terraform.yml

name: "Terraform"

permissions:
  id-token: write
  contents: read
  
on:
  push:
    branches:
      - production
      - development
  pull_request:

jobs:
  terraform:
    permissions: write-all
    name: "Terraform"
    runs-on: ubuntu-latest
    env:
      PANOS_HOSTNAME: ${{ secrets.PANOS_HOSTNAME }}
      PANOS_USERNAME: ${{ secrets.PANOS_USERNAME }}
      PANOS_PASSWORD: ${{ secrets.PANOS_PASSWORD }}
      ASSUME_ROLE: ${{ secrets.ASSUME_ROLE }}
      AWS_REGION: "eu-west-2"
      GITHUB_REF: ${{ github.ref }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set env to development
        if: endsWith(github.ref, '/development') || endsWith(github.base_ref, 'development')
        run: |
          echo "TF_VAR_device_group_name=development" >> $GITHUB_ENV

      - name: Set env to production
        if: endsWith(github.ref, '/production') || endsWith(github.base_ref, 'production')
        run: |
          echo "TF_VAR_device_group_name=production" >> $GITHUB_ENV

      - name: Setup OPA
        uses: open-policy-agent/setup-opa@v2
        with:
          version: latest

      - name: Run OPA Tests
        id: opa_eval
        run: |
          result=$(opa eval -i policy.yml -d tests/panos.rego 'data.panos')
          echo OPA=$result >> "$GITHUB_OUTPUT"
        

      - name: Set OPA Results
        uses: actions/github-script@0.9.0
        if: github.event_name == 'pull_request'
        env:
          opa_results: ${{ steps.opa_eval.outputs.OPA }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const opa_results = JSON.parse(process.env.opa_results)
            const allow = opa_results.result[0].expressions[0].value.allow
            const deny = opa_results.result[0].expressions[0].value.deny

            if (!allow) {
              const output = `#### OPA Policy Violation 🚫
              #### Policy Violations
              
              ${deny.map(msg => `* ${msg}`).join("\n")}

              *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

                
              await github.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              })
              console.log(context)
              process.exit(1);
            }
        
      - name: configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ env.ASSUME_ROLE }}
          role-session-name: gh-action-role-session
          aws-region: ${{ env.AWS_REGION }}
          
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        # with:
          # terraform_version: 0.13.0:
          # cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform Init
        id: init
        run: terraform init

      - name: Terraform Select Workspace (Plan)
        id: ws_plan
        if: github.event_name == 'pull_request'
        run: |
          terraform workspace select ${{ github.base_ref }}
        continue-on-error: true

      - name:  Terraform Select Workspace (Apply)
        id: ws_apply
        if: github.event_name == 'push'
        run: |
          terraform workspace select ${GITHUB_REF##*/}
        continue-on-error: true

      - name: Terraform Plan
        id: plan
        if: github.event_name == 'pull_request'
        run: terraform plan -no-color
        continue-on-error: true

      - uses: actions/github-script@0.9.0
        if: github.event_name == 'pull_request'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`${process.env.PLAN}\`\`\`

            </details>

            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

              
            github.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

      - name: Auto Merge
        uses: actions/github-script@0.9.0
        if: github.event_name == 'pull_request'
        env:
          opa_results: ${{ steps.opa_eval.outputs.OPA }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const opa_results = JSON.parse(process.env.opa_results)
            const allow = opa_results.result[0].expressions[0].value.allow

            if (allow) {
              const output = `#### Validation Checks Passed ✅

              *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

              await github.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              })

              /*
              await github.pulls.merge({
                pull_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo
              })
              */              
              
            }

      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Terraform Apply
        if: github.event_name == 'push'
        run: terraform apply -auto-approve