| mode | trigger = Parse command via branch-deploy, export TF_BD_* to GITHUB_ENV, STOP
execute = Run terraform with lifecycle completion (reads TF_BD_* from GITHUB_ENV)
Use both modes as CONDITIONAL STEPS in a SINGLE JOB:
- Trigger mode exports env vars
- Custom steps (credentials) can access env vars
- Execute mode picks up env vars automatically
| yes | — |
| github-token | GitHub token with Branch Deploy permissions: pull-requests:write, deployments:write, contents:write, checks:read, statuses:read, actions:read | yes | — |
| config-path | Path to .tf-branch-deploy.yml | — | .tf-branch-deploy.yml |
| terraform-version | Terraform version to install | — | latest |
| dry-run | Print commands without running | — | false |
| plan-retention-days | Days to keep saved plan artifacts before they expire (1-90, capped by the repository's artifact retention setting) | — | 7 |
| trigger | Deploy command trigger | — | .apply |
| noop-trigger | Plan command trigger | — | .plan |
| lock-trigger | Lock command trigger | — | .lock |
| unlock-trigger | Unlock command trigger | — | .unlock |
| help-trigger | Help command trigger | — | .help |
| lock-info-alias | Lock info alias | — | .wcid |
| param-separator | Parameter separator in commands | — | | |
| environment-targets | Comma-separated environments (auto-detected from config if empty) | — | "" |
| production-environments | Comma-separated production environments | — | "" |
| environment-urls | Environment URLs mapping | — | "" |
| draft-permitted-targets | Environments allowing draft PR deployments | — | "" |
| stable-branch | Stable branch for rollbacks | — | main |
| update-branch | How to handle outdated branches: disabled|warn|force | — | warn |
| outdated-mode | How to handle outdated branches | — | strict |
| allow-sha-deployments | Allow deployments by SHA | — | false |
| enforced-deployment-order | Required deployment order | — | "" |
| checks | Which checks must pass before deployment | — | all |
| ignored-checks | Checks to ignore | — | "" |
| skip-ci | CI pattern to skip | — | "" |
| skip-reviews | Skip PR review requirement | — | "" |
| required-contexts | Required status contexts | — | "" |
| permissions | Required permissions | — | write,admin |
| admins | Admin users/teams | — | false |
| admins-pat | Admin PAT for checks | — | false |
| commit-verification | Require verified commits | — | false |
| disable-naked-commands | Require 'to <env>' in commands | — | false |
| allow-non-default-target-branch | Allow non-default target branches | — | false |
| deployment-confirmation | Require deployment confirmation | — | false |
| deployment-confirmation-timeout | Confirmation timeout seconds | — | 300 |
| global-lock-flag | Global lock flag | — | --global |
| sticky-locks | Keep locks after deployment | — | false |
| sticky-locks-for-noop | Keep locks for noop | — | false |
| use-security-warnings | Show security warnings | — | true |
| reaction | Initial reaction to command | — | eyes |