schedule_refresh.yaml

---
name: Trigger on schedule (cron) event with fmt/validate checks to open an issue on configuration drift.

on:
  schedule:
    - cron: "0 */8 * * 1-5" # Every 8 hours on weekdays.

jobs:
  tf:
    runs-on: ubuntu-latest

    permissions:
      actions: read        # Required to identify workflow run.
      checks: write        # Required to add status summary.
      contents: read       # Required to checkout repository.
      issues: write        # Required to open issue.
      pull-requests: write # Required to add comment and label.

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup TF
        uses: hashicorp/setup-terraform@v3

      - name: Provision TF
        id: provision
        uses: devsectop/tf-via-pr@v12
        with:
          command: plan
          arg-lock: false
          arg-refresh-only: true
          working-directory: path/to/directory
          plan-encrypt: ${{ secrets.PASSPHRASE }}
          format: true
          validate: true

      - name: Open issue on drift
        if: steps.provision.outputs.exitcode != 0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          diff: ${{ steps.provision.outputs.diff }}
          run: ${{ steps.provision.outputs.run-url }}
          result: ${{ steps.provision.outputs.result }}
          summary: ${{ steps.provision.outputs.summary }}
        run: |
          gh api /repos/{owner}/{repo}/issues \
            --method POST \
            --field title="Configuration drift detected" \
            --field body="[View log.]($run)
          <details><summary>Diff of changes.</summary>

          \`\`\`diff
          $diff
          \`\`\`
          </details>
          <details><summary>$summary</summary>

          \`\`\`hcl
          $result
          \`\`\`
          </details>"