Support resolving terraform version from config

[dkirrane]

I'm looking for a feature similar to actions/setup-go@v5 https://github.com/actions/setup-go?tab=readme-ov-file#getting-go-version-from-the-gomod-file

If we could pass a terraform-version-file that takes a path to a .tf file containing the terraform block with required_version e.g.

versions.tf

terraform {
  required_version = "1.3.6"
}

action

uses: hashicorp/setup-terraform@v3
with:
    terraform-version-file: 'path/to/versions.tf'

Or better still just automatically find the .tf file with required_version config

[vsamofal]

I do use this action to get a version dflook/terraform-version@v1 (cool to have it built in, but at least some workaround)

[guitarrapc]

FYI, I've written bash 1 liner to retrieve required_version and use it with setup-terraform. If you are using simple version string, "= 1.8.4" and ~> 1.8.0, it works fine. Complex versioning is out of scope.

https://gist.github.com/guitarrapc/371018c583e409990daba76df7f062f5

[antm-pp]

I don't think this does work as the true terraform required_version block is not semver (which setup_terraform uses)

required_version = "~> 1.8"

In terraform init that's read as only allow changes to rightmost value, so in current builds 1.9.3 etc would be valid. Things like tfswitch read it the same way as terraform and pull the correct version.

In setup_terraform this gets read as semver allow any patch value not exceeding 1.8 eg 1.8.5 and not 1.9.x. Therefore you will get inconsistent results.

Not sure if that's what was meant about the 'complex versioning' limitation in the above comment. But really these things should all work consistently.

[viktor-kanavchenko]

Here is my solution based on @guitarrapc :

run: |
    test -f versions.tf || { echo ERROR: versions.tf not found ; exit 1 ; }
    version=$(\
        grep -E 'required_version\s*=\s*"([^"]+)"' versions.tf \
        | sed -n 's/\s*required_version[[:space:]]*=[[:space:]]*\(".*"\)/\1/p' \
        | sed -e 's/v//g;s/[[:space:]]//g' \
        | sed -e '/~/s/"~>[[:space:]]*\(.*\)"/~\1/')
    echo "value=${version}" | tee -a "${GITHUB_OUTPUT}"

[briceburg]

I had similar issues and fixed with dflook/terraform-version, although didn't like the additional overhead of the action installing [latest] terraform in order to parse constraints. after all, we want to use the setup-terraform action to install terraform.

In the end I used the following workaround, which uses hcl2json to parse *.tf files for the terraform.required_versions block.

version=$(hcl2json *.tf | jq -r '.terraform.[].required_version // empty' | head -n1)

real-world usage in workflow that calls hashicorp/setup-terraform may look something like:

- name: Install hcl2json
  uses: jcwillox/install-tool-action@4508932aee1fa35c9773d72710e884ea37c81a23 # v1.1.0
  with:
    repo: tmccombs/hcl2json
    download_url: /releases/download/{{version}}/hcl2json_{{os}}_{{arch}}
    download_name: hcl2json
    version: v0.6.5

- name: Discovery
  id: discovery
  working-directory: path/to/terraform/project
  env:
    DEFAULT_VERSION: "1.11.4"
  run: |
    # version discovery
    version=$(hcl2json *.tf | jq -r 'try (.terraform | map(.required_version // empty)[0]) // empty')
    if [ -n "$version" ]; then
      echo "determined terraform version from terraform.required_version block"
    elif [ -e .terraform-version ]; then
      version=$(cat .terraform-version)
      echo "determined terraform version from .terraform-version file"
    else
       version="$DEFAULT_VERSION"
       echo "::warning::Using default version. Please add a terraform.required_version block (preferred) or a .terraform-version file."; 
    fi
    echo "version=$version" | tee -a "$GITHUB_OUTPUT"

- name: Install Terraform
  uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
  with:
    terraform_version: ${{ steps.discovery.outputs.version }}
    ...

as an aside -- it would be super helpful if this action had an output for the installed version. this way we would know what our constraint resolved to (when version is passed as a constraint, e.g. ~> 1.11.0).

right now I call terraform-version=$(terraform version -json | jq -r '.terraform_version') downstream to figure it out. maybe worth a PR...