Add protected Terraform provisioning workflows #85
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!85
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/terraform-delivery"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add protected Terraform provisioning for external-service prerequisites, with Gitchistry dev as the first independently constrained stack. The owning callers are in terraform-modules#2.
The workflow supports public OIDC claim inspection, private/versioned/SSE-S3 state-bucket bootstrap with encrypted probe readback, and separate OpenBao plan/apply identities. Apply requires the reviewed source commit and semantic plan fingerprint, rejects deletion/replacement and unexpected resources, and verifies convergence, dev object access and runtime secret consistency. Raw state, plans and provider diagnostics stay private; emergency backend state is preserved in OpenBao where possible.
CLI downloads use a TLS-verifying HTTPS-only handler chain for the fixed HashiCorp origin, strict numeric versions, no redirects, bounded archives and checksum verification before extraction. S3 XML uses hash-locked defusedxml with DTDs/entities/external references rejected. The protected workflow installs its small pinned Python runtime in a job-local environment. No scan suppressions or mitigations were added.
Release dependency: publish proposed immutable v1.33.0 after review and merge. Published v1.32.0 contains dev delivery/cleanup and does not contain Terraform provisioning. This branch includes that released main baseline. All three companion shared callers (source security, state bootstrap and dev provisioning) pin v1.33.0 with matching uses/library_ref; their security/provisioning operations must wait for publication.
Validation: 58 local Terraform, credential and Forgejo contract tests passed, including TLS/checksum verification, URL injection, redirect refusal and malicious XML rejection for every parsed S3 field. Across the library and companion repository, all 24 workflow YAML files and 67 shell bodies passed checks, and all three shared caller pins match. Hosted security checks must verify the new head. No live credentials, resource APIs, real plan/apply or local container builds were used.
First use remains blocked on key-manager/state setup, exact OIDC roles/scoped credentials and verified bounded own-parent AIStor key authorization. The owner confirmed state storage and KMS are not set up. This PR does not activate shared-service encryption or deploy Harbor. Tracking: terraform-modules#1.
Companion module and owning workflow callers are ready in terraform-modules#2. Those provisioning callers pin the proposed v1.32.0 release and remain blocked until this library change is reviewed, merged and released.
Commit
0dd9297f89strengthens initial state bootstrap: after checking encryption/version metadata and conditional writes, it reads the encrypted probe back and requires an exact match. Three new credential-free tests cover a missing bucket, absent KMS and unreadable/corrupt probe data. All 43 Terraform/workflow credential tests pass locally; diff checks pass. The owner confirmed no state bucket or AIStor KMS is configured. Key-manager installation/recovery must be reviewed separately before this bucket workflow runs; the first-time guide records the order and shared-server impact. No live provisioning was dispatched.Release collision addressed in
f58780a9e4: merged the published v1.32.0 main baseline, changed the proposed Terraform release to v1.33.0 and updated the explicit Terraform runner contract. Companion terraform-modules commit 6e3c2c68ef903ccb629fea1b05db16ffb759d130 updates both uses/library_ref pairs and setup docs in PR #2. Both PR descriptions now distinguish published v1.32.0 from proposed v1.33.0. Validation: 76 local targeted tests passed, all 24 workflow YAML files parse, caller pins match and diff checks pass. No release was republished or provisioning dispatched.Resolve semgrep findings.
Addressed the Semgrep change request in
5a8d3df6a8.python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detectedinpipeline/terraform_delivery.py: the CLI downloader now installs only a TLS-verifying HTTPS handler for the fixed HashiCorp origin, accepts only numeric release versions, refuses redirects/other schemes, bounds the archive and verifies the pinned checksum before extraction.python.lang.security.use-defused-xml.use-defused-xmlinpipeline/terraform_s3.py: every S3 XML response now uses hash-locked defusedxml with DTDs, entities and external references forbidden. The protected workflow installs its small pinned runtime in a job-local environment.Validation: 58 local Terraform/credential/Forgejo contract tests passed. New regressions exercise trusted TLS, checksum rejection before extraction, URL injection, all five redirect statuses to file/HTTP/foreign HTTPS destinations, and malicious XML in every parsed S3 field. All 24 workflow YAML files and 67 shell bodies across the library/caller repositories passed syntax checks. No scan suppressions or mitigations were added. Hosted security checks must confirm the new head; no live provisioning was run.
The companion Terraform PR now pins source security, bootstrap and provisioning uniformly to proposed v1.33.0. That release must be published before its security caller can run.