Github Action中Terraform Apply未触发审批请求问题

核心问题 #

你的terraform-apply任务被跳过，原因是触发条件if: github.event.pull_request.merged仅在PR事件中生效，但PR合并后触发的是push事件（推送到main分支），此时github.event.pull_request对象不存在，条件判断为false，导致任务被跳过。

同时要实现审批触发，需要结合GitHub环境的审批规则，确保terraform-apply运行前必须经过人工审批。

修复后的配置 #

name: Terraform CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  terraform-plan:
    runs-on: self-hosted
    env:
      ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
      ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
      ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
      ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
      ARM_ENVIRONMENT: "usgovernment"
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Add Git Bash to PATH
        run: |
          echo "C:\Program Files\Git\bin" >> $GITHUB_PATH
        shell: powershell

      - name: Disable SSL verification
        run: |
          echo "export NODE_TLS_REJECT_UNAUTHORIZED=0" >> $GITHUB_ENV
        shell: powershell

      - name: List files for debugging
        run: ls -R

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false
          terraform_version: 1.10.4

      - name: Disable SSL Verification
        run: echo "AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1" >> $GITHUB_ENV

      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          environment: AzureUSGovernment
          audience: api://AzureADTokenExchangeUSGov
          auth-type: SERVICE_PRINCIPAL

      - name: Set environment variables
        run: |
          echo "ARM_CLIENT_ID=${{ secrets.ARM_CLIENT_ID }}" >> $GITHUB_ENV
          echo "ARM_CLIENT_SECRET=${{ secrets.ARM_CLIENT_SECRET }}" >> $GITHUB_ENV
          echo "ARM_TENANT_ID=${{ secrets.ARM_TENANT_ID }}" >> $GITHUB_ENV
          echo "ARM_SUBSCRIPTION_ID=${{ secrets.ARM_SUBSCRIPTION_ID }}" >> $GITHUB_ENV

      - name: Initialize Terraform
        working-directory: ./Terraform
        run: terraform init

      - name: Plan Terraform
        working-directory: ./Terraform
        run: terraform plan -out=tfplan

      - name: Save Plan
        uses: actions/upload-artifact@v4
        with:
          name: tfplan
          path: ./Terraform/tfplan

  terraform-apply:
    runs-on: self-hosted
    needs: terraform-plan
    # 仅在推送到main分支时运行
    if: github.ref == 'refs/heads/main'
    environment: production
    env:
      ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
      ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
      ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
      ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
      ARM_ENVIRONMENT: "usgovernment"
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Add Git Bash to PATH
        run: |
          echo "C:\Program Files\Git\bin" >> $GITHUB_PATH
        shell: powershell

      - name: Disable SSL verification
        run: |
          echo "export NODE_TLS_REJECT_UNAUTHORIZED=0" >> $GITHUB_ENV
        shell: powershell

      - name: List files for debugging
        run: ls -R

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false
          terraform_version: 1.10.4

      - name: Disable SSL Verification
        run: echo "AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1" >> $GITHUB_ENV

      - uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
          environment: AzureUSGovernment
          audience: api://AzureADTokenExchangeUSGov
          auth-type: SERVICE_PRINCIPAL

      - name: Set environment variables
        run: |
          echo "ARM_CLIENT_ID=${{ secrets.ARM_CLIENT_ID }}" >> $GITHUB_ENV
          echo "ARM_CLIENT_SECRET=${{ secrets.ARM_CLIENT_SECRET }}" >> $GITHUB_ENV
          echo "ARM_TENANT_ID=${{ secrets.ARM_TENANT_ID }}" >> $GITHUB_ENV
          echo "ARM_SUBSCRIPTION_ID=${{ secrets.ARM_SUBSCRIPTION_ID }}" >> $GITHUB_ENV

      - name: Download Plan
        uses: actions/download-artifact@v4
        with:
          name: tfplan
          # 确保计划文件下载到Terraform目录，和生成时的路径一致
          path: ./Terraform

      - name: Apply Terraform
        working-directory: ./Terraform
        run: terraform apply -input=false -auto-approve tfplan

关键修改点 #

• 调整apply任务触发条件：将if: github.event.pull_request.merged改为if: github.ref == 'refs/heads/main'，确保推送到main分支时触发apply任务。
• 修复计划文件路径：在Download Plan步骤中取消注释path: ./Terraform，保证tfplan文件被下载到正确的目录，避免apply时找不到文件。
• 配置环境审批：在GitHub仓库的Settings > Environments中找到production环境，开启Required reviewers，添加需要审批的人员/团队。这样当terraform-apply任务启动时，会自动触发审批请求，只有审批通过后才会执行terraform apply。

流程说明 #

1. 提交PR到main分支：触发terraform-plan任务，生成并保存计划文件，可在PR中查看计划结果。
2. 合并PR到main分支：触发push事件，启动terraform-plan（验证合并后的代码），随后触发terraform-apply任务，但会先进入审批等待状态。
3. 审批通过后：自动执行terraform apply，将变更部署到生产环境。

内容的提问来源于stack exchange，提问作者user770022