tf-plan-apply.yml

---
name: 'Terraform Plan/Apply'

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

# Special permissions required for OIDC authentication
permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  terraform-plan:
    name: 'Terraform Plan'
    runs-on: ubuntu-latest
    outputs:
      tfplanExitCode: ${{ steps.tf-plan.outputs.exitcode }}

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install latest terraform version
        uses: hashicorp/setup-terraform@v3
        with:
          # We do not want the terraform wrapper that is masking the terraform plan -detailed-exitcode.
          terraform_wrapper: false

      # Initialize a new or existing Terraform working directory by creating initial files,
      # loading any remote state, downloading modules, etc.
      - name: Terraform Init
        run: >-
          terraform init
          -backend-config="username=$ZTL_USERNAME"
          -backend-config="password=$ZTL_API_TOKEN"
        env:
          ZTL_USERNAME: ${{ vars.ZTL_USERNAME }}
          ZTL_API_TOKEN: ${{ secrets.ZTL_API_TOKEN }}

      # Checks that all Terraform configuration files adhere to a canonical format
      # Will fail the build if not
      - name: Terraform Format
        run: terraform fmt -check

      # Generates an execution plan for Terraform
      # An exit code of 0 indicated no changes, 1 a terraform failure, 2 there are pending changes.
      - name: Terraform Plan
        id: tf-plan
        run: |
          export exitcode=0
          terraform plan -detailed-exitcode -no-color -out tfplan || export exitcode=$?

          echo "exitcode=$exitcode" >> $GITHUB_OUTPUT

          if [ $exitcode -eq 1 ]; then
            echo Terraform Plan Failed!
            exit 1
          else
            exit 0
          fi
        env:
          TF_VAR_fqdn: ${{ vars.ZTL_FQDN }}
          TF_VAR_api_token: ${{ secrets.ZTL_API_TOKEN }}

      # Save plan to artifacts
      - name: Publish Terraform Plan
        uses: actions/upload-artifact@v4
        with:
          name: tfplan
          path: ./tfplan

      # Create string output of Terraform Plan
      - name: Create String Output
        id: tf-plan-string
        run: |
          TERRAFORM_PLAN=$(terraform show -no-color tfplan)
          NEWLINE=$'\n'
          [ ${#TERRAFORM_PLAN} -gt 32768 ] && TERRAFORM_PLAN="${TERRAFORM_PLAN:0:32750}$NEWLINE--- TRUNCATED ---"

          delimiter="$(openssl rand -hex 8)"
          echo "summary<<${delimiter}" >> $GITHUB_OUTPUT
          echo "## Terraform Plan Output" >> $GITHUB_OUTPUT
          echo "<details><summary>Click to expand</summary>" >> $GITHUB_OUTPUT
          echo "" >> $GITHUB_OUTPUT
          echo '```terraform' >> $GITHUB_OUTPUT
          echo "$TERRAFORM_PLAN" >> $GITHUB_OUTPUT
          echo '```' >> $GITHUB_OUTPUT
          echo "</details>" >> $GITHUB_OUTPUT
          echo "${delimiter}" >> $GITHUB_OUTPUT

      # Publish Terraform Plan as task summary
      - name: Publish Terraform Plan to Task Summary
        env:
          SUMMARY: ${{ steps.tf-plan-string.outputs.summary }}
        run: |
          echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY

      # If this is a PR post the changes
      - name: Push Terraform Output to PR
        if: github.ref != 'refs/heads/main'
        uses: actions/github-script@v7
        env:
          SUMMARY: "${{ steps.tf-plan-string.outputs.summary }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const body = `${process.env.SUMMARY}`;
            github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: body
            })

  terraform-apply:
    name: 'Terraform Apply'
    if: github.ref == 'refs/heads/main' && needs.terraform-plan.outputs.tfplanExitCode == 2
    runs-on: ubuntu-latest
    needs: [terraform-plan]

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install latest terraform version
        uses: hashicorp/setup-terraform@v3
        with:
          # We do not want the terraform wrapper. Too much magic.
          terraform_wrapper: false

      # Initialize a new or existing Terraform working directory by creating initial files,
      # loading any remote state, downloading modules, etc.
      - name: Terraform Init
        run: >-
          terraform init
          -backend-config="username=$ZTL_USERNAME"
          -backend-config="password=$ZTL_API_TOKEN"
        env:
          ZTL_USERNAME: ${{ vars.ZTL_USERNAME }}
          ZTL_API_TOKEN: ${{ secrets.ZTL_API_TOKEN }}

      # Download saved plan from artifacts
      - name: Download Terraform Plan
        uses: actions/download-artifact@v4
        with:
          name: tfplan

      # Terraform Apply
      - name: Terraform Apply
        run: terraform apply -auto-approve tfplan