terraform-plan.yaml

name: Terraform Plan

on:
  pull_request:
    paths:
      - 'terraform/**'
      - 'terraform/**/*.yaml'
  workflow_dispatch:

jobs:
  plan:
    runs-on: gha-runner-scale-set-kub1k
    container:
      image: quay.io/m1k_cloud/automation_docker_image:latest
    defaults:
      run:
        shell: bash
    permissions:
      contents: read
      pull-requests: write

    name: Create terraform plan
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up ssh key
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa
          eval $(ssh-agent)
          ssh-add ~/.ssh/id_rsa
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: terraform plan
        run: make plan kub1k
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
          VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}

      - name: Post plan as PR comment
        if: github.event_name == 'pull_request'
        run: make comment-pr kub1k
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}