terraform.yaml

---
name: Terraform
on:
  workflow_dispatch:
    inputs:
      apply:
        description: Perform apply after successful plan
        type: boolean
        default: false
        required: false
  push:
    branches: [main]
    paths:
      - .github/workflows/terraform.yaml
      - terraform/**
  pull_request:
    branches: [main]
    paths:
      - .github/workflows/terraform.yaml
      - terraform/**

defaults:
  run:
    working-directory: terraform/

env:
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  B2_APPLICATION_KEY_ID: ${{ secrets.B2_APPLICATION_KEY_ID }}
  B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}
  TF_VAR_netmaker_access_key: ${{ secrets.NETMAKER_ACCESS_KEY }}

# Only run 1 Terraform plan/apply at a time
concurrency: ${{ github.workflow }}

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          # renovate: datasource=github-releases depName=hashicorp/terraform
          terraform_version: v1.10.4
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          aws-region: us-east-2
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Terraform fmt
        id: fmt
        run: terraform fmt -no-color -check

      - name: Terraform Init
        id: init
        run: terraform init -no-color

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color -out=tf.plan

      - name: Terraform Apply
        id: apply
        if: |
          steps.plan.outcome == 'success' &&
          ((github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event.inputs.apply)
        run: terraform apply -no-color -input=false tf.plan

      - name: Find existing PR comment
        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
        id: fc
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: github-actions[bot]
          body-includes: Terraform Summary
        if: github.event_name == 'pull_request'

      - name: Create or update PR comment
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          edit-mode: replace
          body: |
            ## Terraform Summary

            #### Terraform Format and Style 🖌 `${{ steps.fmt.outcome }}`
            #### Terraform Initialization ⚙️ `${{ steps.init.outcome }}`
            #### Terraform Validation 🤖 `${{ steps.validate.outcome }}`

            <details><summary>Validation output</summary>

            ```
            ${{ steps.validate.outputs.stdout }}
            ```

            </details>

            #### Terraform Plan 📖 `${{ steps.plan.outcome }}`

            <details><summary>Plan output</summary>

            ```
            ${{ steps.plan.outputs.stdout }}
            ```

            </details>
        if: always() && github.event_name == 'pull_request'