deploy.yml

name: 'Deploy'

on:
  push:
    branches: [ "main" ]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write

jobs:
  terraform:
    name: 'Validate & Lint, Plan, Apply'
    runs-on: ubuntu-latest
    environment: production

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3

    # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v1
      with:
        terraform_version: 1.5.7

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      id: init
      run: terraform init
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        AWS_S3_ENDPOINT: ${{ vars.AWS_S3_ENDPOINT }}
        KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
        TF_VAR_hcloud_api_token: ${{ secrets.TF_VAR_HCLOUD_API_TOKEN }}
        TF_VAR_hosttech_dns_token: ${{ secrets.TF_VAR_HOSTTECH_DNS_TOKEN }}
        TF_VAR_hosttech_dns_zone_id: ${{ vars.TF_VAR_HOSTTECH_DNS_ZONE_ID }}

    - name: Terraform Validate
      id: validate
      run: terraform validate -no-color

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Format
      id: fmt
      run: terraform fmt -check


    # Generates an execution plan for Terraform
    - name: Terraform Plan
      id: plan
      run: terraform plan -input=false -no-color
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        AWS_S3_ENDPOINT: ${{ vars.AWS_S3_ENDPOINT }}
        KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
        TF_VAR_hcloud_api_token: ${{ secrets.TF_VAR_HCLOUD_API_TOKEN }}
        TF_VAR_hosttech_dns_token: ${{ secrets.TF_VAR_HOSTTECH_DNS_TOKEN }}
        TF_VAR_hosttech_dns_zone_id: ${{ vars.TF_VAR_HOSTTECH_DNS_ZONE_ID }}

    - uses: actions/github-script@v6
      if: github.event_name == 'pull_request'
      env:
        PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          // 1. Retrieve existing bot comments for the PR
          const { data: comments } = await github.rest.issues.listComments({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
          })
          const botComment = comments.find(comment => {
            return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
          })

          // 2. Prepare format of the comment
          const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
          #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
          #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
          <details><summary>Validation Output</summary>

          \`\`\`\n
          ${{ steps.validate.outputs.stdout }}
          \`\`\`

          </details>

          #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

          <details><summary>Show Plan</summary>

          \`\`\`\n
          ${process.env.PLAN}
          \`\`\`

          </details>

          *Pusher: @${{ github.actor }}, Workflow: \`${{ github.workflow }}\`*`;

          // 3. If we have a comment, update it, otherwise create a new one
          if (botComment) {
            github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: botComment.id,
              body: output
            })
          } else {
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })
          }
    - name: Terraform Apply
      if: github.ref == 'refs/heads/main' && ( github.event_name == 'push' || github.event_name == 'workflow_dispatch')
      run: terraform apply -auto-approve -input=false
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        AWS_S3_ENDPOINT: ${{ vars.AWS_S3_ENDPOINT }}
        KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
        TF_VAR_hcloud_api_token: ${{ secrets.TF_VAR_HCLOUD_API_TOKEN }}
        TF_VAR_hosttech_dns_token: ${{ secrets.TF_VAR_HOSTTECH_DNS_TOKEN }}
        TF_VAR_hosttech_dns_zone_id: ${{ vars.TF_VAR_HOSTTECH_DNS_ZONE_ID }}