From bb87df35c1e3b7b3564d6b6bc875ad2c9ca9f37c Mon Sep 17 00:00:00 2001
From: Dave Arnold <user@example.com>
Date: Wed, 24 Jun 2026 13:11:07 -0400
Subject: [PATCH] fix: add SSH-to-HTTPS git insteadOf config for terraform
 module pulls (CSVDIES-10219)

---
 action.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/action.yml b/action.yml
index 89a90b7..e3a32da 100644
--- a/action.yml
+++ b/action.yml
@@ -17,6 +17,16 @@ inputs:
     default: false
   init_args:
     required: false
+  github_app_pem_file:
+    required: false
+    description: "GitHub App PEM file for SSH-to-HTTPS git rewrite during terraform init"
+  github_app_installation_id:
+    required: false
+    description: "GitHub App Installation ID for SSH-to-HTTPS git rewrite during terraform init"
+  github_app_id:
+    required: false
+    default: "6"
+    description: "GitHub App ID for SSH-to-HTTPS git rewrite during terraform init"
   commit_sha:
     required: false
   cache_bucket:
@@ -72,6 +82,22 @@ runs:
       run: |
         echo "TF_WORKSPACE=${{ inputs.workspace }}" >> $GITHUB_ENV
 
+    - name: Setup GITHUB Credentials
+      id: github_credentials
+      if: ${{ inputs.github_app_pem_file != '' }}
+      uses: CSVD/gh-auth@main
+      with:
+        github_app_pem_file: ${{ inputs.github_app_pem_file }}
+        github_app_installation_id: ${{ inputs.github_app_installation_id }}
+        github_app_id: ${{ inputs.github_app_id }}
+
+    - name: Configure Git HTTPS for Terraform module pulls
+      if: ${{ inputs.github_app_pem_file != '' }}
+      shell: bash
+      run: |
+        git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:"
+        git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "ssh://git@github.e.it.census.gov/"
+
     - name: Terraform Init
       id: init_state
       if: ${{ inputs.terraform_init == 'true' && inputs.backend_config != '' }}