plan.yml

name: Terraform Plan

on:
  pull_request:
    branches:
      - main
env:
  TF_VAR_project: ${{ secrets.GCLOUD_PROJECT }}
jobs:
  terraform:
    name: Run Terraform Plan
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Install Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: 1.5.7

    - name: lint
      run: terraform fmt *.tf modules/*/*.tf
      shell: bash

    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v1
      with:
        version: 'latest'

    - name: Authenticate to Google Cloud
      id: 'auth'
      uses: google-github-actions/auth@v1
      with:
        workload_identity_provider: ${{ secrets.GCLOUD_OIDC_POOL }}
        service_account: ${{ secrets.GSA }}
        token_format: 'access_token'

    - name: Configure gcloud
      run: |
        gcloud config set project ${{ secrets.GCLOUD_PROJECT }}
        gcloud config set disable_prompts true

    - uses: 'docker/login-action@v3'
      name: 'Docker login'
      with:
        registry: 'us-docker.pkg.dev'
        username: 'oauth2accesstoken'
        password: '${{ steps.auth.outputs.access_token }}'

    - name: Terraform Init
      run: terraform init -upgrade

    - name: Terraform Plan
      id: plan
      run: |
        out="$(terraform plan -no-color)"
        out="${out//'%'/'%25'}"
        out="${out//$'\n'/'%0A'}"
        out="${out//$'\r'/'%0D'}"
        echo "::set-output name=plan::$out"
      continue-on-error: true

    - uses: actions/github-script@v5
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const output = `#### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
          <details><summary>Show Plan</summary>

          \`\`\`terraform\n
          ${{ steps.plan.outputs.plan }}
          \n\`\`\`

          </details>

          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: output
          })