terraform.yml

name: Terraform Workflow

permissions:
  id-token: write
  contents: read

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  terraform-check:
    runs-on: ubuntu-latest
    env:
      TF_VAR_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
      TF_VAR_gh_username: ${{ secrets.TF_VAR_gh_username }}
      TF_VAR_user_profile_name: ${{ secrets.TF_VAR_user_profile_name }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.9.6

      - name: Terraform Format Check
        run: terraform fmt -check
  terraform-plan:
    runs-on: ubuntu-latest
    needs: terraform-check
    env:
      TF_VAR_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
      TF_VAR_gh_username: ${{ secrets.TF_VAR_gh_username }}
      TF_VAR_user_profile_name: ${{ secrets.TF_VAR_user_profile_name }}
    steps:
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.6

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/GithubActionsRole
          aws-region: us-east-1
          role-duration-seconds: 1200
      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        run: terraform plan
  terraform-apply:
    runs-on: ubuntu-latest
    needs: terraform-plan
    env:
      TF_VAR_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
      TF_VAR_gh_username: ${{ secrets.TF_VAR_gh_username }}
      TF_VAR_user_profile_name: ${{ secrets.TF_VAR_user_profile_name }}
    steps:
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.6

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/GithubActionsRole
          role-duration-seconds: 1200
          aws-region: us-east-1

      - name: Terraform Init
        run: terraform init

      - name: Terraform Apply
        run: terraform apply -auto-approve