[Arjunmehta312]

What was broken

addCredentials() in lib/setup-terraform.js used fs.writeFile() to write the credentials block, overwriting any pre-existing Terraform CLI configuration file (~/.terraformrc, %APPDATA%/terraform.rc, or the path set via TF_CLI_CONFIG_FILE). Existing plugin_cache_dir, provider mirrors, other credentials blocks, and any other user configuration were silently destroyed.

See #428 and #269.

What changed

• The existing config file is read before writing.
• Only ENOENT is treated as "file does not exist"; all other read errors are propagated.
• If a credentials block for the requested hostname already exists, the file is left untouched. This is intentionally add-if-absent semantics: the action never rotates or replaces an existing token.
• If the file exists without a block for that hostname, all existing content is preserved byte-for-byte and the credentials block is appended.
• If the file does not exist, behavior is identical to before.
• No HCL parsing, no regex rewriting, no new dependencies, no input changes.

Validation

• npm test (semistandard + jest): 21/21 passing
• 4 new tests: fresh file (exact output), different hostname (entire config preserved as prefix), same hostname (untouched, no duplicate), TF_CLI_CONFIG_FILE override
• npm run build; dist/index.js regenerated (required by check-dist)
• Changelog fragment added under .changes/unreleased/

Note

If credentials for the same hostname already exist, the supplied token is not applied; delete the block/file to re-provision credentials.

[hashicorp-cla-app]

All committers have signed the CLA.

[Arjunmehta312]

Hi @rainkwan , whenever you have a chance, I’d really appreciate your review.

Thanks!