terraform-plan.yml

name: terraform plan

on:
  pull_request:
    branches:
      - main
      - develop
    paths:
      - .github/workflows/terraform-plan.yml
      - terraform/**
      - cloudformation/**
  workflow_dispatch:
    inputs:
      environment:
        description: "Target environment"
        required: true
        default: "test"
        type: choice
        options:
          - test
  workflow_call:
    inputs:
      environment:
        required: true
        default: "test"
        type: string
      store_plan:
        required: false
        type: boolean

jobs:
  plan:
    runs-on: ubuntu-24.04

    # Related
    # - https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
    # - https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps
    permissions:
      id-token: write # Required for aws-actions/configure-aws-credentials
      contents: read # Required for aws-actions/configure-aws-credentials
      pull-requests: write # Required for actions/github-script

    environment: terraform-${{ inputs.environment || 'test' }}

    steps:
      - uses: actions/checkout@v4.2.2

      - name: Read .terraform-version
        id: terraform_version
        run: echo "value=$(cat .terraform-version)" >> $GITHUB_OUTPUT
        working-directory: terraform

      - uses: hashicorp/setup-terraform@v3.1.2
        with:
          terraform_version: "${{ steps.terraform_version.outputs.value }}"

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          role-to-assume: ${{ vars.IAM_ROLE_ARN }}
          aws-region: eu-central-1

      - name: terraform init
        run: terraform init -backend-config=${{ inputs.environment || 'test' }}.s3.tfbackend
        working-directory: terraform

      - name: terraform plan
        run: terraform plan -no-color -out=tfplan
        working-directory: terraform
        id: plan
        continue-on-error: true
        env:
          TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          TF_VAR_api_subdomain: ${{ vars.API_SUBDOMAIN }}
          TF_VAR_email_function_parameters: ${{ secrets.EMAIL_FUNCTION_PARAMETERS }}

      - uses: actions/github-script@v7.0.1
        if: github.event_name == 'pull_request'
        env:
          PLAN: ${{ steps.plan.outputs.stdout }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            })

            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Plan')
            })

            // 2. Prepare format of the comment
            const output = `#### Terraform Plan 📖 \`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>`

            // 3. If we have a comment, update it, otherwise create a new one
            if (botComment) {
              github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
              })
            } else {
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              })
            }

      - name: Break on terraform plan failure
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Store artifact
        uses: actions/upload-artifact@v4.6.0
        if: inputs.store_plan || false
        with:
          name: tfplan
          path: terraform/tfplan
          retention-days: 1