Repository navigation
chore(gha): select the CLI by binary name instead of concatenating a version - #438
Merged
jsteinich merged 2 commits intoSep 17, 2026
Conversation
…version `integration.yml` already sets TERRAFORM_BINARY_NAME from a `binary` matrix field (open-constructs#405). Every other workflow still built the name by concatenating "terraform" with a version, which makes a non-Terraform runtime impossible to express: there is no version string that turns "terraform${...}" into "tofu1.12.6". No behaviour change here - every binary resolves to exactly what it did before. This only makes the runtime nameable, so an OpenTofu entry can be added to a matrix without touching the plumbing again. - unit.yml takes `terraform_binary` in place of `terraform_version`. The version was never used as a version there, only to build the binary name and to key the concurrency group and schema cache. - provider-integration.yml keeps `terraform_version` - it is also exported as TERRAFORM_VERSION and drives setup-terraform on the windows path - and gains `terraform_binary` beside it. - pr-unit.yml and release.yml's two unit fan-outs carry the binary in the matrix. - examples.yml takes it from the matrix, which build-example-matrix.mjs now emits. Terraform and OpenTofu resolve providers from different registries into the same TF_PLUGIN_CACHE_DIR, so the provider and schema caches are keyed by binary rather than version, matching what integration.yml already does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Review catch on open-constructs#439. I expressed the release matrices as two `include` entries carrying only `terraform_binary`: package: [ ...8 packages... ] include: - terraform_binary: terraform1.16.1 - terraform_binary: terraform1.5.7 `include` objects are merged into every existing combination unless they would overwrite an *original* matrix value. `terraform_binary` is not an original key here, so both entries applied to all eight package combinations and the second overwrote the first: eight jobs, all on terraform1.5.7, with 1.16.1 silently gone from both release channels. Making it a real axis restores the 8 x 2 cross-product the terraform_version axis produced before. Nothing would have caught this: release.yml does not run on pull requests, so the job count only changes on main and release. pr-unit.yml's matrix is unaffected - it has no original axis, so each `include` entry creates its own combination, which is what pairing a version with a binary needs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
so0k
approved these changes
Sep 17, 2026
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
jsteinich
added a commit
that referenced
this pull request
Sep 17, 2026
### Related issue Closes the CI gap left by #429 / #301. **Stacked on #438** — merge that first; this branch contains its commit. ### Description #301 was a unit-level failure: the matcher fixture pinned a Docker provider version OpenTofu rejects as unsigned. #429 fixed it — but nothing in CI runs those tests under `tofu`, so it can regress silently and we would not know. One matrix entry on `affected_terraform`: ```yaml - terraform_version: "1.12.6" terraform_binary: tofu1.12.6 ``` **That is already scoped, which is why it costs one job rather than a second copy of the unit suite.** The job runs: ``` nx affected -t test --exclude='*,!tag:unit-test:terraform' ``` so it only touches the four projects tagged terraform-dependent — `cdktn`, `@cdktn/cli-core`, `@cdktn/provider-generator`, `@cdktn/provider-schema`. Those are exactly the packages whose tests shell out to a CLI; `cdktn-cli`, `hcl2cdk` and `hcl2json` invoke none and are already excluded. The provider schema cache moves from being keyed by version to by binary — tofu and terraform fetch schemas from different registries and must not share an entry. ### Cost One extra job on `depot-ubuntu-24.04-16`, only when a terraform-tagged project is affected. For comparison, a full OpenTofu leg on the integration matrix would be +77 jobs and roughly +115 runner-minutes. ### Deliberately not extended to `release.yml` Its two `unit.yml` fan-outs are a package × version cross-product with **no tag filter**, so an OpenTofu entry there would also run `hcl2cdk`, `hcl2json` and `cdktn-cli` under tofu — none of which touch a CLI. Scoping that properly is a larger change, and worth doing only once this entry has proven itself on PRs. ### Testing CI on this PR is the verification, and it is the interesting part: this is the first time the `cdktn` unit tests — including the #429 matcher fixture — run against OpenTofu in CI. If #429 were wrong, this job is what would say so. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
I'm going to lock this pull request because it has been closed for 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Prerequisite for adding an OpenTofu axis to any workflow other than
integration.yml. Follows #405, which introduced thebinarymatrix field.Description
integration.ymlsetsTERRAFORM_BINARY_NAMEfrom abinarymatrix field. Every other workflow still builds the name by concatenating:That makes a non-Terraform runtime impossible to express — there is no version string that turns
"terraform${...}"intotofu1.12.6. This removes the concatenation everywhere so the runtime is nameable.No behaviour change. Every binary resolves to exactly what it did before; this is plumbing only.
unit.ymlterraform_binaryin place ofterraform_version— the version was never used as a version there, only to build the binary name and key the concurrency group and schema cacheprovider-integration.ymlterraform_version(also exported asTERRAFORM_VERSION, and drivessetup-terraformon the windows path) and gainsterraform_binarybeside itpr-unit.ymlrelease.ymlunit.ymlfan-outs pass a binaryexamples.ymltools/build-example-matrix.mjsbinaryalongsideterraformProvider and schema caches are now keyed by binary rather than version, matching what
integration.ymlalready does — Terraform and OpenTofu resolve providers from different registries into the sameTF_PLUGIN_CACHE_DIR, so they must not share a cache entry.Testing
build-example-matrix.mjsoutput:prettier --checkclean across the workflows and the matrix builder. No"terraform${{ … }}"concatenation remains in.github/workflows/.The real verification is that this PR's own CI run is unchanged from
main— same jobs, same binaries.Follow-up
This unblocks a scoped OpenTofu entry on the unit matrix, which is where #301 actually lived: the matcher fixture is a unit test, and nothing in CI exercises it under
tofutoday, so that fix can silently regress.🤖 Generated with Claude Code