apply.yml

name: Terraform Apply

on:
  pull_request_target:
    branches:
      - main
    types:
      - closed
env:
  TF_VAR_project: ${{ secrets.GCLOUD_PROJECT }}
jobs:
  terraform:
    if: github.event.pull_request.merged == true

    name: Run Terraform Apply
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Install Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: 1.5.7

    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v1
      with:
        version: 'latest'

    - name: Authenticate to Google Cloud
      id: 'auth'
      uses: google-github-actions/auth@v1
      with:
        workload_identity_provider: ${{ secrets.GCLOUD_OIDC_POOL }}
        service_account: ${{ secrets.GSA }}
        token_format: 'access_token'

    - name: Configure gcloud
      run: |
        gcloud config set project ${{ secrets.GCLOUD_PROJECT }}
        gcloud config set disable_prompts true

    - uses: 'docker/login-action@v3'
      name: 'Docker login'
      with:
        registry: 'us-docker.pkg.dev'
        username: 'oauth2accesstoken'
        password: '${{ steps.auth.outputs.access_token }}'

    - name: Terraform Init
      run: terraform init -upgrade

    - name: Terraform Apply
      id: plan
      run: terraform apply -auto-approve