Skip to content

feat: add optional github-token input to generate_terraform_docs workflow#967

Open
jansdhillon wants to merge 4 commits intocanonical:mainfrom
jansdhillon:fix/966-custom-token-terraform-docs
Open

feat: add optional github-token input to generate_terraform_docs workflow#967
jansdhillon wants to merge 4 commits intocanonical:mainfrom
jansdhillon:fix/966-custom-token-terraform-docs

Conversation

@jansdhillon
Copy link
Copy Markdown

@jansdhillon jansdhillon commented Mar 9, 2026

Applicable spec: #966

Overview

Adds an optional github-token input to the generate_terraform_docs workflow so callers can supply a PAT instead of the default GITHUB_TOKEN.

Rationale

GitHub prevents workflows from being triggered by commits or PRs created using GITHUB_TOKEN. This means that when terraform-docs opens or updates a PR, no CI workflows run against it. By allowing callers to pass a PAT, CI can be triggered on the resulting PR.

Workflow Changes

  • Added github-token input (type: string, default: "") to generate_terraform_docs.yaml under workflow_call.inputs.
  • Updated the Create pull request step to use ${{ inputs.github-token || secrets.GITHUB_TOKEN }}, preserving backwards compatibility.

Checklist

@jansdhillon jansdhillon requested a review from a team as a code owner March 9, 2026 17:31
@jansdhillon jansdhillon requested review from alithethird and yanksyoon and removed request for a team March 9, 2026 17:31
…flow

Adds an optional github-token input that defaults to secrets.GITHUB_TOKEN
for backwards compatibility. Callers can pass a PAT to allow CI workflows
to trigger on the resulting pull request.

Fixes canonical#966
@jansdhillon jansdhillon force-pushed the fix/966-custom-token-terraform-docs branch from f552989 to f4b2b3b Compare March 9, 2026 17:35
Comment on lines +16 to +19
github-token:
type: string
description: Token used to create the pull request. Use a PAT to allow CI to trigger on the resulting PR.
default: ""
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello! Im afraid this would lead to a secrets leak (security issue), would you try inheriting the secret instead? https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with Yanks on this.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, I've changed it to a secrets block instead

Move github-token from workflow_call inputs (string) to
workflow_call secrets to prevent potential token exposure in
workflow logs.

Fixes canonical#966
@jansdhillon jansdhillon force-pushed the fix/966-custom-token-terraform-docs branch from 202cd33 to 1bcee9a Compare March 23, 2026 03:51
@github-actions
Copy link
Copy Markdown
Contributor

Test results for commit 1bcee9a

Test coverage for 1bcee9a

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-03-23 03:51:28.457444+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

@github-actions
Copy link
Copy Markdown
Contributor

Test results for commit 1bcee9a

Test coverage for 1bcee9a

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-03-23 03:51:32.783828+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

@github-actions
Copy link
Copy Markdown
Contributor

Test results for commit 1bcee9a

Test coverage for 1bcee9a

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-03-23 03:56:11.875901+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

@alithethird alithethird requested a review from yanksyoon March 26, 2026 04:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants