sandbox.yml

name: Sandbox

on:
  workflow_dispatch:
  pull_request:
    types:
      - opened
      - synchronize
    paths-ignore:
      - "**.md"

# For reusable workflows, the permissions setting for id-token should be set to write at the
# caller workflow level or in the specific job that calls the reusable workflow.

permissions:
  contents: read
  id-token: write

jobs:
  main:
    name: Main
    uses: ./.github/workflows/plan-and-apply.yml
    if: github.actor != 'dependabot[bot]'
    with:
      checkout_ref: ${{ github.ref }}
      environment: sandbox
      github_environment: "Sandbox: Main"
      service_account: plt-lz-testing-github@plt-lz-terraform-tf00-sb.iam.gserviceaccount.com
      terraform_plan_args: -var-file=tfvars/sandbox.tfvars
      terraform_state_bucket: plt-lz-testing-4312-sb
      terraform_version: ${{ vars.TERRAFORM_VERSION }}
      terraform_workspace: main-sandbox
      working_directory: tests/plan-and-apply
      workload_identity_provider: projects/746490462722/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
    secrets:
      gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
      infracost_api_key: ${{ secrets.INFRACOST_API_KEY }}