workflow.yml

name: Main

on:
  push:
    branches: [ main ]
  pull_request: { }


jobs:
  fmt:
    strategy:
      matrix:
        directory: [ ".", "modules/pubsub_channel" ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: asdf-vm/actions/install@v2
      - run: terraform fmt -check
        working-directory: ${{ matrix.directory }}

  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: asdf-vm/actions/install@v2
      - run: terraform init -backend=false
      - run: terraform validate

  plan:
    runs-on: ubuntu-latest
    needs: [fmt, validate]
    concurrency: production
    if: success() && github.ref != 'refs/heads/main'
    env:
      GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_SA_JSON }}
      GITHUB_TOKEN: ${{ secrets.TERRAFORM_GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: asdf-vm/actions/install@v2
      - run: terraform init
      - run: terraform plan

  apply:
    runs-on: ubuntu-latest
    needs: [fmt, validate]
    concurrency: production
    if: success() && github.ref == 'refs/heads/main'
    env:
      GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_SA_JSON }}
      GITHUB_TOKEN: ${{ secrets.TERRAFORM_GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: asdf-vm/actions/install@v2
      - run: terraform init
      - run: terraform apply -auto-approve