GitHub Actions添加if表达式后验证失败求助

问题原因分析 #

触发的搜索权限错误，主要源于两个问题：

1. if条件语法错误：你配置的job级if条件末尾多了一个闭合大括号}，导致工作流上下文解析异常，间接引发后续权限验证问题。
2. 权限不足：当前工作流的permissions仅配置了contents:read和pull-requests:write，而hashicorp/terraform-cdk-action在执行计划并同步结果到PR时，需要调用GitHub搜索API，缺少search:read权限会触发该错误。

修复步骤 #

1. 修正if条件语法 #

移除job的if条件中多余的大括号，正确条件如下：

if: ${{ github.event.issue.pull_request && (github.event.comment.body == 'cdktf diff' || github.event.comment.body == 'cdktf deploy') }}

2. 补充搜索权限 #

在工作流的permissions块中添加search:read权限，确保Action能正常调用搜索API：

permissions:
  contents: read
  pull-requests: write
  search: read  # 新增该权限

3. 完整修复后的工作流配置 #

name: "Comment a CDKTF Command on a PR"

# Controls when the workflow will run
on:
  workflow_dispatch:
  issue_comment:
    types: [ created ]
  
# Allows GHA to read comment and write terraform plan output on PR  
permissions:
  contents: read
  pull-requests: write
  search: read  

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  cdktf_diff:
    if: ${{ github.event.issue.pull_request && (github.event.comment.body == 'cdktf diff' || github.event.comment.body == 'cdktf deploy') }}
    name: "Terraform CDK Diff"
    runs-on: size/medium
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Setup Java
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: "16"

      - name: Generate module and provider bindings
        run: |
            cd postgres-rds-cdktf
            npx cdktf-cli get --language java
      - name: Run Terraform CDK Plan
        uses: hashicorp/terraform-cdk-action@v0.1.0
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        with:
          terraformVersion: 1.4.5
          cdktfVersion: 0.15.5
          mode: plan-only
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          workingDirectory: postgres-rds-cdktf

验证方法 #

在PR下评论cdktf diff或cdktf deploy，触发工作流后检查是否正常执行Terraform plan并将结果评论到PR中，确认错误不再出现。

内容的提问来源于stack exchange，提问作者Shridutt Kothari