pr.yml

## When copying this to a new ORC repository...
##
## 1) Create environments for dev, test, pre-prod and prod (https://github.com/nhsconnect/<repo>/settings/environments).
##
## 2) For each environment, add the following secrets:
## - BACKEND_BUCKET
## - BACKEND_KEY
## - IAM_ROLE_READONLY
##
## 3) Create the following repository secret (https://github.com/nhsconnect/<repo>/settings/secrets/actions):
## - ECR_REPOSITORY_NAME
##
## 4) Edit the ## REPOSITORY SPECIFIC ## section below.

name: Terraform Plan
on:
  pull_request:
    branches: [ main ]

permissions:
  contents: read       # Required for actions/checkout
  id-token: write      # Required for requesting the JWT
  pull-requests: write # Required to write comments

jobs:
  plan:
    strategy:
      matrix:
        environment: [dev, test, pre-prod, prod]
    name: ${{ matrix.environment }}
    runs-on: ubuntu-latest
    environment: ${{ matrix.environment }}
    defaults:
      run:
        working-directory: ./terraform
    steps:
      - name: Set up git repo
        uses: actions/checkout@v4

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.IAM_ROLE_READONLY }}
          aws-region: eu-west-2

      - name: terraform fmt
        id: fmt
        working-directory: ./
        run: terraform fmt -recursive -check

      - name: terraform init
        id: init
        run: terraform init -no-color -upgrade -backend-config="bucket=${{ secrets.BACKEND_BUCKET }}" -backend-config="key=${{ secrets.BACKEND_KEY }}"

      - name: terraform validate
        id: validate
        run: terraform validate -no-color

        ## REPOSITORY SPECIFIC ##
      - name: Setup Terraform variables
        id: vars
        run: |-
          IMAGE_TAG=$(aws ecr describe-images --repository-name ${{ secrets.ECR_REPOSITORY_NAME }} --query 'sort_by(imageDetails,& imagePushedAt)[-1].imageTags[0]')
          cat > pipeline.auto.tfvars <<EOF
          task_image_tag = $IMAGE_TAG
          EOF

      - name: terraform plan
        id: plan
        run: |
          terraform plan -var-file="${{ matrix.environment }}.tfvars" -no-color -out=tfplan
          terraform show -no-color tfplan > tfplan.txt
          echo "summary=$(grep -E 'Plan: [0-9]+ to add, [0-9]+ to change, [0-9]+ to destroy\.|No changes\. Your infrastructure matches the configuration\.' tfplan.txt | sed 's/.*No changes\. Your infrastructure matches the configuration/Plan: no changes/g' | sed 's/.*Plan: //g' | sed 's/\..*//g')" >> $GITHUB_OUTPUT
        continue-on-error: true

      - name: Add PR comment
        uses: actions/github-script@v7
        if: github.event_name == 'pull_request'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            })
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Report for environment: ${{ matrix.environment }}')
            })

            // 2. Prepare format of the comment
            const output = `### Report for environment: ${{ matrix.environment }}
            
            #### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            <details><summary>Format Output</summary>

            \`\`\`\n
            ${{ steps.fmt.outputs.stdout }}
            \`\`\`

            </details>
            
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            <details><summary>Initialization Output</summary>

            \`\`\`\n
            ${{ steps.init.outputs.stdout }}
            \`\`\`

            </details>

            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
            <details><summary>Validation Output</summary>

            \`\`\`\n
            ${{ steps.validate.outputs.stdout }}
            \`\`\`

            </details>

            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan (${{ steps.plan.outputs.summary }})</summary>

            \`\`\`\n
            ${{ steps.plan.outputs.stdout }}
            \`\`\`

            </details>`;

            // 3. If we have a comment, update it, otherwise create a new one
            if (botComment) {
              github.rest.issues.deleteComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
              })
            }
            
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })