chore(deps): update dependency suzuki-shunsuke/tfcmt to v4.11.0

[renovate]

This PR contains the following updates:

Package	Update	Change
suzuki-shunsuke/tfcmt	minor	v4.0.0 -> v4.11.0

---

Release Notes

suzuki-shunsuke/tfcmt (suzuki-shunsuke/tfcmt)

v4.11.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.10.0...v4.11.0

Features

#​1336 #​1339 Post comments to a pull request if the workflow run is triggered via GitHub Actions' merge_group event

Others

Update Go to 1.22.5

v4.10.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.9.1...v4.10.0

Features

#​1294 plan: Support disabling labels by a command line option and environment variable

Added a command line option -disable-label and an environment variable TFCMT_DISABLE_LABEL. If they are set, tfcmt plan doesn't set labels.

tfcmt plan -disable-label -- terraform plan

export TFCMT_DISABLE_LABEL=true
tfcmt plan -- terraform plan

Fixes

#​1295 validate if command is specified

tfcmt plan and tfcmt apply require command to be executed.

tfcmt plan -- terraform plan
tfcmt apply -- terraform apply

So this pull request adds a validation if command is specified.
If no command is specified, tfcmt plan and apply return an error immediately.

$ tfcmt plan
ERRO[0000] tfcmt failed                                  error="no command specified"

Others

#​1292 #​1293 Improve the help message

v4.9.1

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.9.0...v4.9.1

Fix

#​1187 #​1257 #​1258 Exit commands with non zero exit code if any error such as API rate limit happens

This update changes the exit code of tfcmt when an error happens.
The exit code was same with the exit code of terraform plan and terraform apply.
This means tfcmt might have exited with zero even if tfcmt failed to post a comment due to some reason such as API rate limit.
This was not a bug but a expected behavior.
But this behaviour was dangerous because people might have missed unexpected changes.

So this update changes the behaviour as tfcmt exits with non zero if any error such as API rate limit happens.

v4.9.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.8.0...v4.9.0

Features

#​1083 #​1115 Support masking sensitive data

You can mask sensitive data in outputs of terraform.
This feature prevents the leak of sensitive data.

The following outputs are masked.

• Standard output of terraform command
• Standard error output of terraform command
• Pull request comment of tfcmt plan and tfcmt apply
• local files created by --output option

[!CAUTION]
Even if you maske secrets using this feature, secrets are still stored in Terraform States.
Please see also Sensitive Data in State.

You can use environment variables TFCMT_MASKS and TFCMT_MASKS_SEPARATOR.

• TFCMT_MASKS: A list of masks. Masks are joined by TFCMT_MASKS_SEPARATOR
• TFCMT_MASKS_SEPARATOR: A separator of masks. The default value is ,

The format of each mask is ${type}:${value}.
${type} must be either env or regexp.
If ${type} is env, ${value} is a masked environment variable name.
If ${type} is regexp, ${value} is a masked regular expression.

e.g. Mask GitHub access tokens and the environment variable DATADOG_API_KEY.

export TFCMT_MASKS='env:GITHUB_TOKEN,env:DATADOG_API_KEY,regexp:ghp_[^ ]+'
tfcmt plan -- terraform plan

e.g. Change the separator to /.

export TFCMT_MASKS_SEPARATOR=/
export TFCMT_MASKS='env:GITHUB_TOKEN/env:DATADOG_API_KEY/regexp:ghp_[^ ]+'

All matching strings are replaced with ***.
Replacements are done in order of TFCMT_MASKS, so the result depends on the order of TFCMT_MASKS.
For example, if TFCMT_MASKS is regexp:foo,regexp:foo.*, regexp:foo.* has no meaning because all foo are replaced with *** before replacing foo.* with *** so foo.* doesn't match with anything.

Example

This example creates a resource google_cloudbuild_trigger.
This resource has a GitHub Access token as a field substitutions._GH_TOKEN.

main.tf

resource "google_cloudbuild_trigger" "filename_trigger" {
  location = "us-central1"
  trigger_template {
    branch_name = "main"
    repo_name   = "my-repo"
  }
  substitutions = {
    _GH_TOKEN = var.gh_token # Secret
  }
  filename = "cloudbuild.yaml"
}
variable "gh_token" {
  type        = string
  description = "GitHub Access token"
}
terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "5.13.0"
    }
  }
}

If you run terraform plan without masking, the secret would be leaked.
To prevent the leak, let's mask the secret.

export TFCMT_MASKS=env:TF_VAR_gh_token # Mask the environment variable TF_VAR_gh_token

Please see _GH_TOKEN in the output of tfcmt plan and the pull request comment.
You can confirm _GH_TOKEN is masked as *** properly.

