From aad98acdbc98f60b686065dd33815101c8e6568c Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Fri, 16 Oct 2026 13:45:23 -0400 Subject: [PATCH] NO-ISSUE: Re-enable apply on the new tofu state bucket The MOC-hosted osac-terraform-state bucket was removed, so every apply failed at tofu init with NoSuchBucket, and #245 disabled the scheduled and push-triggered runs. The state now lives in a new osac-terraform-state bucket (us-east-1, versioned, private) in an OSAC-controlled AWS account. It was restored from the export of the last state (serial 1790), and the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY secrets now hold a key for an IAM user scoped to that bucket. - Restore the schedule and push triggers removed by #245. - Enable native S3 state locking (use_lockfile) and require OpenTofu >= 1.10, which introduced it. - Update the README to describe the new state location. Assisted-by: Claude Code (Claude Opus 5.5) Signed-off-by: Elior Erez --- .github/workflows/apply.yaml | 8 ++++++++ README.md | 4 +--- backend.tf | 1 + versions.tf | 2 +- 4 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/apply.yaml b/.github/workflows/apply.yaml index 73448df..e1b5be9 100644 --- a/.github/workflows/apply.yaml +++ b/.github/workflows/apply.yaml @@ -19,6 +19,14 @@ on: description: "One-time: comma-separated Terraform resource addresses to exclude from this apply (e.g. a resource that's known-broken and blocking every other pending change atomically, while a permanent fix is prepared). Leave empty for a normal apply." required: false default: "" + schedule: + - cron: "17 */4 * * *" + push: + paths: + - "**/*.tf" + - "**/*.csv" + branches: + - main concurrency: # This workflow has no pull_request trigger, so github.event.pull_request.number diff --git a/README.md b/README.md index d13c0a2..5643eb9 100644 --- a/README.md +++ b/README.md @@ -89,14 +89,12 @@ In general, you won't need to do this: the configuration is applied when a pull 1. Acquire S3 credentials. - OpenTofu maintains state information about the target infrastructure; you need this state in order to plan and apply the configuration. We store this information in an S3 bucket provided by the [NERC]. You need appropriate AWS credentials in order for OpenTofu to access the cached state. These should be provided in the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables. + OpenTofu maintains state information about the target infrastructure; you need this state in order to plan and apply the configuration. We store this information in the `osac-terraform-state` S3 bucket (`us-east-1`) in an OSAC-controlled AWS account. The bucket is versioned, and OpenTofu takes a lock on the state (`osac.tfstate.tflock`) while it plans or applies. You need appropriate AWS credentials in order for OpenTofu to access the cached state. These should be provided in the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables. 1. Acquire GitHub credentials. In order to apply the configuration, OpenTofu needs administrative access to our organization. You will need a token with at least `admin:org` and `repo` privileges for the `osac-project` organization. This should be provided in the `GITHUB_TOKEN` environment variable. -[nerc]: https://nerc.mghpcc.org/ - ## Additional documentation - OpenTofu [introductory documentation](https://opentofu.org/docs/intro/). diff --git a/backend.tf b/backend.tf index 5e5c43f..5b6f1d8 100644 --- a/backend.tf +++ b/backend.tf @@ -9,5 +9,6 @@ terraform { skip_metadata_api_check = true skip_region_validation = true use_path_style = true + use_lockfile = true } } diff --git a/versions.tf b/versions.tf index f39d64f..b818412 100644 --- a/versions.tf +++ b/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = ">= 1.9.0" + required_version = ">= 1.10.0" required_providers { github = { source = "integrations/github"