pr_merge_matrix.yaml

---
name: Trigger on pull_request (plan) and merge_group (apply) events with OpenTofu in matrix strategy.

on:
  pull_request:
  merge_group:

jobs:
  tf:
    runs-on: ubuntu-latest

    permissions:
      actions: read        # Required to identify workflow run.
      checks: write        # Required to add status summary.
      contents: read       # Required to checkout repository.
      pull-requests: write # Required to add comment and label.

    strategy:
      fail-fast: false
      matrix:
        deployment: [dev, qa, prod]

    environment: ${{ github.event_name == 'merge_group' && matrix.deployment || '' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup TF
        uses: opentofu/setup-opentofu@v1

      - name: Provision TF
        uses: devsectop/tf-via-pr@v12
        with:
          command: ${{ github.event_name == 'merge_group' && 'apply' || 'plan' }}
          arg-lock: ${{ github.event_name == 'merge_group' }}
          arg-var-file: env/${{ matrix.deployment }}.tfvars
          arg-workspace: ${{ matrix.deployment }}
          working-directory: path/to/${{ matrix.deployment }}
          plan-encrypt: ${{ secrets.PASSPHRASE }}
          plan-parity: true