HASH Terraform Plan #14143

	name: HASH Terraform Plan

	on:
	workflow_dispatch:
	inputs:
	env:
	type: choice
	options: ["prod"]
	description: "Environment to plan"
	required: true
	default: "prod"

	pull_request:
	merge_group:

	env:
	VAULT_ADDR: ${{ secrets.VAULT_ADDR }}

	jobs:
	matrix-eval:
	name: Prepare environments to be planned
	runs-on: ubuntu-latest
	outputs:
	matrix: ${{ steps.set-matrix.outputs.matrix }}
	steps:
	- name: Set matrix
	id: set-matrix
	env:
	ENV: ${{ github.event.inputs.env }}
	run: \|
	# We only have a single environment, so that's all we need to plan
	# TODO: use the `env` input to determine which environments to plan
	echo "matrix=[\"prod\"]" \| tee -a $GITHUB_OUTPUT

	terraform:
	runs-on: ubuntu-latest
	# The following permissions are required for the Vault step used in the
	# Terraform composite action.
	permissions:
	id-token: write
	contents: read
	needs:
	- matrix-eval
	strategy:
	matrix:
	env: ${{ fromJson(needs.matrix-eval.outputs.matrix) }}
	if: github.event.pull_request.head.repo.full_name == github.repository
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Prepare SSH key
	run: \|
	echo "${{ secrets.BASTION_SSH_KEY }}" > h-hash-prod-usea1-bastionkey.pem

	- uses: ./.github/actions/terraform-exec
	with:
	vault-address: ${{ env.VAULT_ADDR }}
	working-directory: infra/terraform/hash
	command: plan
	env: ${{ matrix.env }}

Provide feedback