From 9f8c3ab6ff6a19debaeca69d71dc1d312d007ac1 Mon Sep 17 00:00:00 2001 From: Graham Savage Date: Thu, 25 Jun 2026 09:54:03 +0100 Subject: [PATCH 1/3] Allow checkout of a different repository in base/plan/apply The base workflow checks out the repository that initiated the run. This works for Kosli, where each repository calls the workflow for its own Terraform code, but breaks for orchestrators such as the CyberDojo production deployment system, where a single repository iterates over several repositories and runs apply.yml for each. Add an optional github_repository_to_checkout input to the base, plan and apply workflows, defaulting to ${{ github.repository }} so existing callers are unaffected. Callers can now point the checkout at a specific repository. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/apply.yml | 5 +++++ .github/workflows/base.yml | 5 +++++ .github/workflows/plan.yml | 5 +++++ 3 files changed, 15 insertions(+) diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml index 33a34bc..9cfd180 100644 --- a/.github/workflows/apply.yml +++ b/.github/workflows/apply.yml @@ -21,6 +21,10 @@ on: environment: required: true type: string + github_repository_to_checkout: + description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code." + default: ${{ github.repository }} + type: string tf_vars: description: "Extra environment variables, one KEY=VALUE per line, exported before plan/apply. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only." default: "" @@ -64,6 +68,7 @@ jobs: tf_version: ${{ inputs.tf_version }} environment: ${{ inputs.environment }} tf_apply: true + github_repository_to_checkout: ${{ inputs.github_repository_to_checkout }} tf_vars: ${{ inputs.tf_vars }} kosli_template_file: ${{ inputs.kosli_template_file }} kosli_host: ${{ inputs.kosli_host }} diff --git a/.github/workflows/base.yml b/.github/workflows/base.yml index 507b163..f6e72c0 100644 --- a/.github/workflows/base.yml +++ b/.github/workflows/base.yml @@ -27,6 +27,10 @@ on: ref: default: "" type: string + github_repository_to_checkout: + description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code." + default: ${{ github.repository }} + type: string tf_vars: description: "Extra environment variables, one KEY=VALUE per line, exported before plan/apply. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only." default: "" @@ -76,6 +80,7 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: + repository: ${{ inputs.github_repository_to_checkout }} ref: ${{ inputs.ref }} - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0 diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml index 6c4ae96..1799f2f 100644 --- a/.github/workflows/plan.yml +++ b/.github/workflows/plan.yml @@ -21,6 +21,10 @@ on: environment: required: true type: string + github_repository_to_checkout: + description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code." + default: ${{ github.repository }} + type: string tf_vars: description: "Extra environment variables, one KEY=VALUE per line, exported before plan. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only." default: "" @@ -57,6 +61,7 @@ jobs: tf_version: ${{ inputs.tf_version }} environment: ${{ inputs.environment }} tf_apply: false + github_repository_to_checkout: ${{ inputs.github_repository_to_checkout }} tf_vars: ${{ inputs.tf_vars }} kosli_template_file: ${{ inputs.kosli_template_file }} kosli_host: ${{ inputs.kosli_host }} From 9e5992dd509f4d7a8e2a8e1b688792a241645bac Mon Sep 17 00:00:00 2001 From: Graham Savage Date: Thu, 25 Jun 2026 10:01:36 +0100 Subject: [PATCH 2/3] Check out the target repository in reset-drift-detection too The reset-drift-detection job's checkout previously always used the repository that initiated the run. The Kosli attest steps in this job read the local git repository for commit metadata, so for an orchestrator such as the CyberDojo production deployment system the attestations would have referenced the orchestrator's commit rather than the target repository's. Make this checkout honour github_repository_to_checkout, matching the checkout in base.yml, so the attestations reference the repository that was actually applied. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/apply.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml index 9cfd180..07c0244 100644 --- a/.github/workflows/apply.yml +++ b/.github/workflows/apply.yml @@ -94,6 +94,8 @@ jobs: GH_TOKEN: ${{ secrets.kosli_github_token }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: ${{ inputs.github_repository_to_checkout }} - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0 From 3fdc00346713f1fd1fa5aac67c0493509795d87f Mon Sep 17 00:00:00 2001 From: Graham Savage Date: Thu, 25 Jun 2026 10:07:15 +0100 Subject: [PATCH 3/3] Expose ref input on the plan and apply workflows The base workflow already accepts a ref input to check out a specific git reference, but the plan and apply workflows neither exposed nor forwarded it, so callers had no way to reach it. Add a ref input to both workflows and pass it through to base.yml. Also apply it to the reset-drift-detection checkout so its Kosli attestations reference the same git reference that was applied. This lets an orchestrator such as the CyberDojo production deployment system pin a deployment to a specific git tag or SHA. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/apply.yml | 6 ++++++ .github/workflows/plan.yml | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml index 07c0244..2c5c92e 100644 --- a/.github/workflows/apply.yml +++ b/.github/workflows/apply.yml @@ -25,6 +25,10 @@ on: description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code." default: ${{ github.repository }} type: string + ref: + description: "Git reference (branch, tag or SHA) to check out. Defaults to the default branch of the checked-out repository." + default: "" + type: string tf_vars: description: "Extra environment variables, one KEY=VALUE per line, exported before plan/apply. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only." default: "" @@ -69,6 +73,7 @@ jobs: environment: ${{ inputs.environment }} tf_apply: true github_repository_to_checkout: ${{ inputs.github_repository_to_checkout }} + ref: ${{ inputs.ref }} tf_vars: ${{ inputs.tf_vars }} kosli_template_file: ${{ inputs.kosli_template_file }} kosli_host: ${{ inputs.kosli_host }} @@ -96,6 +101,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: ${{ inputs.github_repository_to_checkout }} + ref: ${{ inputs.ref }} - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0 diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml index 1799f2f..d0afe35 100644 --- a/.github/workflows/plan.yml +++ b/.github/workflows/plan.yml @@ -25,6 +25,10 @@ on: description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code." default: ${{ github.repository }} type: string + ref: + description: "Git reference (branch, tag or SHA) to check out. Defaults to the default branch of the checked-out repository." + default: "" + type: string tf_vars: description: "Extra environment variables, one KEY=VALUE per line, exported before plan. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only." default: "" @@ -62,6 +66,7 @@ jobs: environment: ${{ inputs.environment }} tf_apply: false github_repository_to_checkout: ${{ inputs.github_repository_to_checkout }} + ref: ${{ inputs.ref }} tf_vars: ${{ inputs.tf_vars }} kosli_template_file: ${{ inputs.kosli_template_file }} kosli_host: ${{ inputs.kosli_host }}