Struggling with setup

[infinisil]

I'm considering using this project for the NixOS organisation (cc NixOS/org#40, @zimbatm, @galargh, @laurentsenta), and am just testing it out on https://github.com/Infinisil-s-Test-Organization/github-as-code for now, but am struggling to get it working. I went through the setup guide (up to including "GitHub Repository Secrets", the rest don't seem necessary) and am trying to just get it synchronised with the default configuration, but have run into the following:

• The Fix workflow failed at terraform init with

  Initializing the backend...
  
  Successfully configured the backend "s3"! Terraform will automatically
  use this backend unless the backend configuration changes.
  Error loading state: failed to lock s3 state: 2 errors occurred:
    * AccessDeniedException: User: arn:aws:iam::687407229899:user/github-as-code-read-only
      is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:eu-west-3:687407229899:table/github-as-code-test
      because no identity-based policy allows the dynamodb:PutItem action
      status code: 400, request id: 6SVGL46SHRH4LV63GQ5KAJF49RVV4KQNSO5AEMVJF66Q9ASUAAJG
    * unexpected end of JSON input
  

  I've been able to work around this (see this run) by just allowing the IAM read-only policy access to dynamodb:PutItem, but that doesn't seem right..

• Regardless of the above, the Sync workflow also fails at terraform import with

  Acquiring state lock. This may take a few moments...
  github_repository.this["nixpkgs"]: Importing from ID "nixpkgs"...
  github_repository.this["nixpkgs"]: Import prepared!
    Prepared github_repository for import
  github_repository.this["nixpkgs"]: Refreshing state... [id=nixpkgs]
  ╷
  │ Error: Unsupported attribute
  │ 
  │   on /home/runner/work/github-as-code/github-as-code/terraform/locals.tf line 141, in locals:
  │  141:         for item in local.state.values.root_module.resources : item.mode => item...
  │     ├────────────────
  │     │ local.state is object with 1 attribute "format_version"
  │ 
  │ This object does not have an attribute named "values".
  ╵
  
  Releasing state lock. This may take a few moments...
  /home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:592
                  error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
                          ^
  
  Error: The process '/home/runner/work/_temp/7f31669d-51f3-442a-b1b0-de23c2e2ac75/terraform' failed with exit code 1
      at ExecState._setResult (/home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:592:25)
      at ExecState.CheckComplete (/home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:575:18)
      at ChildProcess.<anonymous> (/home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:469:27)
      at ChildProcess.emit (node:events:524:28)
      at maybeClose (node:internal/child_process:1104:16)
      at ChildProcess._handle.onexit (node:internal/child_process:304:5)
  
  Node.js v20.19.0
  

I'd be grateful for any help to get this working!

[galargh]

• The Fix workflow failed at terraform init with

  Initializing the backend...
  
  Successfully configured the backend "s3"! Terraform will automatically
  use this backend unless the backend configuration changes.
  Error loading state: failed to lock s3 state: 2 errors occurred:
    * AccessDeniedException: User: arn:aws:iam::687407229899:user/github-as-code-read-only
      is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:eu-west-3:687407229899:table/github-as-code-test
      because no identity-based policy allows the dynamodb:PutItem action
      status code: 400, request id: 6SVGL46SHRH4LV63GQ5KAJF49RVV4KQNSO5AEMVJF66Q9ASUAAJG
    * unexpected end of JSON input
  

  I've been able to work around this (see this run) by just allowing the IAM read-only policy access to dynamodb:PutItem, but that doesn't seem right..

Oh, I see! I think the issue here is that the Fix workflow was added after most of the setup instructions were put together. The Fix workflow shouldn't really work until the repo is synced for the first time. I think we should either make it really explicit in the setup instructions or disable the Fix workflow until the sync is complete or fail the Fix workflow with a more prescriptive error message if it fails because the repo is not synced yet.

• Regardless of the above, the Sync workflow also fails at terraform import with

  Acquiring state lock. This may take a few moments...
  github_repository.this["nixpkgs"]: Importing from ID "nixpkgs"...
  github_repository.this["nixpkgs"]: Import prepared!
    Prepared github_repository for import
  github_repository.this["nixpkgs"]: Refreshing state... [id=nixpkgs]
  ╷
  │ Error: Unsupported attribute
  │ 
  │   on /home/runner/work/github-as-code/github-as-code/terraform/locals.tf line 141, in locals:
  │  141:         for item in local.state.values.root_module.resources : item.mode => item...
  │     ├────────────────
  │     │ local.state is object with 1 attribute "format_version"
  │ 
  │ This object does not have an attribute named "values".
  ╵
  
  Releasing state lock. This may take a few moments...
  /home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:592
                  error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
                          ^
  
  Error: The process '/home/runner/work/_temp/7f31669d-51f3-442a-b1b0-de23c2e2ac75/terraform' failed with exit code 1
      at ExecState._setResult (/home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:592:25)
      at ExecState.CheckComplete (/home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:575:18)
      at ChildProcess.<anonymous> (/home/runner/work/github-as-code/github-as-code/scripts/node_modules/@actions/exec/lib/toolrunner.js:469:27)
      at ChildProcess.emit (node:events:524:28)
      at maybeClose (node:internal/child_process:1104:16)
      at ChildProcess._handle.onexit (node:internal/child_process:304:5)
  
  Node.js v20.19.0
  

I'd be grateful for any help to get this working!

This is certainly a more pressing issue. Let me take a closer look at the setup.

Found it! The issue with the sync is that locals.tf expects a certain structure of the terraform state to exist. However, that structure does not exist until after the initial sync. So we get ourselves into a bit of a chicken and egg problem.

I did solve it the last time I was setting up GitHub as Code in a new organization but forgot to port it back to the main repo 🤦

I created a PR that addresses this and merged it to the default branch - #161.

---

Could you try upgrading your instance of GitHub as Code and running the sync again? You can run the upgrade via the Upgrade workflow. It will create a PR that pulls in the changes from the default branch of this repo to your fork. One disclaimer, the plan and fix workflows on the pull request will fail. But again, it's only because the repo isn't synced yet.

Sorry for the rough edges in the setup process. I haven't gone through it in a while and I'm sure it shows. And thank you for trying it out 🙇

[infinisil]

Thanks a lot, it's working beautifully now!

The only minor issue I've run into is that enabling the github_team_membership resource also requires enabling the github_team one: infinisil-test-org/github-as-code@699a9b0