Allow checkout of a different repository and ref in plan/apply

.github/workflows/apply.yml

@@ -21,6 +21,14 @@ on:
       environment:
         required: true
         type: string
+      github_repository_to_checkout:
+        description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code."
+        default: ${{ github.repository }}
+        type: string
+      ref:
+        description: "Git reference (branch, tag or SHA) to check out. Defaults to the default branch of the checked-out repository."
+        default: ""
+        type: string
       tf_vars:
         description: "Extra environment variables, one KEY=VALUE per line, exported before plan/apply. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only."
         default: ""
@@ -64,6 +72,8 @@ jobs:
       tf_version: ${{ inputs.tf_version }}
       environment: ${{ inputs.environment }}
       tf_apply: true
+      github_repository_to_checkout: ${{ inputs.github_repository_to_checkout }}
+      ref: ${{ inputs.ref }}
       tf_vars: ${{ inputs.tf_vars }}
       kosli_template_file: ${{ inputs.kosli_template_file }}
       kosli_host: ${{ inputs.kosli_host }}
@@ -89,6 +99,9 @@ jobs:
       GH_TOKEN: ${{ secrets.kosli_github_token }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ inputs.github_repository_to_checkout }}
+          ref: ${{ inputs.ref }}
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0

.github/workflows/base.yml

@@ -27,6 +27,10 @@ on:
       ref:
         default: ""
         type: string
+      github_repository_to_checkout:
+        description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code."
+        default: ${{ github.repository }}
+        type: string
       tf_vars:
         description: "Extra environment variables, one KEY=VALUE per line, exported before plan/apply. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only."
         default: ""
@@ -76,6 +80,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          repository: ${{ inputs.github_repository_to_checkout }}
           ref: ${{ inputs.ref }}
 
       - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0

.github/workflows/plan.yml

@@ -21,6 +21,14 @@ on:
       environment:
         required: true
         type: string
+      github_repository_to_checkout:
+        description: "GitHub repository (owner/name) to check out. Defaults to the repository that initiated the run. Override when a workflow in one repository needs to operate on a different repository's Terraform code."
+        default: ${{ github.repository }}
+        type: string
+      ref:
+        description: "Git reference (branch, tag or SHA) to check out. Defaults to the default branch of the checked-out repository."
+        default: ""
+        type: string
       tf_vars:
         description: "Extra environment variables, one KEY=VALUE per line, exported before plan. To set Terraform variable `foo`, use `TF_VAR_foo=...`. Single-line values only."
         default: ""
@@ -57,6 +65,8 @@ jobs:
       tf_version: ${{ inputs.tf_version }}
       environment: ${{ inputs.environment }}
       tf_apply: false
+      github_repository_to_checkout: ${{ inputs.github_repository_to_checkout }}
+      ref: ${{ inputs.ref }}
       tf_vars: ${{ inputs.tf_vars }}
       kosli_template_file: ${{ inputs.kosli_template_file }}
       kosli_host: ${{ inputs.kosli_host }}