iam-apply.yml

name: Apply(IAM mode)

on:
  push:
    branches:
      - master

jobs:
  apply:
    permissions:
      id-token: write
      pull-requests: write
    name: Apply
    runs-on: ubuntu-latest
    strategy:
      matrix:
        dir: [
          terraform/iam
        ]
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Check diff
        id: diff
        uses: technote-space/get-diff-action@v5.0.2
        with:
          PATTERNS: |
            ${{ matrix.dir }}/**/*.tf
      - name: Authenticate to GCP
        if: env. GIT_DIFF_FILTERED
        id: gcp_auth
        uses: google-github-actions/auth@v1.0.0
        with:
          create_credentials_file: 'true'
          workload_identity_provider: projects/233207969476/locations/global/workloadIdentityPools/github-action/providers/github-action-provider
          service_account: ga-iam-applier@mitou-jr.iam.gserviceaccount.com
          access_token_lifetime: 1200s

      - name: gcloud auth login by workload identity
        if: env. GIT_DIFF_FILTERED
        run: |-
          gcloud auth login --brief --cred-file="${{ steps.gcp_auth.outputs.credentials_file_path }}"

      - name: Setup terraform
        if: env. GIT_DIFF_FILTERED
        uses: hashicorp/setup-terraform@v1.3.2
        with:
          terraform_version: 1.0.11

      - name: Apply
        if: env. GIT_DIFF_FILTERED
        run: |
            cd ${{ matrix.dir }}
            terraform init
            terraform get
            terraform apply -auto-approve
        shell: bash