general.yml

---
name: general

"on":
  workflow_dispatch:
  schedule:
    - cron: "0 5 * * *"
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  contents: read

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout source
        id: source
        uses: actions/checkout@v4

      - name: Setup terraform
        id: terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: latest

      - name: Terraform format
        id: fmt
        run: bin/terraform fmt -no-color -check

      - name: Terraform init
        id: init
        env:
          GITHUB_TOKEN: ${{ secrets.INFRA_TOKEN }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bin/terraform init -no-color -input=false

      - name: Terraform validate
        id: validate
        env:
          GITHUB_TOKEN: ${{ secrets.INFRA_TOKEN }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bin/terraform validate -no-color

      - name: Terraform plan
        id: plan
        env:
          GITHUB_TOKEN: ${{ secrets.INFRA_TOKEN }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bin/terraform plan -no-color -input=false

      - name: Terraform apply
        id: apply
        env:
          GITHUB_TOKEN: ${{ secrets.INFRA_TOKEN }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request'
        run: bin/terraform apply -no-color -input=false -auto-approve

...