fix(scripts): exit 0 for plan changes so Make deps aren't broken; synthesize exit in tf-all.sh

Author: adityataps

.github/workflows/terraform-drift.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Detect Drift
         run: |
           set +e
-          make ci-plan CMD=plan
+          scripts/tf-all.sh plan ci-plan
           EXIT=$?
           set -e
           if [[ $EXIT -eq 2 ]]; then

scripts/tf-all.sh

@@ -1,36 +1,43 @@
 #!/usr/bin/env bash
-# Usage: scripts/tf-all.sh <plan|apply> [--auto-approve]
+# Usage: scripts/tf-all.sh <plan|apply> [--auto-approve|<make-target>]
 #
-#   plan                   Preview changes across all modules in dependency order
-#   apply                  Apply changes, prompting per module
-#   apply --auto-approve   Apply all changes without prompting
+#   plan                   Preview all modules (make target: all)
+#   plan ci-plan           Preview CI-scoped modules only (make target: ci-plan)
+#   apply                  Apply all modules, prompting per module
+#   apply --auto-approve   Apply all modules without prompting
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-TOTAL_MODULES=15  # keep in sync with number of targets called in Makefile `all` chain
 
 # ── Parse args ────────────────────────────────────────────────────────────────
 CMD="${1:-}"
 AUTO_APPROVE=0
+MAKE_TARGET="all"
 
 if [[ "$CMD" == "apply" && "${2:-}" == "--auto-approve" ]]; then
   AUTO_APPROVE=1
+elif [[ "$CMD" == "plan" && -n "${2:-}" ]]; then
+  MAKE_TARGET="${2}"
 fi
 
 if [[ "$CMD" != "plan" && "$CMD" != "apply" ]]; then
-  echo "Usage: $0 <plan|apply> [--auto-approve]"
+  echo "Usage: $0 <plan|apply> [--auto-approve|<make-target>]"
   echo ""
-  echo "  plan                   Preview changes across all modules"
-  echo "  apply                  Apply changes, prompting per module"
-  echo "  apply --auto-approve   Apply all changes without prompting"
+  echo "  plan                   Preview all modules"
+  echo "  plan ci-plan           Preview CI-scoped modules only"
+  echo "  apply                  Apply all modules, prompting per module"
+  echo "  apply --auto-approve   Apply all modules without prompting"
   exit 1
 fi
 
 # ── Progress tracking ─────────────────────────────────────────────────────────
 PROGRESS_DIR=$(mktemp -d /tmp/tf-progress.XXXXXX)
 trap 'rm -rf "$PROGRESS_DIR"' EXIT
 
-printf '0'              > "$PROGRESS_DIR/counter"
+# Derive total dynamically so it stays correct for any make target
+TOTAL_MODULES=$(make --dry-run "$MAKE_TARGET" CMD=plan 2>/dev/null | grep -c 'tf-module\.sh' || echo 0)
+
+printf '0'                   > "$PROGRESS_DIR/counter"
 printf '%s' "$TOTAL_MODULES" > "$PROGRESS_DIR/total"
 touch "$PROGRESS_DIR/results"
 
@@ -39,17 +46,30 @@ export TF_PROGRESS_DIR="$PROGRESS_DIR"
 # ── Run ───────────────────────────────────────────────────────────────────────
 cd "$REPO_ROOT"
 set +e
-# -k (keep going) in plan mode: continue past individual module failures so all
-# modules are planned and the summary shows the full picture. Apply mode stays
+# -k (keep going) in plan mode: tf-module.sh exits 0 for "changes detected" so
+# Make prerequisites are never broken by pending diffs. Apply mode stays
 # fail-fast — downstream modules depend on upstream state being applied first.
 if [[ "$CMD" == "plan" ]]; then
-  make -k all CMD="$CMD" AUTO_APPROVE="$AUTO_APPROVE"
+  make -k "$MAKE_TARGET" CMD="$CMD" AUTO_APPROVE="$AUTO_APPROVE"
 else
-  make all CMD="$CMD" AUTO_APPROVE="$AUTO_APPROVE"
+  make "$MAKE_TARGET" CMD="$CMD" AUTO_APPROVE="$AUTO_APPROVE"
 fi
 MAKE_EXIT=$?
 set -e
 
+# ── Synthesize exit from results (plan mode only) ─────────────────────────────
+# tf-module.sh exits 0 for both clean and drift to keep Make deps intact.
+# Re-derive the correct signal here: 1=error, 2=drift, 0=all clean.
+if [[ "$CMD" == "plan" ]]; then
+  if grep -q '^✗' "$PROGRESS_DIR/results" 2>/dev/null; then
+    MAKE_EXIT=1
+  elif grep -q '^~' "$PROGRESS_DIR/results" 2>/dev/null; then
+    MAKE_EXIT=2
+  else
+    MAKE_EXIT=0
+  fi
+fi
+
 # ── Summary ───────────────────────────────────────────────────────────────────
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

scripts/tf-module.sh

@@ -63,7 +63,11 @@ if [[ "$CMD" == "plan" ]]; then
       1) echo "✗ error      $MODULE" >> "$PROGRESS_DIR/results" ;;
     esac
   fi
-  exit $PLAN_EXIT
+  # Exit 0 for both "no changes" (0) and "changes detected" (2) so Make does not
+  # treat a module with pending changes as a failed prerequisite — that would skip
+  # all downstream modules. tf-all.sh synthesizes the real exit from the results
+  # file. Only exit 1 on actual Terraform errors.
+  [[ $PLAN_EXIT -eq 1 ]] && exit 1 || exit 0
 fi
 
 # ── Apply ─────────────────────────────────────────────────────────────────────