From ee5a4ab41eb13f70e60c86614e657307e470bb36 Mon Sep 17 00:00:00 2001
From: malken21 <77374813+malken21@users.noreply.github.com>
Date: Fri, 1 May 2026 13:06:53 +0900
Subject: [PATCH] Add CLOUDFLARE_ACCOUNT_ID env and read permission

Grant workflows contents: read and export CLOUDFLARE_ACCOUNT_ID into the Terraform Plan/Apply jobs. Replace direct secrets interpolation in the backend-config with the environment variable ${CLOUDFLARE_ACCOUNT_ID} so the R2 backend endpoint is constructed at runtime. Changes apply to both terraform-plan.yml and terraform-apply.yml to ensure consistent backend initialization.
---
 .github/workflows/terraform-apply.yml | 6 +++++-
 .github/workflows/terraform-plan.yml  | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index 7ce8b40..560129a 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   apply:
     name: "Terraform Apply"
@@ -21,9 +24,10 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         run: |
           terraform init \
-            -backend-config="endpoints={s3=\"https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com\"}"
+            -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
 
       - name: Terraform Apply
         env:
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
index 02d4189..3d575fa 100644
--- a/.github/workflows/terraform-plan.yml
+++ b/.github/workflows/terraform-plan.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   plan:
     name: "Terraform Plan"
@@ -21,9 +24,10 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         run: |
           terraform init \
-            -backend-config="endpoints={s3=\"https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com\"}"
+            -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
 
       - name: Terraform Plan
         env: