It does not work when using jobs with matrix

[csaavedravanta]

Describe the bug

I have some jobs with matrix strategy, and when I try to do a plan this fails with the following error:
jq: error (at :1): Expected JSON value (while parsing '')

I was debugging and I think the error happens due to this line is not getting a result, making job_id is empty:

TF-via-PR/action.yml

Line 107 in 1e60ee1

job_id=$(echo "$workflow_run" | jq --raw-output --arg matrix "$matrix" '.jobs[] | select(.name | contains($matrix)) | .id' | tail -n 1)

So then the actual error happens in this line because job_id is empty:

TF-via-PR/action.yml

Line 112 in 1e60ee1

workflow_step=$(echo "$workflow_run" | jq --raw-output --arg job_id "$job_id" '.jobs[] | select(.id == ($job_id | tonumber)) | .steps[] | select(.status == "in_progress") | .number')

My matrix definitions is something like for example:
matrix
include:
- somefield1a: value1
somefield1b: value2
somefield1c: value3
- somefield2a: value4
somefield2a: value5
somefield2a: value6
and in the workflow job it is shown correctly in the env output.

I see this line creates something like "value1, value2, value" in the matrix variable

TF-via-PR/action.yml

Line 106 in 1e60ee1

matrix=$(echo "$GH_MATRIX" | jq --raw-output 'to_entries | map(.value) | join(", ")')

but I think the problem is then it tries to filter the workflow json with that string "value1, value2, value3", but looking at the workflow json generated with gh api, that job does not have that information in the json, so it does not find anything, retuning an empty result.

To Reproduce

Define a job with matrix strategy with more than 1 value, and then run a plan and it will fail.

Expected behavior

Be able to run terraform plan with matrix.

Screenshots

Additional context

[rdhar]

Hey @csaavedravanta, thanks for taking the time to dig through the code and raising such a detailed issue: the gold standard for feedback (especially since you recently joined GitHub)!

I was under the impression that handling of matrix-strategy was nipped in the bud a long while back, including multiple matrix arrays. In fact, I checked with the CI tests of this very project/repository to confirm as much: notice the tool and test matrix arrays.

With that said, to the best of you ability, could I request you to share obfuscated snippets of your GH Action workflow? Specifically, the strategy: matrix: block as well as any specific custom name: give to the job. In addition, an obfuscated screenshot of your workflow sidebar would help to match between the inputs and outputs, as shown below.

[csaavedravanta]

Here the obfuscated data:

The job:

jobs:
    terraform-plan:
      strategy:
        matrix:
          include:
            - aws_region: us-east-1
              aws_account_id: 11111111111
              environment: development
            - aws_region: us-east-1
              aws_account_id: 22222222
              environment: staging
     name: terraform (${{ matrix.aws_region }} ${{ matrix.environment }})
     steps:
      - name: Checkout repo
        ......
      - name: Configure AWS credentials
        ......
      - name: Terraform plan
        uses: op5dev/tf-via-pr@v13.0.2
        with:
          working-directory: terraform/code
          command: plan
          arg-reconfigure: "true"
          arg-backend: "true"
          arg-get: "true"
          arg-backend-config: terraform/code/${{ matrix.environment }}-${{ matrix.aws_region }}
          arg-refresh: "false"
          arg-var-file: terraform/code/${{ matrix.environment }}-${{ matrix.aws_region }}.tfvars
          plan-encrypt: ${{ github.sha }}

The failed part of the log:

  Run # Unique identifier.
  # Unique identifier.
  # Get PR number using different query methods for push, merge_group, and pull_request events.
  if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
    # List PRs associated with the commit, then get the PR number from the head ref or the latest PR.
    associated_prs=$(gh api /repos/{owner}/{repo}/commits/${GITHUB_SHA}/pulls --header "$GH_API" --method GET --field per_page=100)
    pr_number=$(echo "$associated_prs" | jq --raw-output '(.[] | select(.head.ref == env.GITHUB_REF_NAME) | .number) // .[0].number // 0')
  elif [[ "$GITHUB_EVENT_NAME" == "merge_group" ]]; then
    # Get the PR number by parsing the ref name.
    pr_number=$(echo "${GITHUB_REF_NAME}" | sed -n 's/.*pr-\([0-9]*\)-.*/\1/p')
  else
    # Get the PR number from the event payload or fallback on 0.
    pr_number=11111
  fi
  echo "pr=$pr_number" >> "$GITHUB_OUTPUT"
  
  # Generate identifier for the workflow run using MD5 hashing algorithm for concise and unique naming.
  identifier=" -chdir=terraform/code -backend-config=terraform/code/development-us-east-1 -var-file=terraform/code/development-us-east-1.tfvars"
  identifier=$(echo -n "$identifier" | md5sum | awk '{print $1}')
  echo "name=terraform-${pr_number}-${identifier}.tfplan" >> "$GITHUB_OUTPUT"
  
  # List jobs from the current workflow run.
  workflow_run=$(gh api /repos/{owner}/{repo}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}/jobs --header "$GH_API" --method GET --field per_page=100)
  
