terraform.yaml

name: "Terraform Infrastructure Change Management Pipeline with GitHub Actions"

on:
  push:
    branches:
      - prod
      - main
  pull_request:
    branches:
      - prod
      - main

env:
  # verbosity setting for Terraform logs
  TF_LOG: INFO
  # environment
  IS_PROD: ${{ ((github.ref_name == 'prod') || (github.base_ref == 'prod')) }}
  # Terraform workspace is prod when pushing or merging to prod branch, otherwise dev
  TF_WORKSPACE: ${{ ((github.ref_name == 'prod') || (github.base_ref == 'prod')) && 'prod' || 'dev' }}
  TF_VAR_harbor_username: ${{ secrets.HARBOR_USER }}
  TF_VAR_harbor_password: ${{ secrets.HARBOR_PASSWORD }}
  TF_VAR_azure_app_client_secret: ${{ secrets.AZURE_APP_CLIENT_SECRET }}
  TF_VAR_azure_app_client_id: ${{ secrets.AZURE_APP_CLIENT_ID }}
  TF_VAR_azure_app_tenant_id: ${{ secrets.AZURE_APP_TENANT_ID }}
  TF_VAR_app_secret_key: ${{ secrets.APP_SECRET_KEY }}
  TF_VAR_app_domain: ${{ ((github.ref_name == 'prod') || (github.base_ref == 'prod')) && 'deltares-fairdata.com' || 'test.deltares-fairdata.com' }}
  AWS_REGION: eu-west-1

jobs:
  terraform:
    name: "Terraform Infrastructure Change Management"
    runs-on: ubuntu-latest
    environment: ${{ ((github.ref_name == 'prod') || (github.base_ref == 'prod')) && 'prod' || 'dev' }}
    defaults:
      run:
        shell: bash
        # We keep Terraform files in the terraform directory.
        working-directory: ./infra
    permissions:
      issues: write
      pull-requests: write
      contents: read
      id-token: write

    steps:
      - name: Checkout the repository to the runner
        uses: actions/checkout@v2
      - name: Configure AWS credentials from Test account
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::654654181948:role/github-actions-terraform-role
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Terraform with specified version on the runner
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.5.7

      - name: Terraform init
        id: init
        run: |
          terraform init

      - name: Terraform format
        id: fmt
        run: terraform fmt -check

      - name: Terraform validate
        id: validate
        run: terraform validate

      - name: Terraform plan
        id: plan
        if: github.event_name == 'pull_request'
        run: terraform plan -no-color -input=false
        continue-on-error: true

      - uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            })
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
            })

            // 2. Prepare format of the comment
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
            <details><summary>Validation Output</summary>

            \`\`\`\n
            ${{ steps.validate.outputs.stdout }}
            \`\`\`

            </details>

            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>

            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`./infra\`, Workflow: \`${{ github.workflow }}\`*`;

            // 3. If we have a comment, update it, otherwise create a new one
            if (botComment) {
              github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
              })
            } else {
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              })
            }

      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Terraform Apply
        if: github.event_name == 'push'
        run: terraform apply -auto-approve -input=false