Commit d8d96b43 authored by xuwang's avatar xuwang
Browse files

skills/otica-migrate-tf: gcp-login on tf-init is GCP-platform-only 



Clarify that tf-init: gcp-login only applies to repos with a GCS
backend — non-GCP repos have no gcp-login on tf-init at all.

Changelog-Fixed: tf-render vault-login section: gcp-login note scoped to GCP platform
Co-Authored-By: default avatarClaude Sonnet 4.6 <noreply@anthropic.com>
parent c4ee21e4

skills/otica/otica-migrate-tf/SKILL.md

+3 −3
Original line number Diff line number Diff line
@@ -280,13 +280,13 @@ For flat repos (no `common/` — e.g. `gitlab-tf`), place `tools.txt` at the pro 
`tf-render` is where gomplate calls `vault-kv` and where the Vault Terraform provider token is first needed. OTICA's chain is `tf-plan → tf-init → tf-render`, so `tf-render` runs **before** `tf-init`'s recipe — a `vault-login` prereq on `tf-init` fires after vault is already needed.



```makefile

tf-init: gcp-login ## initialize terraform

tf-init: gcp-login ## initialize terraform   # GCP platform only

tf-render: vault-login

```



**`gcp-login` stays on `tf-init`** — that's when `terraform init` hits the GCS backend, which needs GCP ADC. `tf-render` makes no GCP API calls.

**`gcp-login` on `tf-init` is GCP-platform-specific** — it covers `terraform init` hitting the GCS state backend, which needs GCP ADC. Non-GCP repos have no `gcp-login` on `tf-init`. Either way, `tf-render` makes no GCP API calls — do not move `gcp-login` there.



If an existing repo has `tf-init: gcp-login vault-login`, move `vault-login` to `tf-render`:

If an existing GCP repo has `tf-init: gcp-login vault-login`, move only `vault-login` to `tf-render`:



```diff

- tf-init: gcp-login vault-login ## initialize terraform