tf_plan.yml

name: Terraform plan
on:
  workflow_dispatch:
  pull_request:
    paths:
      - "terragrunt/**"
      - ".github/workflows/**"
env:
  AWS_REGION: ca-central-1
  TERRAFORM_VERSION: 1.8.2
  TERRAGRUNT_VERSION: 0.58.3
  TF_VAR_api_auth_token: ${{ secrets.TF_VARS_API_AUTH_TOKEN }}
  TF_VAR_notify_key: ${{ secrets.TF_VARS_NOTIFY_KEY }}
  TF_VAR_rds_password: ${{ secrets.TF_VARS_RDS_PASSWORD }}
  TF_VAR_slack_webhook_url: ${{ secrets.TF_VARS_SLACK_WEBHOOK_URL }}

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  terraform-plan:
    strategy:
      fail-fast: false
      matrix:
        include:
          - module: api
          - module: hosted_zone

    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Configure AWS credentials using OIDC
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/list-manager-plan
          role-session-name: TFPlan
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup terraform tools
        uses: cds-snc/terraform-tools-setup@v1

      - name: Terraform plan
        uses: cds-snc/terraform-plan@4719878d72d1b0078e0bce2e7571e854e79903b8 # v3.2.2
        with:
          comment-delete: true
          comment-title: Plan for ${{ matrix.module }}
          directory: ./terragrunt/env/${{ matrix.module }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          terragrunt: true