pr-terraform.yml

name: Terraform

on:
  pull_request:
    paths:
      - 'examples/**'
      - 'tests/**'
      - '**.tf'
  repository_dispatch:
    types: [ ok-to-test-command ]


jobs:
  # Branch-based pull request
  terraform-trusted:
    name: terraform-branch
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      pull-requests: write
    timeout-minutes: 15
    env:
      TF_IN_AUTOMATION: true
      TFDIR: examples
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - name: Branch based PR checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        if: startsWith(github.repository, 'ventx/terraform-aws-')
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
          role-to-assume: ${{ secrets.AWS_GH_OIDC }}

      - name: Set Versions
        run: |
          TFVER=$(grep .tool-versions -e "terraform" | sed "s/terraform \(.*\)/\1/")
          echo "TFVERSION=$TFVER" >> $GITHUB_ENV

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          terraform_version: ${{ env.TFVERSION }}

      - name: Terraform Format
        id: fmt
        run: terraform fmt -check -recursive
        continue-on-error: true

      - name: Terraform Init (test)
        id: init-test
        run: terraform init

      - name: Terraform Test
        id: test
        run: terraform test -verbose
        continue-on-error: true

      - name: Terraform Init (examples)
        id: init
        run: terraform -chdir=${{ env.TFDIR }} init

      - name: Terraform Validate
        id: validate
        run: terraform -chdir=${{ env.TFDIR }} validate -no-color

      - name: Terraform Plan
        id: plan
        run: terraform -chdir=${{ env.TFDIR }} plan -no-color -input=false
        continue-on-error: true

      - name: Update Pull Request
        uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>

            *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })




  # User with write access has commented /ok-to-test on a (fork-based) pull request
  terraform-fork:
    name: terraform-fork
    runs-on: ubuntu-latest
    permissions:
      checks: write
      id-token: write
      pull-requests: write
    timeout-minutes: 15
    env:
      TF_IN_AUTOMATION: true
      TFDIR: examples
    if: |
      github.event_name == 'repository_dispatch' &&
      github.event.client_payload.slash_command.args.named.sha != '' &&
      contains(
        github.event.client_payload.pull_request.head.sha,
        github.event.client_payload.slash_command.args.named.sha
      )
    steps:
      - name: Fork based /ok-to-test checkout
        uses: actions/checkout@v4
        with:
          ref: 'refs/pull/${{ github.event.client_payload.pull_request.number }}/merge'

      - name: Create check run
        uses: actions/github-script@v6
        env:
          job: ${{ github.job }}
          number: ${{ github.event.client_payload.pull_request.number }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { data: pull } = await github.rest.pulls.get({
              ...context.repo,
              pull_number: process.env.number
            });
            const sha = pull.head.sha;
            const { data: check } = await github.rest.checks.create({
              ...context.repo,
              name: process.env.job,
              head_sha: sha
            });
            return check;

      - name: Configure AWS credentials
        if: startsWith(github.repository, 'ventx/terraform-aws-')
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
          role-to-assume: ${{ secrets.AWS_GH_OIDC }}

      - name: Set Versions
        run: |
          TFVER=$(grep .tool-versions -e "terraform" | sed "s/terraform \(.*\)/\1/")
          echo "TFVERSION=$TFVER" >> $GITHUB_ENV

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          terraform_version: ${{ env.TFVERSION }}

      - name: Terraform Format
        id: fmt
        run: terraform fmt -check -recursive
        continue-on-error: true

      - name: Terraform Init (test)
        id: init-test
        run: terraform init

      - name: Terraform Test
        id: test
        run: terraform test -verbose
        continue-on-error: true

      - name: Terraform Init (examples)
        id: init
        run: terraform -chdir=${{ env.TFDIR }} init

      - name: Terraform Validate
        id: validate
        run: terraform -chdir=${{ env.TFDIR }} validate -no-color

      - name: Terraform Plan
        id: plan
        run: terraform -chdir=${{ env.TFDIR }} plan -no-color -input=false
        continue-on-error: true

      - name: Update Pull Request
        uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>

            *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

      # Update check run called "terraform-fork"
      - uses: actions/github-script@v6
        id: update-check-run
        if: ${{ always() }}
        env:
          number: ${{ github.event.client_payload.pull_request.number }}
          job: ${{ github.job }}
          # Conveniently, job.status maps to https://developer.github.com/v3/checks/runs/#update-a-check-run
          conclusion: ${{ job.status }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { data: pull } = await github.rest.pulls.get({
              ...context.repo,
              pull_number: process.env.number
            });
            const ref = pull.head.sha;

            const { data: checks } = await github.rest.checks.listForRef({
              ...context.repo,
              ref
            });

            const check = checks.check_runs.filter(c => c.name === process.env.job);

            const { data: result } = await github.rest.checks.update({
              ...context.repo,
              check_run_id: check[0].id,
              status: 'completed',
              conclusion: process.env.conclusion
            });

            return result;