From f9f6590dfc77b106ee82e4b698cfb7e0bb986864 Mon Sep 17 00:00:00 2001 From: samuelho-dev Date: Wed, 9 Sep 2026 04:45:25 +0000 Subject: [PATCH] feat(terraform)!: accept scoped Cloudflare credentials (CTK-651) Shared Terraform workflows required an account-wide Cloudflare key and email, preventing the scoped-token cutover required by CTK-647. The new immutable interface accepts one optional cloudflare-api-token secret and exports only CLOUDFLARE_API_TOKEN. Existing SHA-pinned callers remain unchanged until their credential and provider proofs are ready. Actionlint 1.7.12 accepted both workflows and disposable token/non-Cloudflare callers. Its native workflow-call validator rejected both obsolete global-key callers. No direct @main consumers or legacy credential examples were found. No credentials or infrastructure were changed. References CTK-651 --- .github/workflows/terraform-apply.yml | 10 +++------- .github/workflows/terraform-plan.yml | 10 +++------- 2 files changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml index d0ba45c..c9dc3ea 100644 --- a/.github/workflows/terraform-apply.yml +++ b/.github/workflows/terraform-apply.yml @@ -49,11 +49,8 @@ on: aws-role-arn: description: 'IAM role ARN to assume via GitHub OIDC' required: true - cloudflare-api-key: - description: 'Cloudflare Global API Key (optional; required only when the terraform uses the Cloudflare provider)' - required: false - cloudflare-email: - description: 'Cloudflare API Email (optional; required only when the terraform uses the Cloudflare provider)' + cloudflare-api-token: + description: 'Scoped Cloudflare API token (optional; required only when Terraform uses Cloudflare)' required: false outputs: applied: @@ -74,8 +71,7 @@ jobs: run: working-directory: ${{ inputs.terraform-path }} env: - CLOUDFLARE_API_KEY: ${{ secrets.cloudflare-api-key }} - CLOUDFLARE_EMAIL: ${{ secrets.cloudflare-email }} + CLOUDFLARE_API_TOKEN: ${{ secrets.cloudflare-api-token }} outputs: applied: ${{ steps.apply.outputs.applied }} steps: diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml index 97529aa..a56f438 100644 --- a/.github/workflows/terraform-plan.yml +++ b/.github/workflows/terraform-plan.yml @@ -68,11 +68,8 @@ on: infracost-api-key: description: 'Infracost API key (only used when cost-estimation=true)' required: false - cloudflare-api-key: - description: 'Cloudflare Global API Key (optional; required only when the terraform uses the Cloudflare provider)' - required: false - cloudflare-email: - description: 'Cloudflare API Email (optional; required only when the terraform uses the Cloudflare provider)' + cloudflare-api-token: + description: 'Scoped Cloudflare API token (optional; required only when Terraform uses Cloudflare)' required: false outputs: has-changes: @@ -102,8 +99,7 @@ jobs: working-directory: ${{ inputs.terraform-path }} env: AWS_ROLE_ARN: ${{ secrets.aws-role-arn }} - CLOUDFLARE_API_KEY: ${{ secrets.cloudflare-api-key }} - CLOUDFLARE_EMAIL: ${{ secrets.cloudflare-email }} + CLOUDFLARE_API_TOKEN: ${{ secrets.cloudflare-api-token }} outputs: has-changes: ${{ steps.plan.outputs.has-changes }} destroy-count: ${{ steps.analyze.outputs.destroy-count }}