feat: set TF_LOG debub when GHA debug mode, but only if a log level h…

…asn't been set as an input

.github/workflows/terraform-plan-and-apply-aws.yml

@@ -177,14 +177,24 @@ env:
   AWS_READONLY_OVERRIDE_ROLE: ${{ inputs.aws-read-role-name }}
   AWS_READWRITE_OVERRIDE_ROLE: ${{ inputs.aws-write-role-name }}
   AWS_WEB_IDENTITY_TOKEN_FILE: /tmp/web_identity_token_file
-  TF_LOG: ${{ inputs.terraform-log-level }}
 
 permissions:
   id-token: write
   contents: read
   pull-requests: write
 
 jobs:
+  debug-mode:
+    name: "Debug Mode"
+    runs-on: ubuntu-latest
+    outputs:
+      tf_log: ${{ steps.debug.outputs.tf_log }}
+    steps:
+      - name: Debug Mode Vars
+        id: debug
+        run: |
+          echo "tf_log=${{ inputs.terraform-log-level || (runner.debug == true && 'DEBUG') }}" >> $GITHUB_OUTPUT
+
   commitlint:
     name: "Commitlint"
     if: github.event_name == 'pull_request' && inputs.enable-commitlint
@@ -327,12 +337,16 @@ jobs:
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
+    needs:
+      - debug-mode
     outputs:
       result-auth: ${{ steps.auth.outcome }}
       result-init: ${{ steps.init.outcome }}
       result-validate: ${{ steps.validate.outcome }}
       result-s3-backend-check: ${{ steps.s3-backend-check.outcome }}
       result-plan: ${{ steps.plan.outcome }}
+    env:
+      TF_LOG: ${{ needs.debug-mode.outputs.tf_log }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
@@ -676,10 +690,13 @@ jobs:
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
+    env:
+      TF_LOG: ${{ needs.debug-mode.outputs.tf_log }}
     needs:
       - terraform-format
       - terraform-lint
       - terraform-plan
+      - debug-mode
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4