LangSmith/Terraform/Q/What is the minimum secure setup for using the LangSmith Terraform provider in GitHub Actions?
What is the minimum secure setup for using the LangSmith Terraform provider in GitHub Actions?
- Short answer: If Terraform only reads LangSmith data sources and manages no resources, it does not need persistent Terraform state. If it manages any LangSmith resources, Terraform needs state to map those resources to its configuration. A GitHub Actions runner is temporary, so its default local state disappears after the job. For repeatable CI, use a remote backend such as HCP Terraform; GitHub Actions can run Terraform, but GitHub does not provide a native Terraform state backend.
- Minimum setup: Pin the LangSmith provider source and version in
required_providers; configure the provider with LANGSMITH_API_KEY stored as a GitHub Actions secret; configure a remote backend and its credentials; and run terraform init, terraform plan, and (when authorized) terraform apply in the workflow. Limit who can trigger apply, keep secrets out of configuration and logs, and serialize runs that target the same state. Prefer short-lived identity federation where the backend supports it. - Answer/Official The LangSmith provider registry documentation documents provider installation and
LANGSMITH_API_KEY authentication. Terraform's state documentation explains that state records the mapping between declared resources and real objects and recommends HCP Terraform or a remote backend for secure team use. The backend documentation describes backend storage and state locking; locking prevents concurrent operations from corrupting shared state when supported. - Can GitHub store the state securely? GitHub Actions artifacts can be access-controlled and have configurable retention, but they are run outputs rather than a Terraform backend: they do not provide Terraform's backend state update and locking protocol. Committing
terraform.tfstate to a repository is unsafe because state can contain sensitive values and version control does not provide Terraform state locking. For a small CI-only configuration, HCP Terraform is the simplest managed remote state option; alternatively use an existing cloud backend such as S3 if that infrastructure is already available. Keep LangSmith API credentials in GitHub secrets (or a supported federated identity flow), and treat state itself as sensitive.