$ tfcmt plan -- terraform plan
tfcmt plan -- terraform plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

### google_cloudbuild_trigger.filename_trigger will be created
  + resource "google_cloudbuild_trigger" "filename_trigger" {
      + create_time   = (known after apply)
      + filename      = "cloudbuild.yaml"
      + id            = (known after apply)
      + location      = "us-central1"
      + name          = (known after apply)
      + project       = "hello"
      + substitutions = {
          + "_GH_TOKEN" = "***"
        }
      + trigger_id    = (known after apply)

      + trigger_template {
          + branch_name = "main"
          + project_id  = (known after apply)
          + repo_name   = "my-repo"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Terraform sensitive input variables and outputs and sensitive function

Terraform itself has features to prevent sensitive data from being leaked.

• https://developer.hashicorp.com/terraform/tutorials/configuration-language/sensitive-variables
• https://developer.hashicorp.com/terraform/language/functions/sensitive
• https://developer.hashicorp.com/terraform/language/values/outputs#sensitive-suppressing-values-in-cli-output
• https://developer.hashicorp.com/terraform/language/values/variables#suppressing-values-in-cli-output
• https://www.hashicorp.com/blog/terraform-0-14-adds-the-ability-to-redact-sensitive-values-in-console-output
• https://www.hashicorp.com/blog/announcing-hashicorp-terraform-0-15-general-availability

So first you should use these features.
But even if these features are available, it still makes sense for tfcmt to mask sensitive data.
Please imagine the situation that platform engineers manage Terraform workflows and product teams manage Terraform codes in a Monorepo.
Then platform engineers need to prevent sensitive data from being leaked, but if product teams forget to protect them with sensitive flags, sensitive data would be leaked.
By protecting sensitive data using tfcmt, platform engineers can prevent sensitive data from being leaked while delegating the management of Terraform codes to product teams.
tfcmt's masking feature works as a guardrail.

v4.8.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.7.3...v4.8.0

Features

#​1090 #​1091 Support passing GitHub Access token via the environment variable TFCMT_GITHUB_TOKEN

In addition to the environment variable GITHUB_TOKEN, tfcmt supports the environment variable TFCMT_GITHUB_TOKEN too.

v4.7.3

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.7.2...v4.7.3

Bug Fixes

#​1073 Fix a bug code blocks are broken if "```" are used in the command output @​jemiam

When triple backticks are in results for terraform command, wrapCode method uses HTML tags(pre + code) to escape it.
But currently these tags are also escaped so it doesn't work as intended.

New Contributor 🎉

Thank you for your contirbution!

@​jemiam #​1073

v4.7.2

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.7.1...v4.7.2

Fixes

#​1061 #​1062 Change the default template to fix the issue that emojis aren't rendered

Recently, some emojis in tfcmt's comments aren't rendered properly.

We guess this is a bug of GitHub itself.

• https://github.com/orgs/community/discussions/77605
• https://github.com/orgs/community/discussions/77606

We found the bug doesn't occur if we remove emojis from the end of lines.

Before

##### :warning: Resource Deletion will happen :warning:

After

##### :warning: Resource Deletion will happen

Until the bug will be fixed, we'll remove emojis from the end of lines.

Others

Update dependencies

#​1058 chore(deps): update dependency golang/go to v1.21.5

v4.7.1

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.7.0...v4.7.1

Others

#​959 chore(deps): update dependency golang/go to v1.21.3
#​960 fix(deps): update module github.com/google/go-cmp to v0.6.0

v4.7.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.6.1...v4.7.0

#​955 #​956 Support OpenTofu

We roughly checked if tfcmt worked with OpenTofu, then we fixed some issues that tfcmt didn't work with OpenTofu.
We tested tfcmt with OpenTofu v1.6.0-alpha2.
tfcmt seems to work with OpenTofu.
You can simply replace Terraform CLI with OpenTofu CLI.

$ tfcmt plan -- tofu plan
$ tfcmt apply -- tofu apply

But we didn't check deeply. We just checked roughly.
And we don't promise OpenTofu Support for now.
We primary support Terraform.

v4.6.1

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.6.0...v4.6.1

Others

#​952 Fix Go Module Path

This update fixes the issue that tfcmt can't be installed by go install.

$ go install github.com/suzuki-shunsuke/tfcmt/cmd/[email protected]
go: github.com/suzuki-shunsuke/tfcmt/cmd/[email protected]: github.com/suzuki-shunsuke/[email protected]: invalid version: module contains a go.mod file, so module path must match major version ("github.com/suzuki-shunsuke/tfcmt/v4")

$ go install github.com/suzuki-shunsuke/tfcmt/v4/cmd/[email protected]
go: github.com/suzuki-shunsuke/tfcmt/v4/cmd/[email protected]: github.com/suzuki-shunsuke/[email protected]: invalid version: module contains a go.mod file, so module path must match major version ("github.com/suzuki-shunsuke/tfcmt/v4")

As of v4.6.1, you can install tfcmt by go install.

$ go install github.com/suzuki-shunsuke/tfcmt/v4/cmd/[email protected]
go: downloading github.com/suzuki-shunsuke/tfcmt/v4 v4.6.1

#​947 Update Go 1.21.1 to 1.21.2
#​890 Update github.com/google/go-github/v53 to v55

Addressed go-github's breaking changes.

#​711 Update dependency golangci/golangci-lint to v1.54.2

Fixed lint errors.

v4.6.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.5.1...v4.6.0

Features

#​930 #​932 List imported or moved resources even if they are changed or replaced

tfcmt v4.5.0 now lists imported or moved resources, but doesn't list them if they are changed or replaced.
This release enables to list imported or moved resources even if they are changed.

v4.5.1

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.5.0...v4.5.1

Bug Fixes

• #​117 #​896 (#​904 #​909 #​910) Fix parse errors when only Outputs will be changed
• #​903 #​911 Support parsing errors and warnings without terraform plan's -no-color option
• #​907 --output: List imported and moved resources
• #​906 Fix the title by error messages

Fix parse errors when only Outputs will be changed

#​117 #​896 (#​904 #​909 #​910)

tfcmt ever couldn't parse the output of terraform plan if only Terraform's Outputs will be changed.

e.g.

$ tfcmt plan -- terraform plan

Changes to Outputs:
  + foo = "foo"

You can apply this plan to save these new output values to the Terraform
state, without changing any real infrastructure.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

As of tfcmt v4.5.1, tfcmt can parse the output properly.

Support parsing errors and warnings without terraform plan's -no-color option

#​903 #​911

tfcmt ever couldn't parse errors and warnings without terraform plan's -no-color option because they start with |.

tfcmt plan -- terraform plan

e.g.

╷
│ Warning: "default_branch": [DEPRECATED] Use the github_branch_default resource instead
│ 
│   with github_repository.tfcmt,
│   on main.tf line 10, in resource "github_repository" "tfcmt":
│   10: resource "github_repository" "tfcmt" {
│ 
│ (and one more similar warning elsewhere)
╵

As of tfcmt v4.5.1, tfcmt supports parsing warnings and errors even if the -no-color option isn't set.

--output: List imported and moved resources

#​907

Follow up #​881 and #​884

https://github.com/suzuki-shunsuke/tfcmt/releases/tag/v4.5.0

https://suzuki-shunsuke.github.io/tfcmt/output-file

Fix the title by error messages

#​906

tfcmt changes the title by the result of terraform commands

Success

#### Plan Result

Failure

#### :x: Plan Failed

tfcmt evers checked only the exit code of terraform commands,
but as of tfcmt v4.5.1, tfcmt checks also if terraform commands outputs errors.

This is useful when you outputs terraform commands to a text file and runs tfcmt.

e.g.

terraform plan > plan.txt 2>&1
tfcmt plan -- cat plan.txt

Contributors

Thank you for your contribution!

#​896 @​taro-kayo

v4.5.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.4.3...v4.5.0

Features

#​880 #​881 Add moved resources to the list of changed resources
#​882 #​884 Add imported resources to the list of changed resources

Add the template variables MovedResources and ImportedResources, which is a list of imported resources.

e.g.

MovedResources:
  - Before: null_resource.foo
    After: null_resource.bar
ImportedResources:
  - github_repository.tfcmt

Add the list of moved resources and imported resources to the built in template updated_resources.

If you use the default template, you don't have to do anything because the moved resources and imported resources are added to the default template.

