ci.yml

name: CI

on:
  pull_request:
    branches: [main]
    types: [opened, reopened, synchronize, edited]

jobs:
  env:
    name: Set Env Vars
    runs-on: ubuntu-latest
    steps:
      - name: Set up DEV Environment Variables
        if: github.base_ref == 'main'
        run: |
          matrix='{
            "env":[
              {
                "tf_version":"1.8.0",
                "tf_working_dir":"./examples/ci-1_0",
                "aws_account":"977306314792",
                "aws_gha_role":"terraform-bastion-dev-gha"
              }
            ]
          }'
          echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV

    outputs:
      matrix: ${{ env.matrix }}

  format:
    name: Terraform Format
    runs-on: ubuntu-latest
    needs: env
    strategy:
      matrix: ${{ fromJson(needs.env.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Terraform Setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ matrix.env.tf_version }}

      - name: Terraform Format
        working-directory: "./"
        run: terraform fmt -check -recursive

  plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    needs: env
    strategy:
      matrix: ${{ fromJson(needs.env.outputs.matrix) }}
    permissions:
      contents: read
      actions: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: "arn:aws:iam::${{ matrix.env.aws_account }}:role/${{ matrix.env.aws_gha_role }}"
          role-session-name: ${{ github.sha }}
          aws-region: us-west-2

      - name: Terraform Setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ matrix.env.tf_version }}

      - name: Terraform Init
        working-directory: ${{ matrix.env.tf_working_dir }}
        run: terraform init

      - name: Terraform Plan
        working-directory: ${{ matrix.env.tf_working_dir }}
        run: terraform plan -input=false
    # TODO: Post plan back to PR