github-actions/terraform.yml at master · DevSecOpsSamples/github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
name: Build
on:
  push:
    branches:
      - master
      - develop
  pull_request:
    types: [opened, synchronize, reopened]

  terraform:
    strategy:
      matrix:
        path: [src/terraform/cluster, src/terraform/workload-identity]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: HashiCorp - Setup Terraform
      uses: hashicorp/setup-terraform@v2.0.3
    - run: terraform fmt -check
      id: fmt
      working-directory: ${{ matrix.path }}
    - run: terraform init
      working-directory: ${{ matrix.path }}
      id: init
    - run: terraform validate -no-color
      working-directory: ${{ matrix.path }}
      id: validate
    - name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v1'
      with:
        credentials_json: '${{ secrets.SA }}'
    - name: Replace project-id
      uses: jacobtomlinson/gha-find-replace@v2
      with:
        find: "<dev-stage-project-id>"
        replace: ${{ secrets.PROJECT_ID }}
        include: "src/terraform/**"
        regex: false
    - name: Terraform Plan
      id: plan
      if: matrix.path == 'src/terraform/cluster'
      run: terraform plan -var-file=vars/dev.tfvars -no-color
      working-directory: ${{ matrix.path }}
    - uses: actions/github-script@v6
      if: github.event_name == 'pull_request'
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const output = `#### Working Directory: ${{ matrix.path }}

          #### Terraform Format and Style \`${{ steps.fmt.outcome }}\`

          #### Terraform Initialization \`${{ steps.init.outcome }}\`

          #### Terraform Validation \`${{ steps.validate.outcome }}\`

          <details><summary>Validation Output</summary>

          \`\`\`\n
          ${{ steps.validate.outputs.stdout }}
          \`\`\`

          </details>

          #### Terraform Plan \`${{ steps.plan.outcome }}\`

          <details><summary>Show Plan</summary>

          \`\`\`\n
          ${{ steps.plan.outputs.stdout }}
          \`\`\`

          </details>`;

          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: output
          });