abcxyz/secure-setup-terraform action
Verify that the installed terraform binary matches a pre-computed hash. Ensure that there is a checked in provider lock file and that it is read only so that terraform cannot update it.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 13, 2026
- License
- Apache 2.0
Pinned Snippet
uses: abcxyz/secure-setup-terraform@45433e336aec93465f6b7aea3c7a70d16ef8c186 # v0.3.58tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| terraform_version | The version of Terraform CLI to install. Instead of full version string you can also specify constraint string starting with "<" (for example `<1.13.0`) to install the latest version satisfying the constraint. A value of `latest` will install the latest version of Terraform CLI. Defaults to `latest`. | no | latest |
| terraform_wrapper | Whether or not to install a wrapper to wrap subsequent calls of the `terraform` binary and expose its STDOUT, STDERR, and exit code as outputs named `stdout`, `stderr`, and `exitcode` respectively. Defaults to `true`. | no | true |
| cli_config_credentials_hostname | From setup-terraform: The hostname of a Terraform Cloud/Enterprise instance to place within the credentials block of the Terraform CLI configuration file. Defaults to `app.terraform.io`. | no | app.terraform.io |
| cli_config_credentials_token | From setup-terraform: The API token for a Terraform Cloud/Enterprise instance to place within the credentials block of the Terraform CLI configuration file. | no | — |
| terraform_lockfile_location | Path to the directory containing the .terraform.lock.hcl file. This action will mark this file readonly to prevent terraform init calls from adding new providers. | no | . |
| terraform_module_location | Path to the directory containing the terraform files that should be linted. | no | ./ |
| protect_lockfile | When true, enables the step that marks the lock file readonly so that no provider updates can occur. | no | true |
Outputs
no outputs