firezone/.github/workflows/_terraform.yml

name: Terraform
on:
  workflow_call:

jobs:
  plan-deploy:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      pull-requests: write
    env:
      TF_CLOUD_ORGANIZATION: "firezone"
      TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
      TF_WORKSPACE: "staging"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true
          ssh-key: ${{ secrets.ENVIRONMENTS_REPO_DEPLOY_KEY }}
      - run: ls -alR terraform/environments
      - name: Tool Versions
        id: versions
        uses: marocchino/tool-versions-action@18a164fa2b0db1cc1edf7305fcb17ace36d1c306 # v1.2.0
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: ${{ steps.versions.outputs.terraform }}
      - name: Validate cloud-init
        run: |
          sudo apt-get update
          sudo apt-get install -y cloud-init
          cloud-init schema --config-file terraform/modules/google-cloud/apps/relay/templates/cloud-init.yaml
          # This doesn't work if the file contains interpolated variables
          # cloud-init schema --config-file terraform/modules/google-cloud/apps/elixir/templates/cloud-init.yaml
      - name: Check Formatting
        working-directory: terraform
        run: |
          terraform fmt --check --recursive
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            terraform:
              - 'terraform/**'
      - if: steps.changes.outputs.terraform == 'true'
        name: Upload Configuration
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
        id: plan-upload
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          # Subdirectory is set in the project settings:
          # https://app.terraform.io/app/firezone/workspaces/staging/settings/general
          directory: "./"
          speculative: true
      - if: steps.changes.outputs.terraform == 'true'
        name: Create Plan Run
        uses: hashicorp/tfc-workflows-github/actions/create-run@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
        id: plan-run
        env:
          TF_VAR_image_tag: '"${{ github.sha }}"'
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
          plan_only: true
      - if: steps.changes.outputs.terraform == 'true'
        name: Get Plan Output
        uses: hashicorp/tfc-workflows-github/actions/plan-output@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
        id: plan-output
        with:
          plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}
      - name: Update PR
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        id: plan-comment
        if: ${{ github.event_name == 'pull_request' && steps.changes.outputs.terraform == 'true' }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
            });
            const output = `#### Terraform Cloud Plan Output

            \`\`\`
            Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
            \`\`\`

            [Terraform Cloud Plan](${{ steps.plan-run.outputs.run_link }})
            `;
            // 3. Update previous comment or create new one
            if (botComment) {
              github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
              });
            } else {
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              });
            }