feat: optional state_bucket override for pre-existing/non-matching buckets

[eli-the-wizard]

Summary

• Adds optional state_bucket input to all workflows and the setup-terraform-aws composite
• When provided, overrides the derived <project>-tfstate-<account> name
• Default behavior unchanged (empty → derives bucket name as before)
• Unblocks in-place adoption for repos like isengard with non-matching bucket names (e.g., isengard-tfstate-<account>-us-west-2)

Changes

• .github/actions/setup-terraform-aws/action.yml: added state_bucket input; modified resolve logic to check override first
• .github/workflows/terraform-plan.yml: added state_bucket input, passed to setup step
• .github/workflows/terraform-apply.yml: added state_bucket input, passed to both ordered and parallel setup steps
• .github/workflows/terraform-lambda-plan.yml: added state_bucket input, passed to setup step
• .github/actions/build-deploy-lambda/action.yml: added state_bucket input, passed to setup step
• .github/workflows/terraform-lambda-deploy.yml: added state_bucket input, passed to build-deploy-lambda in both jobs
• README.md: documented the new input in all workflow inputs tables
• RELEASING.md: documented as v1.3.0 minor release (additive, backward-compatible)

Validation

• ✓ actionlint passed on all workflows
• ✓ shellcheck passed on the modified shell script (with -e SC2154)
• ✓ YAML parsing passed on both composite actions
• ✓ Functional logic tests passed:
  • state_bucket set → outputs it verbatim (regardless of aws_auth)
  • state_bucket unset + oidc → derives <project>-tfstate-<account>
  • state_bucket unset + none → empty

Test plan

• Merge to main without breaking existing consumers (default = derived name)
• Test with a consumer repo that provides state_bucket override

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

📖 Stack: lambda

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_lambda_function.fixture will be created
  + resource "aws_lambda_function" "fixture" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "/home/runner/work/atlantis-trident/atlantis-trident/examples/lambda-fixture/dist/lambda.zip"
      + function_name                  = "atlantis-trident-lambda-fixture"
      + handler                        = "handler.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = "arn:aws:iam::000000000000:role/fixture"
      + runtime                        = "python3.13"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "Mho8Kv9ALVlIZkH6CfpzpNpuotOU8OJJ1//giv8hkV4="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 3
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "SOME_SECRET" = (sensitive value)
            }
        }

      + ephemeral_storage (known after apply)

      + logging_config (known after apply)

      + tracing_config (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Last updated 2026-08-28 19:58:49 UTC for commit 7ae3e54 · run