From b4c051e6c033441476ff55717cdf33b3fccadd6c Mon Sep 17 00:00:00 2001
From: Haitao Pan <haitaopanhq@gmail.com>
Date: Thu, 25 Jun 2026 11:29:35 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E5=B0=86=20R2=20endpoint=20?=
 =?UTF-8?q?=E5=86=99=E5=85=A5=20backend.tf=20HCL=20=E8=80=8C=E9=9D=9E=20-b?=
 =?UTF-8?q?ackend-config=20flag?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Terraform S3 backend 的 endpoints 块只能在 HCL 配置里指定，
无法通过 -backend-config 命令行参数传递（endpoints={s3=...} 和
endpoints.s3=... 两种写法均被 Terraform 拒绝）。

改为：Configure remote backend 步骤用非引号 heredoc 将
TF_STATE_ENDPOINT 展开写入 backend.tf，terraform init 只通过
-backend-config 传 bucket/key/region。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/deploy-ai-workspace-iac.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-ai-workspace-iac.yaml b/.github/workflows/deploy-ai-workspace-iac.yaml
index ab0f943..49cfc17 100644
--- a/.github/workflows/deploy-ai-workspace-iac.yaml
+++ b/.github/workflows/deploy-ai-workspace-iac.yaml
@@ -181,11 +181,16 @@ jobs:
       - name: Configure remote backend (optional)
         if: ${{ steps.vault.outputs.TF_STATE_BUCKET != '' }}
         working-directory: ${{ env.ENV_DIR }}
+        env:
+          TF_STATE_ENDPOINT: ${{ steps.vault.outputs.TF_STATE_ENDPOINT }}
         run: |
           set -euo pipefail
-          cat > backend.tf <<'EOF'
+          # endpoints 块只能在 HCL 里配置，无法通过 -backend-config flag 传递。
+          # 用非引号 heredoc 将 endpoint URL 直接写入 backend.tf。
+          cat > backend.tf <<EOF
           terraform {
             backend "s3" {
+              endpoints = { s3 = "${TF_STATE_ENDPOINT}" }
               skip_credentials_validation = true
               skip_region_validation      = true
               skip_requesting_account_id  = true
@@ -212,7 +217,6 @@ jobs:
           set -euo pipefail
           if [ -n "${TF_STATE_BUCKET}" ]; then
             terraform init -input=false \
-              -backend-config="endpoints.s3=${TF_STATE_ENDPOINT}" \
               -backend-config="bucket=${TF_STATE_BUCKET}" \
               -backend-config="key=ai-workspace/terraform.tfstate" \
               -backend-config="region=${TF_STATE_REGION:-us-east-1}"