fix: truncate long lines before tfmask to prevent bufio.Scanner crash

tfmask is a Go binary that reads plan output line-by-line using
bufio.Scanner, which has a default 64KB buffer limit. Terraform resources
that embed large base64 blobs in their plan output (e.g.
google_api_gateway_api_config with openapi_documents) produce single lines
that exceed this limit.

When tfmask crashes mid-pipe, terraform receives SIGPIPE and exits with a
non-standard code (not 0 or 2). PIPESTATUS[0] then captures that bad code,
neither branch of the PLAN_EXIT check matches, set_output changes is never
called, and the apply step is skipped with "No plan changes detected".

Fix: add a Python pre-processor before tfmask that truncates any line
exceeding 65000 chars. This preserves tfmask's secret-masking for all
normal lines while preventing it from crashing on oversized blob lines.
The truncated content only affects the human-readable plan display in
plan.txt — it has no effect on whether changes are detected or applied.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bennymagid

image/actions.sh

@@ -505,6 +505,17 @@ function plan() {
     # shellcheck disable=SC2086
     (cd "$INPUT_PATH" && $TOOL_COMMAND_NAME plan -input=false -no-color -detailed-exitcode -lock-timeout=300s $PARALLEL_ARG $PLAN_OUT_ARG $PLAN_ARGS) \
         2>"$STEP_TMP_DIR/terraform_plan.stderr" \
+        | python3 -c "
+import sys
+# tfmask uses bufio.Scanner which has a 64KB line limit. Resources that embed
+# large base64 blobs (e.g. google_api_gateway_api_config openapi_documents)
+# produce lines that exceed this limit, causing tfmask to crash mid-pipe and
+# terraform to exit via SIGPIPE with a non-standard exit code. That prevents
+# PIPESTATUS[0] from returning 2 (changes), so the apply step is skipped.
+# Truncating lines here before they reach tfmask prevents the crash.
+for line in sys.stdin:
+    sys.stdout.write(line[:65000] + ' [line truncated for display]\n' if len(line) > 65000 else line)
+" \
         | $TFMASK \
         | tee /dev/fd/3 "$STEP_TMP_DIR/terraform_plan.stdout" \
         | compact_plan \