terraform.yaml

name: Terraform

on:
  workflow_dispatch:
  push:
    branches:
    - dev
    - main
    - ssoteam-2010
    paths:
    - terraform-ecs/**
    - loki-authorizer/**
    - .github/**

env:
  TF_VERSION: 1.1.4

jobs:
  terraform:
    permissions: write-all
    runs-on: ubuntu-20.04
    steps:
    - uses: hmarr/debug-action@v3
    - uses: actions/checkout@v4

    - name: Install asdf
      uses: asdf-vm/actions/setup@v3

    - name: Cache tools
      uses: actions/cache@v4
      with:
        path: /home/runner/.asdf
        key: ${{ runner.os }}-${{ hashFiles('**/.tool-versions') }}

    - name: Install required tools
      run: |
        cat .tool-versions | cut -f 1 -d ' ' | xargs -n 1 asdf plugin-add || true
        asdf plugin-update --all
        asdf install
        asdf reshim
      shell: bash

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.TERRAFORM_DEPLOY_ROLE_ARN }}
        aws-region: ca-central-1

    - name: Terraform Init
      id: init
      run: terraform init -upgrade
      working-directory: ./terraform

    - name: Terraform Plan
      id: plan
      if: github.event_name == 'pull_request'
      run: terraform plan -var "auth_secret=fake_secret_for_testing" -no-color
      working-directory: ./terraform
      continue-on-error: true