terraform.yml

name: "Terraform plan on PR and apply on merge to main"
on:
  pull_request:
    types:
      - opened
      - synchronize
      - closed
permissions:
  id-token: write # This is required for aws oidc connection
  contents: read # This is required for actions/checkout
  pull-requests: write # This is required for gh bot to comment PR
env:
  TF_LOG: INFO
  AWS_REGION: ${{ secrets.AWS_REGION }}
jobs:
  tf-plan:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: .
    steps:
      - name: Git checkout
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: "3.10"

      - name: Install Lambda (Python) dependencies
        run: |
          pip install --user pipenv
          if [ ! -d .venv ]; then
            export PIPENV_VENV_IN_PROJECT=1
            pipenv install --deploy
          else
            export PIPENV_VENV_IN_PROJECT=1
            pipenv sync
          fi

      - name: Configure AWS credentials from AWS account
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE }}
          aws-region: ${{ secrets.AWS_REGION }}
          role-session-name: GitHub-OIDC-TERRAFORM

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.9.7

      - name: Terraform fmt
        id: fmt
        run: cd terraform &&
          terraform fmt -check
        continue-on-error: false

      - name: Terraform Init
        id: init
        env:
          AWS_BUCKET_NAME: ${{ secrets.AWS_BUCKET_NAME_TFSTATE }}
          AWS_BUCKET_KEY_NAME: ${{ secrets.AWS_TFSTATE_FILE_NAME }}
        run: cd terraform &&
          terraform init -backend-config="bucket=${AWS_BUCKET_NAME}"  -backend-config="key=${AWS_BUCKET_KEY_NAME}" -backend-config="region=${AWS_REGION}"

      - name: Terraform Plan
        id: plan
        run: |
          cd terraform
          terraform plan -no-color -out=tfplan
        env:
          TF_VAR_notification_email: ${{ secrets.NOTIFICATION_EMAIL }}
          TF_VAR_api_base_url: ${{ secrets.BASE_URL }}
        continue-on-error: false

      - uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            var updatedPlan = process.env.PLAN.replace(/${{secrets.AWS_ACCOUNT_ID}}/g, '127449185323');
            updatedPlan = updatedPlan.replace(/${{secrets.AWS_BUCKET_NAME_TFSTATE}}/g, "tfstate-bucket");
            updatedPlan = updatedPlan.replace(/${{secrets.NOTIFICATION_EMAIL}}/g, "socdev@dev.com");

            process.env.PLAN = updatedPlan;
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`

            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>

            *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Terraform Apply
        if: github.event.pull_request.merged == true
        run: |
          cd terraform
          terraform apply tfplan