What is actual benefit of adding Azure Pipelines task?

[mloskot]

Hi,

I'm hosting my IaC in GitHub repository and running Terraform with Azure Pipelines.
I'm following the Getting Started > Add to CI/CD > Azure Pipelines where the first step says

Add the Infracost tasks to your organization by clicking 'Get it free' ...

I followed that instruction, but I'm not my Azure Pipelines admin so I have to wait...

Meanwhile, I'm trying my pipeline to run Infracost for Terraform plan in JSON which failed for obvious reasons

While I'm waiting for my Azure Pipelines admin, I continue with learning more about Infracost and the Infracost Tasks documentation explains a few details:

• InfracostSetup basically installs the infracost executable
• "Enabling Infracost Cloud" causes the CLI to send its JSON output to dashboard
• There is this enableDashboard which can be used to disable sending anything to dashboard

I also look around my organization at dashboard.infracost.io and there is this message in the Organization settings > Plan and billing section:

Your plan will automatically be downgraded to the Infracost CI/CD plan after your trial expires. (...) but CLI runs and pull request comments will continue to work.

so, it seems that I can continue running infracost in CLI with enableDashboard=false and there will be no requirement of further communication between infracost and dashboard.infracost.io.

Other Infracost examples of setting it up for other CI/CD like GitLab or Jenkins, I see they do not use any bespoke solution like Infracost Tasks for Azure Pipelines, but container image image: infracost/infracost:ci-0.10.

Long story short, the setup for Azure Pipelines can also be simplified to the official manual installation:

# Downloads the CLI based on your OS/arch and puts it in /usr/local/bin
curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh

Now, let's assume that:

• I'm not interested in dashboard.infracost.io features
• I'm only interested in Infracost posting comments to my GitHub PR-s

then, why would I want to do this in my Azure Pipelines YAML files

steps:
  - task: InfracostSetup@v1
    inputs:
      apiKey: $(infracostApiKey)

instead of just grabbing the infracost-linux-amd64.tar.gz, exporting the INFRACOST_API_KEY environment variable and running infracost CLI commands?

Is my understanding correct, that the only benefit of using the InfracostSetup@v1 task is the convenience controlling Infracost with Azure Pipelines task inputs like enableDashboard, apiKey, etc.?

If that is correct, then to be honest, it would be very beneficial to explain that in the documentation. (It could potentially save devops folks lots of time waiting for their Azure Pipelines admins to accept the Infracost Tasks addition ;-))

Finally, what could those other benefits of using the Azure Pipeline's Infracost Task be?
For example, instead of requiring the GitHub PAT for posting GitHub PR comment, the task could use named Azure Pipelines to GitHub connection (OAuth), like Microsoft's GitHubComment task do. I could not find anything on that in the Infracost documentation, so I guess it is not supported.

[alikhajeh1]

@mloskot great question!

We're following a similar strategy to versioning as Terraform's CLI, so Infracost v0.9.0 to v0.10.0 had breaking changes that required you to migrate, but v0.10.1 to v0.10.2 had no breaking changes. We release a new CLI version every 2-4 weeks.

The issue with curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh is that it gets the latest version, so when we release v0.11 (which can have breaking changes), your CI/CD pipelines might break - not good!

The issue with downloading the CLI binary directly from GitHub is that you lock to an old version and don't get the latest mappings and bug fixes in patch releases. Unfortunately GitHub doesn't support SemVer range downloads.

So the main benefit of InfracostSetup@1 is that it automatically maps to the latest v0.10.x version of the Infracost CLI, so you can continue to get the latest resource mappings and bug fixes without breaking CI/CD. Using that task also sets this useful env for you and I think it does it in a way such that you don't need to set those env each time you run the CLI in your pipeline. So that task saves us having to explain all of the above and lets users get to success quickly (assuming they have permissions).

We also wrote an endpoint that returns the latest v0.10 version so you can do this if you can't/don't want to use that task: curl -O -L https://infracost.io/downloads/v0.10/infracost-linux-amd64.tar.gz (that's documented here > CLI executable).

We use to have another Azure Pipeline task to post the PR comment but we removed it and moved that logic into infracost comment. So that's why it looks odd now as there is only 1 task that installs the CLI and lets you configure the API key etc.

[mloskot]

@alikhajeh1 Apparently, great questions receive great answers! ;)

Thank you for the explanation and those are very good reasons indeed, and benefits too.

[alikhajeh1]

Thanks!