如何用单个GitHub Actions流水线批量应用多Terraform资源（各带独立状态文件）

核心逻辑 #

• 自动识别PR或合并提交中变更的Terraform项目目录
• 对每个变更目录独立执行Terraform操作（init/plan/apply）
• 利用GitHub Actions的矩阵策略批量处理多个项目

1. PR触发的Terraform Plan流水线 #

当用户提交PR时，自动对所有变更的Terraform项目生成执行计划：

name: Terraform Multi-Project Plan
on:
  pull_request:
    paths:
      - '**/*.tf'
      - '**/*.tfvars'

jobs:
  detect-changed-projects:
    runs-on: ubuntu-latest
    outputs:
      project_dirs: ${{ steps.changed-files.outputs.all_changed_files | dirname | uniq | join(',') }}
    steps:
      - uses: actions/checkout@v4
      - name: 提取变更的Terraform项目目录
        id: changed-files
        uses: tj-actions/changed-files@v41
        with:
          files: |
            **/*.tf
            **/*.tfvars
          dir_names: true
          dir_names_max_depth: 2 # 匹配user-projectX/projectY的目录层级

  terraform-plan:
    needs: detect-changed-projects
    runs-on: ubuntu-latest
    strategy:
      matrix:
        project_dir: ${{ fromJson('["' + replace(needs.detect-changed-projects.outputs.project_dirs, ',', '","') + '"]') }}
    steps:
      - uses: actions/checkout@v4
      - name: 安装Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.0 # 替换为你使用的Terraform版本

      - name: Terraform初始化
        working-directory: ${{ matrix.project_dir }}
        run: terraform init -backend-config=backend.tf # 根据你的后端配置调整参数

      - name: 验证Terraform配置
        working-directory: ${{ matrix.project_dir }}
        run: terraform validate

      - name: 生成执行计划
        working-directory: ${{ matrix.project_dir }}
        run: terraform plan -var-file=variables.tfvars -out=tfplan
        env:
          GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }} # 你的GCP服务账号凭据

      - name: 上传计划文件
        uses: actions/upload-artifact@v3
        with:
          name: tfplan-${{ matrix.project_dir }}
          path: ${{ matrix.project_dir }}/tfplan

2. 合并后触发的Terraform Apply流水线 #

当PR合并到主分支后，批量执行所有变更项目的计划：

name: Terraform Multi-Project Apply
on:
  push:
    branches:
      - main # 替换为你的主分支名称
    paths:
      - '**/*.tf'
      - '**/*.tfvars'

jobs:
  detect-changed-projects:
    runs-on: ubuntu-latest
    outputs:
      project_dirs: ${{ steps.changed-files.outputs.all_changed_files | dirname | uniq | join(',') }}
    steps:
      - uses: actions/checkout@v4
      - name: 提取变更的Terraform项目目录
        id: changed-files
        uses: tj-actions/changed-files@v41
        with:
          files: |
            **/*.tf
            **/*.tfvars
          dir_names: true
          dir_names_max_depth: 2

  terraform-apply:
    needs: detect-changed-projects
    runs-on: ubuntu-latest
    strategy:
      matrix:
        project_dir: ${{ fromJson('["' + replace(needs.detect-changed-projects.outputs.project_dirs, ',', '","') + '"]') }}
    steps:
      - uses: actions/checkout@v4
      - name: 安装Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.0

      - name: Terraform初始化
        working-directory: ${{ matrix.project_dir }}
        run: terraform init -backend-config=backend.tf

      - name: 下载计划文件
        uses: actions/download-artifact@v3
        with:
          name: tfplan-${{ matrix.project_dir }}
          path: ${{ matrix.project_dir }}

      - name: 执行Terraform Apply
        working-directory: ${{ matrix.project_dir }}
        run: terraform apply tfplan
        env:
          GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}

关键说明 #

• 变更检测：通过tj-actions/changed-files工具筛选出所有修改过tf/tfvars文件的项目目录，自动排除未变更的项目，避免无效操作。
• 独立状态管理：每个项目的backend.tf配置独立的远程状态文件，确保各项目状态互不干扰。
• 计划一致性：PR阶段生成的tfplan文件会作为制品保存，合并后直接使用该文件执行Apply，保证Plan和Apply的操作完全一致。
• 批量处理：利用GitHub Actions的矩阵策略，并行处理多个变更项目，提升流水线效率。

内容的提问来源于stack exchange，提问作者researcher9