What you need

Your pipeline must authenticate to Grafana without exposing credentials in code. GitHub Actions provides two mechanisms: secrets for sensitive values and variables for non-sensitive configuration. You need three values: one secret and two variables.

Add and reference your credentials

Store the three values in your repository, then reference them from your workflow.

1. In your repository, go to Settings > Secrets and variables > Actions.
2. On Repository secrets, add GRAFANA_TOKEN with your service account token. Never commit this token to your repository.
3. On Repository variables, add GRAFANA_SERVER and GRAFANA_STACK_ID.
4. Reference the secret with the secrets context and the variables with the vars context.

YAML Copy

env:
  GRAFANA_SERVER: ${{ vars.GRAFANA_SERVER }}
  GRAFANA_STACK_ID: ${{ vars.GRAFANA_STACK_ID }}
  GRAFANA_TOKEN: ${{ secrets.GRAFANA_TOKEN }}

Authenticate Terraform

Pass authentication to the Terraform provider through environment variables or directly in the provider block. Set TF_VAR_grafana_url and TF_VAR_grafana_token as environment variables, and Terraform picks them up automatically. The environment variable approach keeps your Terraform code portable: the same configuration works locally and in CI.

hcl Copy

provider "grafana" {
  url  = var.grafana_url
  auth = var.grafana_token
}