Others

#​855 #​862 Upgrade Go v1.20.6 to v1.21.0

v4.4.3

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.4.2...v4.4.3

Others

#​850 refactor: Replace suzuki-shunsuke/go-timeout to exec.CommandContext, Cmd.Cancel, and Cmd.WaitDelay
#​833 #​842 Update Go 1.20.1 to 1.20.6

v4.4.2

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.4.1...v4.4.2

Fixes

#​823 #​824 Fix summaries of tainted resources
#​829 #​831 Fix summaries of resources replaced by terraform's -replace options

tfcmt parses the output of terraform and outputs the list of replaced resources as the following.

* Replace
  * null_resource.foo

But tfcmt didn't parse the output of terraform well and the above list wasn't outputted properly when some resources were replaced by terraform's taint command or -replace option.

This release fixes the bug.

v4.4.1

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.4.0...v4.4.1

Fixes

#​795 Propagate the signal such as SIGINT to terraform command properly for graceful shutdown

exec.CommandContext exits a command by SIGKILL immediately, so the command can't exit gracefully. So let's use suzuki-shunsuke/go-timeout instead.
go-timeout exits a command by SIGINT gracefully.

Reference

• https://github.com/suzuki-shunsuke/go-timeout
• Japanese
  • https://songmu.jp/riji/entry/2019-06-02-gocon-timeout.html
  • https://techblog.szksh.cloud/go-timeout/

Test

hello.sh

#!/usr/bin/env bash

set -eu
set -o pipefail

trap 'echo trapped.' 2

sleep 60

AS IS

$ tfcmt -v     
tfcmt version 4.4.0 (5e9bc7fece716d7e892b273c1a7a2103273a7f9c)

$ tfcmt plan -- bash hello.sh
^CERRO[0002] remove labels                                 error="context canceled" program=tfcmt
context canceled

echo trapped. isn't executed.

TO BE

$ tfcmt plan -- bash hello.sh              
^Ctrapped.
ERRO[0001] remove labels                                 error="context canceled" program=tfcmt
context canceled

echo trapped. is executed.

v4.4.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.3.0...v4.4.0

Features

#​773 #​774 Support skipping the post of a comment if the result of terraform plan has no change

https://suzuki-shunsuke.github.io/tfcmt/skip-no-changes

You can skip posting a comment if there is no change using the command line option -skip-no-changes or configuration field disable_comment.

e.g.

$ tfcmt plan -skip-no-changes -- terraform plan

tfcmt.yaml

terraform:
  plan:
    when_no_changes:
      disable_comment: true

If the option is set, tfcmt plan adds or updates a pull request label but doesn't post a comment if the result of terraform plan has no change and no warning.

Even if there are no comment, the pull request label lets you know the result.
This feature is useful when you want to keep pull request comments clean.

v4.3.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.2.0...v4.3.0

Features

• TFCMT_REPO_OWNER
• TFCMT_REPO_NAME
• TFCMT_SHA
• TFCMT_PR_NUMBER
• TFCMT_CONFIG
• TFCMT_VAR_*

v4.2.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.1.0...v4.2.0

Features

#​194 #​654 #​662 Support outputting the result to a local file @​NikitaCOEUR 🎉 New Contributor

https://suzuki-shunsuke.github.io/tfcmt/output-file

A command line option --output has been added.
If this option is set, tfcmt outputs the result to a local file instead of posting a comment to GitHub pull request.

tfcmt plan:

$ tfcmt --output plan.md plan -- terraform plan

tfcmt apply:

$ tfcmt --output apply.md apply -- terraform apply

If a specified file doesn't exist, the file is created.
If the file already exist, the file content is appended.

💡 If you want to overwrite the file content instead of appending, please make the file empty before running tfcmt.

e.g.

: > plan.md # Make the file empty
tfcmt --output plan.md plan -- terraform plan

Metadata isn't embedded.

v4.1.0

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.0.1...v4.1.0

Features

#​623 #​624 Add disable_label config per result type @​dtan4

Others

#​626 Update go-github to v50

v4.0.1

Compare Source

Pull Requests | Issues | suzuki-shunsuke/tfcmt@v4.0.0...v4.0.1

Others

#​580 Release SLSA Provenance and sign checksum files by Cosign
#​580 Update Go from 1.19.1 to 1.19.4
#​581 Update go-github from v43 to v49

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.