  # Get the current job ID from the workflow run using different query methods for matrix and regular jobs.
  if [[ "$GH_MATRIX" == "null" ]]; then
    # For regular jobs, get the ID of the job with the same name as $GITHUB_JOB (lowercase and '-' or '_' replaced with ' ').
    # Otherwise, get the ID of the first job in the list as a fallback.
    job_id=$(echo "$workflow_run" | jq --raw-output '(.jobs[] | select((.name | ascii_downcase | gsub("-|_"; " ")) == (env.GITHUB_JOB | ascii_downcase | gsub("-|_"; " "))) | .id) // .jobs[0].id' | tail -n 1)
  else
    # For matrix jobs, join the matrix values with comma separator into a single string and get the ID of the job which contains it.
    matrix=$(echo "$GH_MATRIX" | jq --raw-output 'to_entries | map(.value) | join(", ")')
    job_id=$(echo "$workflow_run" | jq --raw-output --arg matrix "$matrix" '.jobs[] | select(.name | contains($matrix)) | .id' | tail -n 1)
  fi
  echo "job=$job_id" >> "$GITHUB_OUTPUT"
  
  # Get the step number that has status "in_progress" from the current job.
  workflow_step=$(echo "$workflow_run" | jq --raw-output --arg job_id "$job_id" '.jobs[] | select(.id == ($job_id | tonumber)) | .steps[] | select(.status == "in_progress") | .number')
  echo "step=$workflow_step" >> "$GITHUB_OUTPUT"
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    AWS_DEFAULT_REGION: us-east-1
    AWS_REGION: us-east-1
    AWS_ACCESS_KEY_ID: ***
    AWS_SECRET_ACCESS_KEY: ***
    AWS_SESSION_TOKEN: ***
    GH_API: X-GitHub-Api-Version:2022-11-28
    GH_TOKEN: ***
    TF_CLI_ARGS: -no-color
    TF_IN_AUTOMATION: true
    TF_INPUT: false
    GH_MATRIX: {
    "aws_region": "us-east-1",
    "aws_account_id": ******,
    "environment": "development"
  }
jq: error (at <stdin>:1): Expected JSON value (while parsing '')
Error: Process completed with exit code 5.

[rdhar]

Fantastic, thanks for sharing @csaavedravanta, that gives me a solid lead!

Just to humour me, would you mind deleting the following name: line please?

name: terraform (${{ matrix.aws_region }} ${{ matrix.environment }})

[csaavedravanta]

Oh yeah, removing the custom name the job name is the same as the script intent to find it and now it can find it and works ok.
Just one is failing, it is if some matrix value is empty it fails because it tries to look for some thing like for example:

matrix
  include:
    - somefield1a: value1
       somefield1b: ""
       somefield1c: value3

"value1, , value3"
Note the empty value between the commas, it should be "value1, value3"

So a question, if I want to use TF-via-PR for matrix, the job cannot have a custom name? or is there a workaround or fix coming?

[rdhar]

Great Q, so there's a few takeaways here:

• 🟢 Great to hear the default configuration worked for most cases!

• 🟢 The handling of empty matrix value(s) can be addressed by the workaround "Edit" below.

• 🔴 Unfortunately, the source of the problem is upstream: specifically with GitHub API discussed here and there.

  • In short, the job's name is its unique identifier, while also over-written by the name: attribute and matrix strategy.
  • But the final/over-written value is not exposed anywhere, so we're left in the dark.
  • Despite it seeming to be a "simple" fix.

TF-via-PR's current behaviour is a workaround in order to make it work with most scenarios. At best, a new "job-name" input could be introduced to allow users to specify their unconventional job-naming… which is far from ideal.

---

Edit: For your particular use-case, the following custom name: input will work—even with empty values—while maintaining compatibility with TF-via-PR.

name: terraform (${{ matrix.aws_region }}, ${{ matrix.aws_account_id }}, ${{ matrix.environment }})

Where:

• The matrix... ordering matches your matrix input order.
• Each matrix... is separated by a comma and space , (surrounding parentheses () are optional).

[csaavedravanta]

Thanks for the response,
I think we can live without specifying a custom name for matrix jobs for now.
Regarding for empty values, the workaround you specified does not work for our case, because the fields of matrix differ between items, so the job name will differ depending the fields, for example:

matrix
  include:
    - somefield1a: value1
       somefield1b: ""
       somefield1c: value3
    - somefield1a: value1
       somefield1c: value3
       **somefield1d: value4**

as you can see here, the second item of the matrix has another field somefield1d which is not in the first item and also does not have the somefield1b.
Anyway I found another way to workaround the empty values:

• Not using the custom names
• For empty values use some random special word (like none) that then I can verify if it is set then use an empty string
  For example:

matrix
  include:
    - somefield1a: value1
       somefield1b: none
       somefield1c: value3
    - somefield1a: value1
       somefield1b: value2
       somefield1c: value3
  steps:
    - name: Checkout repo
       run: |
             somevariable=${{ matrix.somefield1b != 'none' && matrix.somefield1b || '' }}

Thank you for the support.

[rdhar]

Is the GitHub Action still able to meet your needs in this multi-matrix use-case with your workarounds?

[rdhar]

because the fields of matrix differ between items

Ah shoot, that's a tough nut to crack.

For empty values use some random special word

Smart thinking! I know some workarounds can be frustrating, but you've done well to manage it smoothly.

Thank you for the support

Thank you for sharing your feedback—super valuable to hear how others use this Action. On that note, I had a few questions:

1. Given your use of command: plan instead of something like command: ${{ github.event_name == 'push' && 'apply' || 'plan' }}, I assume you have a whole separate job to run apply? If so, is there any reason they can't be combined into the same job with conditional logic, in order to reduce duplication of code?
   
   
2. Your use of backend, get, and reconfigure is fascinating, and likely linked with the answer to the previous question, eh?
   
   
3. Since ${{ github.sha }} is openly available data (just look at the UI) which changes with each commit, it doesn't make for a good plan-encrypt passphrase.
   Ideally it should be a secret value like ${{ secrets.PASSPHRASE }}. Or, if it's a private repo with trusted team members, then plan-encrypt might not be needed in the first place.