Permissions fixes for Terragrunt action

.circleci/config.yml

@@ -0,0 +1,82 @@
+env: &env
+  environment:
+    GRUNTWORK_INSTALLER_VERSION: v0.0.36
+    MODULE_CI_VERSION: v0.46.0
+    GO_VERSION: 1.21.1
+    GO111MODULE: auto
+
+defaults: &defaults
+  machine:
+    enabled: true
+    image: ubuntu-2004:2022.10.1
+  <<: *env
+
+install_gruntwork_utils: &install_gruntwork_utils
+  name: install gruntwork utils
+  command: |
+    curl -Ls https://raw.githubusercontent.com/gruntwork-io/gruntwork-installer/master/bootstrap-gruntwork-installer.sh | bash /dev/stdin --version "${GRUNTWORK_INSTALLER_VERSION}"
+    gruntwork-install --module-name "gruntwork-module-circleci-helpers" --repo "https://github.com/gruntwork-io/terraform-aws-ci" --tag "${MODULE_CI_VERSION}"
+    gruntwork-install --module-name "kubernetes-circleci-helpers" --repo "https://github.com/gruntwork-io/terraform-aws-ci" --tag "${MODULE_CI_VERSION}"
+
+    echo "Installing Go version $GO_VERSION"
+    curl -O --silent --location --fail --show-error "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz"
+    sudo rm -rf /usr/local/go
+    sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
+    sudo ln -s /usr/local/go/bin/go /usr/bin/go
+    echo "The installed version of Go is now $(go version)"
+
+version: 2
+jobs:
+  setup:
+    <<: *env
+    docker:
+      - image: cimg/python:3.10.2
+
+    steps:
+      - checkout
+
+      # Install gruntwork utilities
+      - run:
+          <<: *install_gruntwork_utils
+
+      - persist_to_workspace:
+          root: /home/circleci
+          paths:
+            - project
+
+  tests:
+    <<: *defaults
+    steps:
+      - attach_workspace:
+          at: /home/circleci
+
+      - run:
+          <<: *install_gruntwork_utils
+      - run: |
+          run-go-tests --path test --timeout 60m  --packages . | (tee /tmp/logs/all.log || true)
+
+workflows:
+  version: 2
+  build-and-test:
+    jobs:
+      - setup:
+          context:
+            - AWS__PHXDEVOPS__circle-ci-test
+            - GITHUB__PAT__gruntwork-ci
+          filters:
+            tags:
+              only: /^v.*/
+
+      - tests:
+          context:
+            - AWS__PHXDEVOPS__circle-ci-test
+            - GITHUB__PAT__gruntwork-ci
+            - SLACK__TOKEN__refarch-deployer-test
+            - SLACK__WEBHOOK__refarch-deployer-test
+            - SLACK__CHANNEL__test-workflow-approvals
+          requires:
+            - setup
+          filters:
+            tags:
+              only: /^v.*/
+

.gitignore

@@ -0,0 +1,28 @@
+# Terraform files
+.terraform
+terraform.tfstate
+terraform.tfvars
+terraform.tfvars.json
+*.tfstate*
+.terragrunt
+.terragrunt-cache
+.terraform.lock.hcl
+# IDE files
+.idea
+.vscode
+*.iml
+vendor
+
+# Folder used to store temporary test data by Terratest
+.test-data
+
+# rbenv
+.ruby-version
+
+# OS X
+.DS_Store
+# Intermediate file for testing
+kubeconfig
+
+# environment files
+.env

README.md

@@ -18,12 +18,13 @@ Supported GitHub action inputs:
 
 Supported environment variables:
 
-| Input Name            | Description                                                                                                 | 
-|:----------------------|:------------------------------------------------------------------------------------------------------------|
-| GITHUB_TOKEN          | GitHub token used to add comment to Pull request                                                            |
-| TF_LOG                | Log level for Terraform                                                                                     |
-| TF_VAR_name           | Define custom variable name as inputs                                                                       |
-| INPUT_PRE_EXEC_number | Environment variable is utilized to provide custom commands that will be executed before running Terragrunt |
+| Input Name             | Description                                                                                                  | 
+|:-----------------------|:-------------------------------------------------------------------------------------------------------------|
+| GITHUB_TOKEN           | GitHub token used to add comment to Pull request                                                             |
+| TF_LOG                 | Log level for Terraform                                                                                      |
+| TF_VAR_name            | Define custom variable name as inputs                                                                        |
+| INPUT_PRE_EXEC_number  | Environment variable is utilized to provide custom commands that will be executed before running Terragrunt  |
+| INPUT_POST_EXEC_number | Environment variable is utilized to provide custom commands that will be executed *after* running Terragrunt |
 
