From 542541521d5c906543cc5c74bce12965a32a36f4 Mon Sep 17 00:00:00 2001
From: Kkhandale2024 <kalyani.khandale@clouddrove.com>
Date: Mon, 27 Jul 2026 17:43:15 +0530
Subject: [PATCH 1/2] fix: load environment variables for terraform checks

---
 .github/workflows/tf-checks.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/tf-checks.yml b/.github/workflows/tf-checks.yml
index a221b580..16d227d5 100644
--- a/.github/workflows/tf-checks.yml
+++ b/.github/workflows/tf-checks.yml
@@ -97,6 +97,9 @@ on:
       SERVICE_ACCOUNT:
         required: false
         description: 'The service account to be used'
+      env-vars:
+        required: false
+        description: Environment variables required during Terraform execution.
 
 jobs:
 
@@ -187,6 +190,14 @@ jobs:
           terraform_wrapper: false
           terraform_version: ${{ steps.set-version.outputs.tf_version }}
 
+      - name: 🌱 Set environment variables
+        run: |
+          (
+          cat <<'_EOT'
+          ${{ secrets.env-vars }}
+          _EOT
+          ) >> "$GITHUB_ENV"
+
       - name: 🧹 Terraform Format
         run: terraform fmt --recursive -check=true
 

From 1ab621a65af10c38da3c09cea92b97de61afaf2f Mon Sep 17 00:00:00 2001
From: Kkhandale2024 <kalyani.khandale@clouddrove.com>
Date: Mon, 27 Jul 2026 19:08:10 +0530
Subject: [PATCH 2/2] fix(tf-check): updated tf-checks.md

---
 .github/workflows/tf-checks.yml |  4 ++--
 docs/tf-checks.md               | 34 +++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tf-checks.yml b/.github/workflows/tf-checks.yml
index 16d227d5..bf1574ab 100644
--- a/.github/workflows/tf-checks.yml
+++ b/.github/workflows/tf-checks.yml
@@ -190,13 +190,13 @@ jobs:
           terraform_wrapper: false
           terraform_version: ${{ steps.set-version.outputs.tf_version }}
 
-      - name: 🌱 Set environment variables
+      - name: 🌱 Set environment variables    
         run: |
           (
           cat <<'_EOT'
           ${{ secrets.env-vars }}
           _EOT
-          ) >> "$GITHUB_ENV"
+          ) >> "$GITHUB_ENV" 
 
       - name: 🧹 Terraform Format
         run: terraform fmt --recursive -check=true
diff --git a/docs/tf-checks.md b/docs/tf-checks.md
index ffb4554e..5f856aee 100644
--- a/docs/tf-checks.md
+++ b/docs/tf-checks.md
@@ -10,6 +10,8 @@ This workflow automates terraform checks including format, init, validate, and o
 - ✅ Optional min/max version compatibility testing
 - ✅ Support for AWS, Azure, GCP, and DigitalOcean
 - ✅ Configurable working directory and terraform version
+- ✅ Secure environment variable support using env-vars
+- ✅ Support for passing Terraform variables using TF_VAR_<variable_name>
 
 ### Usage
 
@@ -57,6 +59,36 @@ jobs:
       TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
 ```
 
+#### With Environment Variables
+
+Use the env-vars secret to securely pass environment variables to Terraform without using a .tfvars file.
+
+For Terraform input variables, use the TF_VAR_<variable_name> format.
+
+```yaml
+name: Terraform Checks with Environment Variables
+
+on:
+  push:
+    branches: [master, main]
+
+jobs:
+  terraform-checks:
+    uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@v2
+    with:
+      working_directory: './examples/complete/'
+      provider: 'aws'
+      enable_plan: true
+      show_plan: false
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      env-vars: |
+        TF_VAR_database_username=${{ secrets.DB_USERNAME }}
+        TF_VAR_database_password=${{ secrets.DB_PASSWORD }}
+
+```
+
 #### With Version Compatibility Testing
 
 ```yaml
@@ -182,6 +214,7 @@ jobs:
 | `token_format` | No | `access_token` | GCP token format (`access_token` or `id_token`) |
 | `access_token_lifetime` | No | `300s` | GCP access token lifetime |
 | `create_credentials_file` | No | `true` | Create GCP credentials file |
+| `env-vars` | No | - | Environment variables for Terraform execution, exported to `GITHUB_ENV`. |
 
 ### Secrets
 
@@ -198,3 +231,4 @@ jobs:
 | `GCP_CREDENTIALS` | No | GCP service account key JSON |
 | `WORKLOAD_IDENTITY_PROVIDER` | No | GCP Workload Identity Provider |
 | `SERVICE_ACCOUNT` | No | GCP service account email |
+| `env-vars` | No | Pass Terraform variables securely using `TF_VAR_<variable_name>`.|