Bump configure-aws… | hackforla/devops-security

首先阅读 .github/workflows/terraform-plan.yaml 和 .github/workflows/terraform-apply.yaml，通过定位相关的 uses: 行而不是依赖行号。编辑前检查路径过滤器，并与相关的 OIDC 和 checkout 工作协调。完成的标准是只有指定 action 的 pin 发生变化，无操作的 .tf 更改会生成空 plan，并且合并后的 apply 成功且没有 Node.js 20 弃用注释。

Overview

We need to bump aws-actions/configure-aws-credentials from @v4 to @v6 and dflook/terraform-plan/dflook/terraform-apply from @v1 to @v3 in both Terraform workflows, because configure-aws-credentials@v4 runs on the deprecated Node 20 and the dflook pins are four releases behind, including a fix for terraform-apply wrongly aborting on a plan that contains both imports and warnings.

Action Items

aws-actions/configure-aws-credentials — @v4 to @v6, 2 lines:

.github/workflows/terraform-plan.yaml:25 and .github/workflows/terraform-apply.yaml:25.
Go to v6, not v4-for-parity and not v5. Reading action.yml at each tag: v3 = node16, v4 = node20, v5 = node20, v6 = node24. Only v6 clears the Node 20 deprecation. This repo was previously described as the "good" state that incubator's @v3 should be brought up to — that was wrong, @v4 here is deprecated too.
Note this is the opposite call from actions/checkout in hackforla/devops#183, which deliberately stops at v5 rather than going current. The two look inconsistent and are not: for checkout an intermediate version already reaches Node 24, and for this action nothing below v6 does.

dflook/terraform-plan and dflook/terraform-apply — @v1 to @v3, 2 lines:

terraform-plan.yaml:32 (dflook/terraform-plan@v1) and terraform-apply.yaml:32 (dflook/terraform-apply@v1).
@v1 is a floating tag, so this is less stale than it looks — it resolves to v1.49.0 (2025-05-29), not the 2021 release. Latest is v3.0.0 (2026-07-18). The honest framing is four missed releases, not "two majors behind".
The Node 20 deprecation does not apply to these two. Both are Docker actions (runs: using: docker), so no JS runtime is involved. That is why going straight to current is fine here.
Checked before this ticket was written, so you do not have to: the only input removed across both majors is the deprecated var: input (v2.0.0), and neither workflow uses it — they pass only path, backend_config_file and auto_approve, all still present at v3.0.0. The real risk is the debian 11 → 12 → 13 base-image bump.

Out of scope — do not change these here:

actions/checkout@v4 at line 23 of both files belongs to hackforla/devops#183. Leave it alone. If hackforla/devops#183's devops-security PR has already merged, rebase; if it has not, whoever merges second rebases. Same two files, adjacent lines.

Verification — read this before opening the PR, it is the awkward part:

Both workflows filter on paths: ['**/*.tf'] only, so a PR that changes only .github/workflows/*.yaml triggers neither plan nor apply and shows no checks at all. That is expected, not a failure — and it means this change is not self-testing the way the equivalent incubator work (hackforla/incubator#158, hackforla/incubator#159) was.
To exercise the plan job in the same PR, include a no-op change to a .tf file (a comment line). Treat an empty plan as a hard gate: if the plan shows any resource change, stop and raise it rather than merging.
After the PR merges, terraform-apply.yaml runs a real terraform apply against AWS on push to main. Confirm that run succeeds and carries no "Node.js 20 is deprecated" annotation. This cannot be checked from the branch.

Resources/Instructions

Files (default branch is main): .github/workflows/terraform-plan.yaml, .github/workflows/terraform-apply.yaml
Line numbers accurate 2026-08-27 and will drift — locate each pin by its uses: line rather than by position.
Coordination with the OIDC work. There is an unticketed plan to move both workflows off static AWS credentials onto OIDC role assumption, which rewrites configure-aws-credentials — the very line this ticket bumps. If that work starts before this is picked up, fold this in and close this issue as covered rather than editing the same lines twice.
Related: hackforla/devops#183 (actions/checkout in the same files), hackforla/incubator#158 (same configure-aws-credentials bump, already ticketed), hackforla/incubator#159 (same dflook bump, already ticketed).

Bump configure-aws-credentials to v6 and dflook/terraform-* to v3 in the Terraform workflows

评估

调研方向

描述

Overview

Action Items

Resources/Instructions

环境准备

从这里开始

hackforla/devops-security 的其他 Issue

相似的 Issue

Bump configure-aws-credentials to v6 and dflook/terraform-* to v3 in the Terraform workflows

哪里不对？

评估

调研方向

描述

Overview

Action Items

Resources/Instructions

环境准备

从这里开始

hackforla/devops-security 的其他 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

相似的 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

把新 issue 发到你的邮箱