terraform.yaml

---
name: Terraform
on:
  workflow_dispatch:
    inputs:
      apply:
        description: Perform apply after successful plan
        type: boolean
        default: false
        required: false
  push:
    branches: [main]
    paths:
      - .github/workflows/terraform.yaml
      - terraform/**
  pull_request:
    branches: [main]
    paths:
      - .github/workflows/terraform.yaml
      - terraform/**

defaults:
  run:
    working-directory: terraform/

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  B2_APPLICATION_KEY_ID: ${{ secrets.B2_APPLICATION_KEY_ID }}
  B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}
  TF_VAR_netmaker_access_key: ${{ secrets.NETMAKER_ACCESS_KEY }}

# Only run 1 Terraform plan/apply at a time
concurrency: ${{ github.workflow }}

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          # renovate: datasource=github-releases depName=hashicorp/terraform
          terraform_version: v1.6.4
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform fmt
        id: fmt
        run: terraform fmt -no-color -check

      - name: Terraform Init
        id: init
        run: terraform init -no-color

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color -out=tf.plan

      - name: Terraform Apply
        id: apply
        if: |
          steps.plan.outcome == 'success' &&
          ((github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event.inputs.apply)
        run: terraform apply -no-color -input=false tf.plan

      - name: Find existing PR comment
        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
        id: fc
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: github-actions[bot]
          body-includes: Terraform Summary
        if: github.event_name == 'pull_request'

      - name: Create or update PR comment
        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          edit-mode: replace
          body: |
            ## Terraform Summary

            #### Terraform Format and Style 🖌 `${{ steps.fmt.outcome }}`
            #### Terraform Initialization ⚙️ `${{ steps.init.outcome }}`
            #### Terraform Validation 🤖 `${{ steps.validate.outcome }}`

            <details><summary>Validation output</summary>

            ```
            ${{ steps.validate.outputs.stdout }}
            ```

            </details>

            #### Terraform Plan 📖 `${{ steps.plan.outcome }}`

            <details><summary>Plan output</summary>

            ```
            ${{ steps.plan.outputs.stdout }}
            ```

            </details>
        if: always() && github.event_name == 'pull_request'