 ## Outputs
 

src/main.sh

@@ -102,6 +102,21 @@ function setup_pre_exec {
   done <<< "$pre_exec_vars"
 }
 
+# Run INPUT_POST_EXEC_* environment variables as Bash code
+function setup_post_exec {
+  # Get all environment variables that match the pattern INPUT_POST_EXEC_*
+  local -r post_exec_vars=$(env | grep -o '^INPUT_POST_EXEC_[0-9]\+' | sort)
+  # Loop through each pre-execution variable and execute its value (Bash code)
+  local post_exec_command
+  while IFS= read -r post_exec_var; do
+    if [[ -n "${post_exec_var}" ]]; then
+      log "Evaluating ${post_exec_var}"
+      post_exec_command="${!post_exec_var}"
+      eval "$post_exec_command"
+    fi
+  done <<< "$post_exec_vars"
+}
+
 function main {
   log "Starting Terragrunt Action"
   trap 'log "Finished Terragrunt Action execution"' EXIT
@@ -139,6 +154,8 @@ function main {
   fi
   run_terragrunt "${tg_dir}" "${tg_arg_and_commands}"
 
+  setup_post_exec
+
   local -r log_file="${terragrunt_log_file}"
   trap 'rm -rf ${log_file}' EXIT
 

terragrunt/Dockerfile

@@ -13,11 +13,13 @@ RUN apt-get update && apt-get install -y \
     jq \
     unzip \
     wget \
+    sudo \
     && rm -rf /var/lib/apt/lists/*
 
 # Create runner user
 RUN addgroup --system --gid 127 docker
 RUN useradd --system -u 1001 -g 127 -ms /bin/bash runner
+RUN usermod -aG sudo runner && echo 'runner ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
 USER runner
 
 RUN mkdir -p /home/runner/.ssh

test/action.go

@@ -0,0 +1,16 @@
+package test
+
+import (
+	"github.com/gruntwork-io/terratest/modules/docker"
+	"github.com/gruntwork-io/terratest/modules/random"
+	"testing"
+)
+
+func buildActionImage(t *testing.T) string {
+	tag := "terragrunt-action:" + random.UniqueId()
+	buildOptions := &docker.BuildOptions{
+		Tags: []string{tag},
+	}
+	docker.Build(t, "..", buildOptions)
+	return tag
+}

test/action_container_test.go

@@ -0,0 +1,16 @@
+package test
+
+import (
+	"testing"
+
+	"github.com/gruntwork-io/terratest/modules/docker"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActionContainerIsBuilt(t *testing.T) {
+	tag := buildActionImage(t)
+
+	opts := &docker.RunOptions{Entrypoint: "/bin/bash", Command: []string{"-c", "ls /action"}}
+	output := docker.Run(t, tag, opts)
+	assert.Equal(t, "main.sh", output)
+}

test/action_run_test.go

@@ -0,0 +1,33 @@
+package test
+
+import (
+	"github.com/gruntwork-io/terratest/modules/files"
+	"os"
+	"testing"
+
+	"github.com/gruntwork-io/terratest/modules/docker"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActionIsExecuted(t *testing.T) {
+	tag := buildActionImage(t)
+
+	path, err := files.CopyTerraformFolderToTemp("fixture-action-execution", "test")
+	assert.NoError(t, err)
+
+	err = os.Chmod(path, 0777)
+	assert.NoError(t, err)
+
+	opts := &docker.RunOptions{
+		EnvironmentVariables: []string{
+			"INPUT_TF_VERSION=1.4.6",
+			"INPUT_TG_VERSION=0.46.3",
+			"INPUT_TG_COMMAND=plan",
+			"INPUT_TG_DIR=/github/workspace/fixture-action-execution",
+			"GITHUB_OUTPUT=/tmp/logs",
+		},
+		Volumes: []string{path + ":/github/workspace/fixture-action-execution"},
+	}
+	output := docker.Run(t, tag, opts)
+	assert.Contains(t, output, "You can apply this plan to save these new output values to the Terraform")
+}

test/fixture-action-execution/terragrunt.hcl

@@ -0,0 +1,7 @@
+inputs = {
+  name = "World"
+}
+
+terraform {
+  source = "github.com/gruntwork-io/terragrunt.git//test/fixture-download/hello-world?ref=v0.9.9"
+}

test/go.mod

@@ -0,0 +1,20 @@
+module github.com/gruntwork-io/terragrunt-action
+
+go 1.21.1
+
+require (
+	github.com/gruntwork-io/terratest v0.46.6
+	github.com/stretchr/testify v1.8.4
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.0 // indirect
+	github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.0.3 // indirect
+)

test/go.sum

@@ -0,0 +1,36 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/gruntwork-io/terratest v0.46.6 h1:OO+BozS6nqeu0OhkLy7opkgDoYafkDr1TPlxprma26M=
+github.com/gruntwork-io/terratest v0.46.6/go.mod h1:6gI5MlLeyF+SLwqocA5GBzcTix+XiuxCy1BPwKuT+WM=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
+github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
+github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 h1:ofNAzWCcyTALn2Zv40+8XitdzCgXY6e9qvXwN9W0YXg=
+github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
+gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=