terraform.yml

name: 'Terraform'

on:
  push:
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:
    inputs:
      name:
        description: "Manual deploy"
        default: "Manual deploy"
        
env:
  TF_CLOUD_ORGANIZATION: "${{ vars.BMB_TF_ORGANIZATION }}"
  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
  TF_WORKSPACE: "${{ vars.TF_WORKSPACE }}"
  CONFIG_DIRECTORY: "./"

jobs:

  test:
    name: 'Test'
    runs-on: ubuntu-latest
    environment: dev

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v4

    # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

    - name: Terraform fmt
      id: fmt
      run: terraform fmt -check
      
    - name: Terraform Init
      id: init
      run: terraform init
    
    - name: Terraform Validate
      id: validate
      run: terraform validate

    - name: Terraform Test
      run: terraform test

  terraform-plan:
    if: github.event_name == 'pull_request'
    needs: [test]
    environment: dev
    name: "Terraform Plan & Update PR"
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create .auto.tfvars file
        run: |
          cat <<EOF > eks.auto.tfvars
          eks_vpc_name = "${{ vars.BMB_EKS_CLUSTER_VPC }}"
          cluster_name = "${{ vars.BMB_EKS_CLUSTER_NAME }}"
          nlb_name = "${{ vars.BMB_INTERNAL_LB_NAME }}"
          EOF

      - name: Upload Configuration
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
        id: plan-upload
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          directory: ${{ env.CONFIG_DIRECTORY }}
          speculative: true

      - name: Create Plan Run
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
        id: plan-run
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
          plan_only: true

      - name: Get Plan Output
        uses: hashicorp/tfc-workflows-github/actions/plan-output@v1.3.1
        id: plan-output
        with:
          plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}

      - name: Update PR
        uses: actions/github-script@v7
        id: plan-comment
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
            });
            const output = `#### Terraform Cloud Plan Output
               \`\`\`
               Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
               \`\`\`
               [Terraform Cloud Plan](${{ steps.plan-run.outputs.run_link }})
               `;
            // 3. Delete previous comment so PR timeline makes sense
            if (botComment) {
              github.rest.issues.deleteComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
              });
            }
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            });

  deploy:
    if: github.ref == 'refs/heads/main'
    needs: [test]
    name: "Terraform Apply"
    runs-on: ubuntu-latest
    environment: dev
    permissions:
      contents: read
    outputs:
      CONFIG_VERSION: ${{ steps.apply-upload.outputs.configuration_version_id }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create .auto.tfvars file
        run: |
          cat <<EOF > eks.auto.tfvars
          eks_vpc_name = "${{ vars.BMB_EKS_CLUSTER_VPC }}"
          cluster_name = "${{ vars.BMB_EKS_CLUSTER_NAME }}"
          nlb_name = "${{ vars.BMB_INTERNAL_LB_NAME }}"
          EOF

      - name: Upload Configuration
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
        id: apply-upload
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          directory: ${{ env.CONFIG_DIRECTORY }}

      - name: Create Apply Run
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
        id: apply-run
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
          message: "Create Run from GitHub Actions CI ${{ github.sha }}"

      - uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.3.1
        if: ${{ vars.TF_AUTO_APPROVE == 'true' }}
        id: apply
        with:
          run: ${{ steps.apply-run.outputs.run_id }}
          comment: "Confirmed from GitHub Actions CI ${{ github.sha }}"

  destroy-plan:
    name: "Create terraform destroy plan"
    needs: [deploy]
    runs-on: ubuntu-latest
    environment: dev
    steps:
      - name: Create plan
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
        id: destroy-plan
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ needs.deploy.outputs.CONFIG_VERSION }}
          is_destroy: true