terraform.yml

name: "Terraform"

on:
  push:
    branches: ["main"]
    
permissions:
  contents: read

jobs:
  terraform:
    name: "Terraform"
    runs-on: ubuntu-latest
    environment: production

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Setup Google Cloud Credentials
        uses: google-github-actions/auth@v2
        with: 
          credentials_json: "${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}" 

      # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
      - name: Terraform Init
        run: terraform init
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
          TF_VAR_MONGO_URI: ${{ secrets.MONGO_URI }}
          TF_VAR_GOOGLE_TYPE: ${{ secrets.GOOGLE_TYPE }}
          TF_VAR_GOOGLE_PROJECT_ID: ${{ secrets.GOOGLE_PROJECT_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY_ID: ${{ secrets.GOOGLE_PRIVATE_KEY_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
          TF_VAR_GOOGLE_CLIENT_EMAIL: ${{ secrets.GOOGLE_CLIENT_EMAIL }}
          TF_VAR_GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          TF_VAR_GOOGLE_AUTH_URI: ${{ secrets.GOOGLE_AUTH_URI }}
          TF_VAR_GOOGLE_TOKEN_URI: ${{ secrets.GOOGLE_TOKEN_URI }}
          TF_VAR_GOOGLE_AUTH_PROVIDER_X509_CERT_URL: ${{ secrets.GOOGLE_AUTH_PROVIDER_X509_CERT_URL }}
          TF_VAR_GOOGLE_CLIENT_X509_CERT_URL: ${{ secrets.GOOGLE_CLIENT_X509_CERT_URL }}
          TF_VAR_GOOGLE_UNIVERSE_DOMAIN: ${{ secrets.GOOGLE_UNIVERSE_DOMAIN }}


      # Checks that all Terraform configuration files adhere to a canonical format
      - name: Terraform Format
        run: terraform fmt -check
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
          TF_VAR_MONGO_URI: ${{ secrets.MONGO_URI }}
          TF_VAR_GOOGLE_TYPE: ${{ secrets.GOOGLE_TYPE }}
          TF_VAR_GOOGLE_PROJECT_ID: ${{ secrets.GOOGLE_PROJECT_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY_ID: ${{ secrets.GOOGLE_PRIVATE_KEY_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
          TF_VAR_GOOGLE_CLIENT_EMAIL: ${{ secrets.GOOGLE_CLIENT_EMAIL }}
          TF_VAR_GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          TF_VAR_GOOGLE_AUTH_URI: ${{ secrets.GOOGLE_AUTH_URI }}
          TF_VAR_GOOGLE_TOKEN_URI: ${{ secrets.GOOGLE_TOKEN_URI }}
          TF_VAR_GOOGLE_AUTH_PROVIDER_X509_CERT_URL: ${{ secrets.GOOGLE_AUTH_PROVIDER_X509_CERT_URL }}
          TF_VAR_GOOGLE_CLIENT_X509_CERT_URL: ${{ secrets.GOOGLE_CLIENT_X509_CERT_URL }}
          TF_VAR_GOOGLE_UNIVERSE_DOMAIN: ${{ secrets.GOOGLE_UNIVERSE_DOMAIN }}

      # Generates an execution plan for Terraform
      - name: Terraform Plan
        run: terraform plan -input=false
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
          TF_VAR_MONGO_URI: ${{ secrets.MONGO_URI }}
          TF_VAR_GOOGLE_TYPE: ${{ secrets.GOOGLE_TYPE }}
          TF_VAR_GOOGLE_PROJECT_ID: ${{ secrets.GOOGLE_PROJECT_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY_ID: ${{ secrets.GOOGLE_PRIVATE_KEY_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
          TF_VAR_GOOGLE_CLIENT_EMAIL: ${{ secrets.GOOGLE_CLIENT_EMAIL }}
          TF_VAR_GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          TF_VAR_GOOGLE_AUTH_URI: ${{ secrets.GOOGLE_AUTH_URI }}
          TF_VAR_GOOGLE_TOKEN_URI: ${{ secrets.GOOGLE_TOKEN_URI }}
          TF_VAR_GOOGLE_AUTH_PROVIDER_X509_CERT_URL: ${{ secrets.GOOGLE_AUTH_PROVIDER_X509_CERT_URL }}
          TF_VAR_GOOGLE_CLIENT_X509_CERT_URL: ${{ secrets.GOOGLE_CLIENT_X509_CERT_URL }}
          TF_VAR_GOOGLE_UNIVERSE_DOMAIN: ${{ secrets.GOOGLE_UNIVERSE_DOMAIN }}
          
        # On push to "main", build or change infrastructure according to Terraform configuration files
        # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud". See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks
      - name: Terraform Apply
        run: terraform apply -auto-approve -input=false
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
          TF_VAR_MONGO_URI: ${{ secrets.MONGO_URI }}
          TF_VAR_GOOGLE_TYPE: ${{ secrets.GOOGLE_TYPE }}
          TF_VAR_GOOGLE_PROJECT_ID: ${{ secrets.GOOGLE_PROJECT_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY_ID: ${{ secrets.GOOGLE_PRIVATE_KEY_ID }}
          TF_VAR_GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
          TF_VAR_GOOGLE_CLIENT_EMAIL: ${{ secrets.GOOGLE_CLIENT_EMAIL }}
          TF_VAR_GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          TF_VAR_GOOGLE_AUTH_URI: ${{ secrets.GOOGLE_AUTH_URI }}
          TF_VAR_GOOGLE_TOKEN_URI: ${{ secrets.GOOGLE_TOKEN_URI }}
          TF_VAR_GOOGLE_AUTH_PROVIDER_X509_CERT_URL: ${{ secrets.GOOGLE_AUTH_PROVIDER_X509_CERT_URL }}
          TF_VAR_GOOGLE_CLIENT_X509_CERT_URL: ${{ secrets.GOOGLE_CLIENT_X509_CERT_URL }}
          TF_VAR_GOOGLE_UNIVERSE_DOMAIN: ${{ secrets.GOOGLE_UNIVERSE_DOMAIN }}