PR commands · tfv · Marcus Chukwuoma

Comment on a pull request to tell tfv what to do.

Plan, apply and unlock

Comment	Does
`tfv plan`	Plan every project this PR changes
`tfv plan -p <project>`	Plan one project. `-d <dir>` and `-w <workspace>` also work
`tfv plan -p <project> -t <address>`	Plan only some resources; repeat `-t` for more
`tfv plan --destroy`	Plan a destroy
`tfv plan -p <project> --replace <address>`	Plan replacing a resource
`tfv plan -p <project> --refresh-only`	Plan updating the state to match what's deployed
`tfv apply`	Apply every ready project (can be turned off, see below)
`tfv apply -p <project>`	Apply one project. The Apply button does the same
`tfv unlock`	Release this PR's locks and drop its plans

Apply always uses the saved plan, so what runs is exactly what was reviewed.

To make people apply one project at a time, set TFV_REQUIRE_APPLY_PROJECT=true (or require_apply_project: true for a repo in repos.yaml). A bare tfv apply is then refused.

Examples

tfv plan -p live/prod/vpc -t aws_subnet.private -t aws_route_table.private
tfv plan -p live/prod/app --replace aws_instance.web
tfv plan -p live/prod/app --refresh-only
tfv apply -p live/prod/vpc

Terraform commands

These run on one project (-p <project>). Each needs a permission (see rules and permissions):

Comment	Needs
`tfv validate`, `providers`, `fmt`, `state list [address]`	`plan`
`tfv state show <address>`, `show`, `output [name]`	`state_read`
`tfv import <address> <id>`, `taint <address>`, `untaint <address>`	`state_write` and approvals
`tfv state rm <address>...`, `state mv <from> <to>`, `force-unlock <lock-id>`	`state_remove` and approvals

tfv state list -p live/prod/app
tfv state show -p live/prod/app aws_instance.web
tfv output -p live/prod/app
tfv import -p live/prod/app aws_s3_bucket.logs acme-logs
tfv state mv -p live/prod/app aws_instance.web aws_instance.api

Commands that edit the state directly take the project's lock, are audited, and plan the project again. Only these commands run, and their arguments are checked, so nothing else (such as console or -chdir) can be passed through.

Turn direct state edits off for a repo with allow_state_changes: false.

How tfv answers

It reacts to a command it picked up (👀 by default). Change it with TFV_ACK_REACTION.
Each result is posted once as a new comment and never edited. With TFV_PROGRESS_REPLY=true it posts a spinning "Running…" reply instead and edits it into the result.
With TFV_COMMENT_MODE=update, plans and applies go in one comment at the top, edited in place.

See settings for all of these.