate it again in the dashboard.

… HTTP 403: GitHub repository ownership no longer matches its Infragr.am activation.

The repository was transferred to another account. Activate it again from the new owner’s account.

… HTTP 400: pull_request_target is not supported …

Use pull_request instead. pull_request_target runs pull request code with the base repository’s secrets, so Infragr.am refuses it.

… HTTP 400: Request is not a supported sanitized Infragr.am bundle.

The bundle didn’t match the schema. This usually means a very old Action ref. Use @v1, or update your pinned SHA.

… HTTP 413: Sanitized bundle exceeds 3 MB.

The root is very large. Split it into smaller roots, or diagram the parts separately with a matrix.

… HTTP 429: Too many builds in flight. Try again shortly.

The account had 8 builds rendering for more than 5 minutes straight. Re-run the job. If this happens often, reduce how many workflows build at once.

No pull request comment

See When there is no comment.

The diagram is missing something

• A resource isn’t drawn. Check Supported AWS resources. Unsupported types are skipped.
• A connection is missing. Connections come from references in your configuration. If a value is hard-coded, such as a subnet ID pasted as a string instead of aws_subnet.x.id, there is no reference to follow.
• A subnet is in the wrong zone. See Public or private?

If the diagram still looks wrong, use Support on the diagram in the dashboard. It attaches the run, so we can reproduce the render exactly.