Centralize Terraform plan storage

[gunzip]

Why

Terraform plan storage was implemented independently in the upload and download actions, making fixes difficult to keep aligned.

What changed

• Add shared Azure Blob and S3 plan bundle storage APIs to @pagopa/dx-tasks.
• Refactor the existing upload and download actions to delegate to the shared implementation while preserving their inputs and outputs.
• Rebuild the committed action bundles and add version plans for the affected projects.

Validation

• pnpm nx run-many -t test lint typecheck -p @pagopa/dx-tasks @pagopa-dx/terraform-plan-storage-upload @pagopa-dx/terraform-plan-storage-download
• pnpm nx run-many -t build -p @pagopa-dx/terraform-plan-storage-upload @pagopa-dx/terraform-plan-storage-download

Extracted from #1926.

[Copilot]

Pull request overview

This PR centralizes Terraform plan bundle storage logic into @pagopa/dx-tasks, and refactors the existing GitHub Actions (upload/download) to act as thin adapters that preserve current inputs/outputs while delegating implementation details to the shared module.

Changes:

• Added a shared plan bundle storage API (readBackendConfig, computePlanPath, uploadPlanBundle, downloadPlanBundle, deleteRemotePlanBundle) supporting both Azure Blob Storage and S3.
• Refactored terraform-plan-storage-upload and terraform-plan-storage-download actions to use the shared @pagopa/dx-tasks/terraform-plan-storage implementation.
• Added tests + updated lockfile and Nx version plans for the affected packages/actions.

Reviewed changes

Copilot reviewed 10 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Moves Azure/AWS SDK deps from actions to dx-tasks; lockfile refresh.
packages/dx-tasks/src/terraform/plan-storage.ts	Introduces shared Azure/S3 plan bundle storage implementation (upload/download/delete + backend parsing).
packages/dx-tasks/src/terraform/tests/plan-storage.test.ts	Adds unit tests for the new plan storage module (partial provider coverage).
packages/dx-tasks/package.json	Exports the new terraform-plan-storage entrypoint and adds required SDK dependencies.
actions/terraform-plan-storage-upload/src/main.ts	Refactors upload action to delegate to uploadPlanBundle and map outputs.
actions/terraform-plan-storage-upload/package.json	Replaces direct cloud SDK deps with @pagopa/dx-tasks; adjusts Nx build inputs.
actions/terraform-plan-storage-download/src/main.ts	Refactors download action to delegate to downloadPlanBundle and manage post-state.
actions/terraform-plan-storage-download/src/post.ts	Refactors post-step cleanup to delegate to deleteRemotePlanBundle.
actions/terraform-plan-storage-download/package.json	Replaces direct cloud SDK deps with @pagopa/dx-tasks; adjusts Nx build inputs.
.nx/version-plans/version-plan-1784226540183.md	Patch plan for upload/download actions.
.nx/version-plans/version-plan-1784226528365.md	Minor plan for @pagopa/dx-tasks to expose shared plan storage.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[github-actions]

Code Review Report

Terraform Plan: infra/policy/dev - ✅ Success

Plan: 2 to add, 0 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/dev - ✅ Success

Warning

Warning: Reference to undefined provider

on aws.tf line 12, in module "mcp_server":
12: aws.us_east_1 = aws.us-east-1

There is no explicit declaration for local provider name "aws.us_east_1" in
module.mcp_server, so Terraform is assuming you mean to pass a configuration
for "hashicorp/aws".

If you also control the child module, add a required_providers entry named
"aws.us_east_1" with the source address "hashicorp/aws".

Plan: 0 to add, 1 to change, 27 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.container_app_infra.azurerm_monitor_diagnostic_setting.container_app_environment,
on .terraform/modules/container_app_infra/monitoring.tf line 3, in resource "azurerm_monitor_diagnostic_setting" "container_app_environment":
3: resource "azurerm_monitor_diagnostic_setting" "container_app_environment" {

metric has been deprecated in favour of the enabled_metric property and
will be removed in v5.0 of the AzureRM provider

Plan: 0 to add, 7 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/dev - ✅ Success

Plan: 0 to add, 44 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/prod - ✅ Success

Plan: 0 to add, 2 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/dev - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.integration_tests_client_id[0],
on ../_modules/azure/custom_environments.tf line 16, in resource "github_actions_environment_secret" "integration_tests_client_id":
16: plaintext_value = azurerm_user_assigned_identity.integration_tests[0].client_id

Use value.

(and 26 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 3 to add, 14 to change, 14 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.automation_infra_cd_client_id,
on ../_modules/azure/custom_environments.tf line 32, in resource "github_actions_environment_secret" "automation_infra_cd_client_id":
32: plaintext_value = module.bootstrap.identities.infra.cd.client_id

Use value.

(and 23 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 14 to add, 16 to change, 58 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

---

Triggered by @gunzip, commit: 4f0619de158961b565a6324271cc359185b208f9.