terraform-report.yml

name: Report pending terraform changes

on:
  pull_request:
    branches:
      - 'main'
      - 'targets/*'
    paths:
      - 'iac/terraform/*'

jobs:

  changed:

    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          submodules: true

      - uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: '${{ secrets.GCP_SA_KEY }}'

      - uses: google-github-actions/setup-gcloud@v2

      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.1.7
          terraform_wrapper: false

      - name: terraform-report
        shell: bash
        env:
          CONTENT_ROOT       : ${{ github.workspace     }}/iac
          ENGINE_ROOT        : ${{ github.workspace     }}/iac/.engine
          GITHUB_TOKEN       : ${{ secrets.GITHUB_TOKEN }}
          GITHUB_PR_NUMBER   : ${{ github.event.number  }}
          GITHUB_BASE_BRANCH : ${{ github.event.pull_request.base.ref }}
        run: |

          if [[ $GITHUB_BASE_BRANCH == main ]]; then
            export INFRA_TARGET_NAME=prod
          else
            export INFRA_TARGET_NAME=${GITHUB_BASE_BRANCH#targets/}
            if [[ $INFRA_TARGET_NAME == prod ]]; then
              echo "fatal: prod changes must be merged to main branch" >&2
              exit 1
            fi
          fi

          . "$ENGINE_ROOT"/lib/sh/terraform-report.sh

          if [[ ${#target_endpoint_changes[*]} == 0 ]]; then
            exit 0
          fi

          gh pr comment $GITHUB_PR_NUMBER --body-file - <<EOF
          ## Terraform Deployment Preview
          $(
            for endpoint in "${!target_endpoint_changes[@]}"; do
              printf '\n### %s\n\n' "$endpoint"
              printf '```hcl\n'
              printf '%s\n'         "${target_endpoint_changes[$endpoint]}"
              printf '```\n'
            done
          )
          EOF