Public-works IaC jobs fail because runners lack Terraform and cloud CLIs. What CI environment practice fixes that?
Select an answer to reveal the explanation.
Short Explanation
Think of the runner like a fully stocked public-works truck—if the wrench kit (CLIs) isn't on board, the IaC job can't fix the road. Bake Terraform and cloud tools into the runner image or bootstrap so every build starts ready.
Full Explanation
CI environment provisioning equips pipeline agents with the toolchains jobs actually invoke before those jobs start. In public-works IaC pipelines, that means a prepared runner image or an agent bootstrap that installs Terraform and the required cloud CLIs so every job starts from a known, complete toolkit rather than hoping the host already has the right binaries. The correct practice works because IaC apply and plan steps are CLI-driven: if the runner lacks Terraform or cloud authentication tooling, the job fails for environmental reasons unrelated to the change under test, and engineers cannot trust red or green as a signal about infrastructure code quality.
Asking each engineer to install tools only on personal laptops and skip runners fails because laptop-only tooling is not the execution environment the pipeline uses; it also creates drift, unreviewed local credentials, and builds that cannot be reproduced by another operator or by overnight automation. Deleting the pipeline and applying infrastructure by hand in the production console fails conceptually because it abandons continuous integration and controlled promotion for ad-hoc console changes that leave no durable job history, peer review gate, or consistent state reconciliation. Storing cloud API keys in the Git commit message so jobs can scrape them later fails on both secrets management and provisioning: commit messages are not a secret store, are widely replicated, and do not install missing CLIs on the runner.
Exam caveat: baking every conceivable tool into one mega-image can slow pulls and widen the attack surface; pin versions to what municipal IaC jobs need and refresh images on a controlled cadence. Operational check: for a public-works pipeline, verify a clean runner can run terraform version and the cloud CLI identity command without manual install steps, confirm the image or bootstrap is referenced by the job definition, and ensure credentials come from the vault or CI secret store—not from the repository.