fix(ci): install Terraform once and retry the dhi.io login

Merged
EV
13h ago
+75-7

Description

This PR removes two sources of CI infrastructure flakes.

Terraform provider acceptance tests. The acceptance job installed Go but not Terraform. It did not set TF_ACC_TERRAFORM_PATH or TF_ACC_TERRAFORM_VERSION. So terraform-plugin-testing (v1.16.0, internal/plugintest/config.go) looked up the latest CLI on checkpoint-api.hashicorp.com and downloaded it from releases.hashicorp.com on every resource.Test. One bad response (502, 500, wrong zip content type, timeout) exited the test binary with failed to find or install Terraform CLI. This caused about 24% of the failures.

  • Add the pinned hashicorp/setup-terraform step (same SHA as docs-check) with an exact terraform_version: "1.16.6" and terraform_wrapper: false. 1.11 is the floor for the write-only tests.
  • Export TF_ACC_TERRAFORM_PATH from command -v terraform. With this variable set, the library uses only that binary and makes no network calls.

dhi.io login. .github/actions/dhi-base-images logged in with docker/login-action once, with no fallback. A dhi.io outage (503 on /v2/) failed every image build.

  • Replace the login with a bash step: docker login dhi.io --password-stdin, 4 attempts, backoff of 15s, 30s, 45s. The token goes in on stdin and never in an argument.
  • Export the DHI build args only when the login succeeds.
  • Add a required input (default "true"). When it is "true", a failed login fails the step, as before. When it is "false", the step logs a ::warning:: and the build uses the public base images, as fork PRs already do (#13915).
  • build-model-server-image gets a dhi-required input (default "true") and passes it through.
  • Only pr-playwright-tests.yml (web image and model server image) and pr-integration-tests.yml (model server image) set it to "false". deployment.yml, cve-alerts.yml and the nightly workflows stay strict.
  • The export step keeps its exact format, because .github/scripts/base-image-ref.sh parses it.

How Has This Been Tested?

  • pre-commit run on the touched files: zizmor, actionlint, check-yaml and ripsecrets pass.
  • shellcheck on the new login script passes.
  • Ran the login script locally with a fake docker that returns 503. With required=false it retries 4 times, warns, writes logged-in=false and exits 0. With required=true it exits 1. An invalid required value exits 1.
  • .github/scripts/base-image-ref.sh web still reads the digest from the action file.
  • This PR's CI runs the changed jobs: Terraform provider acceptance (bootstrap) and acceptance (api-key), and the Playwright and integration image builds. The Point the acceptance tests at the installed Terraform CLI step prints the Terraform version.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

🤖 Generated with Claude Code

Summary by cubic

Fixes two sources of CI flakiness: the Terraform provider acceptance job no longer downloads the latest Terraform CLI on every test (a bad response from HashiCorp's APIs failed the whole run), and the dhi.io login now retries instead of failing every image build during an outage.

  • The acceptance job installs Terraform 1.16.6 once with hashicorp/setup-terraform and exports TF_ACC_TERRAFORM_PATH, so terraform-plugin-testing uses that binary only and makes no network calls.
  • The dhi-base-images action retries docker login dhi.io 4 times with backoff. A new required input (default "true") keeps release and CVE workflows strict; pr-playwright-tests.yml and pr-integration-tests.yml set it to "false" so PR test images fall back to the public base images with a warning instead of failing.

Summary by CodeRabbit

  • Chores
    • Builds can optionally continue with public base images when private base-image services are unavailable, with warnings instead of immediate failure.
    • Private base-image authentication now retries before applying the configured fallback or failing the build.
    • Terraform acceptance tests use a fixed CLI version and configured executable path for more consistent results.