Support separate GitHub token for Terraform GitHub provider

[nakamasato]

Feature Overview

Support for using a separate GitHub token for Terraform GitHub provider while using tfaction.

Currently, the github_token parameter passed to terraform-plan and terraform-apply actions is set as the GITHUB_TOKEN environment variable internally. This overwrites any GITHUB_TOKEN environment variable set at the workflow level, making it impossible to use a different token for the Terraform GitHub provider.

Why is the feature needed?

When managing GitHub resources with Terraform using tfaction, we often need to use different GitHub tokens for different purposes:

1. tfaction operations (fetching workflows, updating PRs, etc.) - requires specific permissions like contents: write, actions:read, pull-requests:write, etc
2. Terraform GitHub provider (managing GitHub resources) - requires different permissions like administration:write,etc.

Using separate GitHub Apps for each purpose follows the principle of least privilege and better security practices.

Example Code

GitHub Actions

  - uses: suzuki-shunsuke/tfaction/plan@v1.19.1
    with:
      github_token: ${{ steps.tfaction_token.outputs.token }}
    env:
      GITHUB_TOKEN: ${{ steps.github_provider_token.outputs.token }}  # Should not be overwritten

tfaction-root.yaml

tfaction.yaml

Note

Current implementation reference:

• tfaction/terraform-plan/action.yaml

  Line 60 in b06bafe

  GITHUB_TOKEN: ${{ inputs.github_token }}

  sets GITHUB_TOKEN: ${{ inputs.github_token }}

• tfaction/terraform-apply/action.yaml

  Line 46 in b06bafe

  GITHUB_TOKEN: ${{ inputs.github_token }}

  also sets GITHUB_TOKEN: ${{ inputs.github_token }}

Possible solutions:

1. Use a different environment variable name for tfaction's internal use (e.g., TFACTION_GITHUB_TOKEN (similar to TFCMT_GITHUB_TOKEN in https://github.com/suzuki-shunsuke/tfcmt))
2. Add a new input parameter like terraform_github_token that sets GITHUB_TOKEN for Terraform
3. Only set GITHUB_TOKEN if it's not already set at the workflow level

[suzuki-shunsuke]

Thank you for the suggestion.
This is reasonable.
tfaction needs three kinds of access tokens.

1. Download Terraform Modules (permissions: contents:read, repositories: your private Terraform Modules)
2. tfaction operations
   1. Post comments, etc
   2. (Optional) Securefix Action Client access token
3. Terraform Providers like GitHub Provider

Related Issues:

• Secure Secret Management #1351