「CI/CD 流水线集成」

安全模式：
  PR 提交 ──► plan（只读，产出 diff）──► 人工 Review ──► apply（写入，需批准）
                                    ▲
                   门禁：plan 无破坏性变更才允许合并

# plan 输出中的关键标记
# Terraform will perform the following actions:
#   # aws_instance.web will be updated in-place
#   # aws_db_instance.db will be replaced   ← 高风险

# backend 配置（凭据由 CI 环境注入，不在代码里）
terraform {
  backend "s3" {
    bucket         = "my-infra-tfstate"
    key            = "prod/network/terraform.tfstate"
    region         = "ap-northeast-1"
    dynamodb_table = "tf-state-lock"
  }
}

# GitHub Actions / GitLab CI 通过 Secret 注入
export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}"
export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}"
export AWS_REGION="ap-northeast-1"

terraform init -backend-config="key=${ENV}/network/terraform.tfstate"

# 1. 初始化并获取最新 state
terraform init
terraform workspace select prod || terraform workspace new prod

# 2. 生成 plan 产物（二进制，apply 时复用）
terraform plan -out=tfplan.binary

# 3. 生成人类可读摘要
terraform show -json tfplan.binary | jq -r '.resource_changes[] | "\(.change.actions | join(",")) \(.address)"'

Terraform Plan 评论模板（prod/network）

| 动作 | 数量 |
|------|------|
| create | 2 |
| update | 1 |
| replace | 0 |
| delete | 1 |

- aws_vpc.main 将被 delete（请确认）
- aws_subnet.azs["a"] 将被 create

# GitHub Actions 示例：PR 上评论 plan 结果
- name: Post plan comment
  uses: actions/github-script@v7
  with:
    script: |
      const body = process.env.PLAN_SUMMARY;
      await github.rest.issues.createComment({
        owner, repo, issue_number, body
      });

# 手动批准：需要人工 approval 后才执行
terraform apply tfplan.binary

# 1. 复用 plan 产物（保证与审查的完全一致）
terraform apply tfplan.binary

# 2. 记录输出
terraform output -json > output.json

# 3. 失败时保留锁信息
# Error: Error acquiring the state lock
# → 检查是否有并行流水线

# GitHub Actions：限制并发，避免多人同时 apply
concurrency:
  group: tf-apply-${{ github.ref }}
  cancel-in-progress: false

开发者提交 PR
  └─► Atlantis 检测到变更，跑 plan，评论到 PR
      └─► 人工 Review + 评论 "atlantis apply"
          └─► Atlantis 执行 apply，更新 PR 状态

# atlantis.yaml
version: 3
projects:
  - dir: prod/network
    workspace: prod
    terraform_version: v1.7.0
    apply_requirements: [mergeable, approved]
  - dir: staging/app
    workspace: staging
    apply_requirements: []

atlantis plan        # 触发 plan
atlantis apply       # 触发 apply（需权限）
atlantis plan -p prod/network

prod/network/
  main.tf
  backend.tf
  tfplan.binary（存档）
staging/network/
  main.tf
prod/app/
  main.tf

# 同一工作流，按环境分支不同配置
env:
  ENV: ${{ github.ref_name == 'refs/heads/main' && 'prod' || 'staging' }}

# 生产 apply 前的双重检查脚本（示例）
#!/bin/bash
set -euo pipefail

# 检查 plan 中是否存在 delete 且未经批准
DELETES=$(terraform show -json tfplan.binary | jq '.resource_changes[] | select(.change.actions[0] == "delete")')
if [ -n "$DELETES" ] && [ "${AUTO_APPROVE:-false}" != "true" ]; then
  echo "检测到删除操作，需要人工批准"
  exit 1
fi