terraform-publish.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Publish Terraform"

on:
  workflow_dispatch:
  push:
    branches: ["main"]
    paths: ["terraform/**"]

jobs:
  publish-terraform:
    name: Publish Terraform
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Setup Workflow Tools
        run: brew install fluxcd/tap/flux

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Lowercase repository owner
        run: |
          echo "LOWERCASE_REPO_OWNER=${GITHUB_REPOSITORY_OWNER,,}" >> "${GITHUB_ENV}"

      - name: Generate Tag
        id: generate-tag
        run: |
          echo "tag=ghcr.io/${LOWERCASE_REPO_OWNER}/manifests/terraform:$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"

      - name: Publish OCI Artifact
        run: |
          flux push artifact oci://${{ steps.generate-tag.outputs.tag }} \
              --path="./terraform" \
              --source="$(git config --get remote.origin.url)" \
              --revision="$(git branch --show-current)/$(git rev-parse HEAD)"

      - name: Tag OCI Artifact
        run: |
          flux tag artifact \
              oci://${{ steps.generate-tag.outputs.tag }} \
              --tag main