terraform.yaml

name: Terraform CI/CD

on:
  pull_request:
    branches:
    - main
    paths:
    - terraform/**
  push:
    branches:
    - main

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  terraform:
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        workspace: [
          "245582572290/us-east-1/sandbox/eks"
        ]
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      TF_IN_AUTOMATION: true
      TF_VARS_PATH: ${{ matrix['workspace'] }}
      TF_DIR: services/eks
    steps:
    - uses: actions/checkout@v4
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::245582572290:role/lgtm-GHA
        aws-region: us-east-1
    # https://github.com/hashicorp/setup-terraform/issues/298
    - name: Get Terraform Version
      id: tf_version
      run: |
        echo "value=$(cat .terraform-version)" >> $GITHUB_OUTPUT
    - uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: ${{ steps.tf_version.outputs.value }}

    - name: Terraform Init - ${{ env.TF_DIR }} -> ${{ matrix['workspace'] }}
      id: init
      run: terraform -chdir=terraform/${TF_DIR} init -backend-config="key=${TF_VARS_PATH}"

    - name: Post Init - ${{ env.TF_DIR }} -> ${{ matrix['workspace'] }}
      if: always() && github.ref != 'refs/heads/main' && (steps.init.outcome == 'success' || steps.init.outcome == 'failure')
      uses: Jimdo/terraform-pr-commenter@main
      with:
        commenter_type: init
        commenter_input: ${{ format('{0}{1}', steps.init.outputs.stdout, steps.init.outputs.stderr) }}
        commenter_exitcode: ${{ steps.init.outputs.exitcode }}

    - name: Terraform Plan - ${{ env.TF_DIR }} -> ${{ matrix['workspace'] }}
      id: plan
      run: terraform -chdir=terraform/${TF_DIR} plan -out ${TF_VARS_PATH//\//-}.plan -var-file=../../environments/${TF_VARS_PATH}/terraform.tfvars

    - name: Post Plan - ${{ env.TF_DIR }} -> ${{ matrix['workspace'] }}
      if: always() && github.ref != 'refs/heads/main' && (steps.plan.outcome == 'success' || steps.plan.outcome == 'failure')
      uses: Jimdo/terraform-pr-commenter@main
      with:
        commenter_type: plan
        commenter_input: ${{ format('{0}{1}', steps.plan.outputs.stdout, steps.plan.outputs.stderr) }}
        commenter_exitcode: ${{ steps.plan.outputs.exitcode }}

    - name: Terraform Apply - ${{ env.TF_DIR }} -> ${{ matrix['workspace'] }}
      id: apply
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: terraform -chdir=terraform/${TF_DIR} apply ${TF_VARS_PATH//\//-}.plan