terraform.yml

name: terraform-plan

# NOTE: won't have access to secrets on PR from forks.

on:
  push:
    branches:
      - 'master'
    tags:
      - 'v*'
    paths-ignore:
      - 'README.md'
  pull_request:
    branches:
      - 'master'

jobs:
  run-terraform:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        use_vpc: ['false', 'true']
    defaults:
      run:
        working-directory: terraform
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.3.7

      - name: Terraform Init
        id: init
        run: terraform init

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform Plan
        id: plan
        run: |
          terraform plan -no-color -input=false -refresh=false \
              -var test_google_access_token="abcxyz" \
              -var app_title="Custom CRMint Title" \
              -var iap_allowed_users='["user@example.com"]' \
              -var iap_support_email="user@example.com" \
              -var notification_sender_email="user@example.com" \
              -var project_id="my-gcp-project" \
              -var report_usage_id="abc123" \
              -var use_vpc="${{ matrix.use_vpc }}"
        continue-on-error: false

      - name: Save artifacts
        run: |
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          mkdir -p ~/pr/terraform
          echo ${{ steps.init.outcome }} > ~/pr/terraform/init_outcome
          echo "Saved init outcome"
          echo ${{ steps.validate.outcome }} > ~/pr/terraform/validate_outcome
          echo "Saved validate outcome"
          cat <<$EOF > ~/pr/terraform/validate_output
          ${{ steps.validate.outputs.stdout }}
          $EOF
          echo "Saved validate output"
          echo ${{ steps.plan.outcome }} > ~/pr/terraform/plan_outcome
          cat <<$EOF > ~/pr/terraform/plan_output
          ${{ steps.plan.outputs.stdout }}
          $EOF
          echo "Saved plan output"
        shell: bash

      - uses: actions/upload-artifact@v3
        with:
          name: pr
          path: ~/pr/terraform/