CI/CD and automation workflows practice questions

terraform fmt's scope: by default only the specified or current directory.

The documentation states that by default fmt only processes the specified or current directory, and -recursive also processes subdirectories. The job therefore checked only the root's .tf files. -check does return a non-zero exit status on findings, and fmt has no commit-aware or module-aware filtering.

1. Note where the job runs and where the bad files live.
2. Recall fmt's default scope is one directory.
3. Recall -check does fail the job on findings it sees.
4. Conclude the files were outside the scope; add -recursive.

Exam tip: No -recursive, no subdirectories: fmt -check from the root misses modules/.

The provider plugin cache saves downloads, but HashiCorp does not guarantee it is safe for concurrent terraform init runs.

The CLI configuration documentation states that the plugin cache directory is not guaranteed to be concurrency safe and that the installer's behaviour with multiple concurrent terraform init calls is undefined. Separate caches per concurrent job (or a pre-populated read-only provider directory) remove the race. The lock-file option and -upgrade address different problems, and moving the setting to a file changes nothing about sharing.

1. Notice the failures happen only when jobs start together.
2. Recall that the plugin cache is not guaranteed to be concurrency safe.
3. Pick the change that stops parallel inits writing the same cache.

Exam tip: One plugin cache per concurrent init; the cache is not concurrency safe.

The plugin cache is used only when a cached package matches a checksum already recorded in the dependency lock file.

HashiCorp's documentation says Terraform always installs a provider from upstream the first time it is used with a configuration, so that it can record a complete set of checksums; later runs reuse the cache once the lock file has them. Without a committed lock file every run is a 'first time'. The may-break option would produce cache hits but writes an incomplete lock entry valid only for the current OS and architecture, which breaks the stated cross-platform requirement.

1. Ask why a populated cache is ignored: there is no lock entry to match.
2. Recall that a first install goes upstream to record full checksums.
3. Reject the may-break option: it trades away cross-platform checksums.
4. Commit the lock file so later inits can match the cache.

Exam tip: No lock entry, no cache hit: commit .terraform.lock.hcl to make the plugin cache work safely.

hashicorp/setup-terraform installs, by default, a wrapper that captures each terraform call's stdout, stderr and exit code as step outputs.

terraform_wrapper defaults to true. The wrapper runs subsequent terraform calls and records their results so later steps can read steps.<id>.outputs.stdout, stderr and exitcode. When a step needs Terraform's own output on stdout, for example JSON piped to jq, set terraform_wrapper: false; the README notes it can be skipped when later steps do not need the captured results.

1. Note that the extra content appears only when Terraform runs under the action.
2. Recall that setup-terraform wraps the binary by default.
3. Disable the wrapper when scripts consume Terraform's raw output.

Exam tip: Piping terraform output in GitHub Actions? Set terraform_wrapper: false.

Terraform 1.2 and later read host credentials from TF_TOKEN_<host> environment variables, with the host name encoded for variable-name rules.

The CLI configuration documentation says the variable name is TF_TOKEN_ plus the domain name with periods encoded as underscores, and that hyphens, which are usually invalid in variable names, may be encoded as double underscores. tfe.example-corp.com therefore becomes TF_TOKEN_tfe_example__corp_com. Using a single underscore for the hyphen produces a different host, and the full host name including the tfe label is required.

1. Start from the full host name: tfe.example-corp.com.
2. Encode each period as one underscore.
3. Encode the hyphen as a double underscore.
4. Prefix with TF_TOKEN_.

Exam tip: TF_TOKEN_<host>: periods become _, hyphens become __.

VCS-driven workspaces can limit automatic runs to changes that affect specified paths, preferably with glob trigger patterns.

With 'Only trigger runs when files in specified paths change', HCP Terraform begins runs only for changes that affect the specified files and directories; HashiCorp recommends glob trigger patterns. Because envs/prod calls modules/ through relative paths, both trees must be listed, or a module change would reach prod only on some unrelated later run. 'Always trigger' reacts to any file in the repository, and tag triggers ignore ordinary pushes.

1. List what can change prod's plan: its root module and the local modules.
2. Exclude everything else, so 'Always trigger' is out.
3. Choose specified paths with patterns covering both trees.

Exam tip: Path-filtered triggers must include every local module the workspace reads, not just its working directory.