fix(ci): pass state backend settings to every tofu-init workflow #33

Merged

jfraeys merged 1 commit from jfraeys/fix/ci-state-backend-env into main

2026-10-09 20:55:43 -04:00

jfraeys commented

2026-10-09 20:52:35 -04:00

Owner

terraform-plan run 254 (PR #31) failed at tofu init: empty backend bucket and region. The workflow assumed the runner baseline carried the state-backend settings; it does not.

Declares TF_VAR_tf_state_bucket/region/endpoint plus OBJECT_STORAGE_ACCESS_KEY_ID/SECRET_ACCESS_KEY (repo secrets) at workflow level in terraform-plan, terraform-apply, staging-validate and staging-reboot-check, matching drift-check.

Takes effect only once the two OBJECT_STORAGE_ repo secrets exist.* Without them init_terraform still skips -backend-config and fails the same way. Which credential to store (shared key vs a bucket-scoped Linode limited-access key, see docs/secrets-inventory.md) is a pending decision; drift-check can be un-paused afterwards.

🤖 Generated with Claude Code

terraform-plan run 254 (PR #31) failed at `tofu init`: empty backend bucket and region. The workflow assumed the runner baseline carried the state-backend settings; it does not. Declares TF_VAR_tf_state_bucket/region/endpoint plus OBJECT_STORAGE_ACCESS_KEY_ID/SECRET_ACCESS_KEY (repo secrets) at workflow level in terraform-plan, terraform-apply, staging-validate and staging-reboot-check, matching drift-check. **Takes effect only once the two OBJECT_STORAGE_* repo secrets exist.** Without them init_terraform still skips -backend-config and fails the same way. Which credential to store (shared key vs a bucket-scoped Linode limited-access key, see docs/secrets-inventory.md) is a pending decision; drift-check can be un-paused afterwards. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-09 20:52:35 -04:00

fix(ci): pass the state backend settings explicitly to every tofu-init workflow 08558ac45b

terraform-plan.yml assumed the runner baseline already had the S3 backend
settings and said to confirm on first real run; run 254 failed at tofu init
("bucket must not be empty", "Missing region"). Declare the bucket/region/
endpoint and the OBJECT_STORAGE_* repo secrets at workflow level in
terraform-plan, terraform-apply, staging-validate and staging-reboot-check,
matching drift-check. The two repo secrets must exist for this to take effect.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys referenced this pull request

2026-10-09 20:54:37 -04:00

feat(ci): bucket-scoped Linode key for the Terraform state backend #34

jfraeys merged commit 272d26efb7 into main

2026-10-09 20:55:43 -04:00

jfraeys referenced this pull request from a commit

2026-10-09 20:55:47 -04:00

Merge pull request 'fix(ci): pass state backend settings to every tofu-init workflow' (#33) from jfraeys/fix/ci-state-backend-env into main