chore: post terraform plan summary as PR comment

.github/workflows/deploy.yml

@@ -183,6 +183,15 @@ jobs:
         working-directory: terraform
         run: terraform apply -lock-timeout=5m tfplan
 
+      # attach a detailed summary directly to a gh actions job. sensitive values that match repo secrets are automatically redacted
+      - name: Attach detailed summary to job
+        uses: borchero/terraform-plan-comment@2d41e908725447b1677913001dfb92fa7010c025 # v3.1.0
+        with:
+          planfile: tfplan
+          token: ${{ github.token }}
+          skip-comment: true
+          working-directory: terraform
+
   release:
     needs: deploy
     if: ${{ needs.setup.outputs.is_release =='true' }}

.github/workflows/terraform-plan.yml

@@ -8,8 +8,9 @@ on:
       - ".github/workflows/terraform-plan.yml"
 
 permissions:
-  id-token: write
   contents: read
+  id-token: write
+  pull-requests: write
 
 jobs:
   terraform-plan:
@@ -50,4 +51,28 @@ jobs:
           TF_VAR_CONTAINER_TAG: ${{ steps.get_main_sha.outputs.sha }}
           TF_VAR_DEVSECOPS_OBJECT_ID: ${{ secrets.TF_VAR_DEVSECOPS_OBJECT_ID }}
           TF_VAR_ENGINEERING_GROUP_OBJECT_ID: ${{ secrets.TF_VAR_ENGINEERING_GROUP_OBJECT_ID }}
-        run: terraform plan -lock-timeout=5m
+        run: terraform plan -out=tfplan -lock-timeout=5m
+
+      # tf-summarize generates a course-grained summary w/ no sensitive infra details
+      - name: Setup tf-summarize
+        uses: kishaningithub/setup-tf-summarize@1596bb06f9509eb36b71bc1b304407cc111059c0 #v3.0.0
+
+      - name: Create tf-summarize markdown file
+        run: tf-summarize -md tfplan >> tf-summary.md
+
+      - name: Check for existing comment
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
+        id: fc
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          comment-author: "github-actions[bot]"
+          body-includes: CHANGE
+          direction: last
+
+      - name: Create or update PR comment with course-grained plan summary
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
+        with:
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          issue-number: ${{ github.event.number }}
+          body-path: "./terraform/tf-summary.md"
+          edit-mode: replace

terraform/modules/application/outputs.tf

@@ -1,9 +1,11 @@
 output "web_principal_id" {
   description = "The Principal ID of the Benefits (web) Container App Managed Identity"
   value       = azurerm_container_app.web.identity[0].principal_id
+  sensitive   = true
 }
 
 output "pgadmin_principal_id" {
   description = "The Principal ID of the pgAdmin Container App Managed Identity"
   value       = azurerm_container_app.pgadmin.identity[0].principal_id
+  sensitive   = true
 }

terraform/output.tf

@@ -1,4 +1,5 @@
 output "outbound_ip_ranges" {
   value       = sort([for ip in azurerm_linux_web_app.main.possible_outbound_ip_address_list : "${ip}/32"])
   description = "The IP address ranges (in CIDR notation) to use to filter requests from this App Service instance, such as API calls to the Eligibility Server"
+  sensitive   = true
 }

terraform/variables.tf

@@ -5,11 +5,13 @@
 variable "DEVSECOPS_OBJECT_ID" {
   description = "Object ID for the DevSecOps principal, which includes the Production service connection"
   type        = string
+  sensitive   = true
 }
 
 variable "ENGINEERING_GROUP_OBJECT_ID" {
   description = "Object ID for the Cal-ITP engineering Active Directory Group"
   type        = string
+  sensitive   = true
 }
 
 variable "CONTAINER_REGISTRY" {