tf_sample.yaml

---
name: TF Sample

on:
  pull_request:
    paths: [.github/workflows/tf_sample.yaml, sample/**]
  push:
    paths: [.github/workflows/tf_sample.yaml, sample/**]
    branches: [main]

env:
  AWS_REGION: us-east-1
  TF_VERSION: ~> 1.8.0
  TF_VAR_PREFIX: sample

jobs:
  iac:
    runs-on: ubuntu-24.04

    permissions:
      actions: read # Required to download repository artifact.
      checks: write # Required to add status summary.
      contents: read # Required to checkout repository.
      id-token: write # Required to authenticate via OIDC.
      pull-requests: write # Required to add PR comment and label.

    strategy:
      fail-fast: false
      matrix:
        dir: [bucket, instance]
        env: [dev, qa]

    environment: ${{ github.event_name == 'push' && format('{0}/{1}', matrix.dir, matrix.env) || '' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false

      - name: Authenticate AWS
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_ROLE }}
          role-session-name: devsectop-tf-via-pr-${{ github.run_id }}-${{ github.run_attempt}}

      - name: Setup TF
        uses: opentofu/setup-opentofu@12f4debbf681675350b6cd1f0ff8ecfbda62027b # v1.0.4
        with:
          tofu_version: ${{ env.TF_VERSION }}

      - name: Provision TF
        uses: ./
        with:
          arg_chdir: sample/${{ matrix.dir }}
          arg_command: ${{ github.event_name == 'push' && 'apply' || 'plan' }}
          arg_lock: ${{ github.event_name == 'push' && 'true' || 'false' }}
          arg_backend_config: ${{ contains(matrix.dir, 'bucket') && format('backend/{0}.tfbackend', matrix.env) || '' }}
          arg_var_file: ${{ contains(matrix.dir, 'instance') && format('env/{0}.tfvars', matrix.env) || '' }}
          arg_workspace: ${{ matrix.env }}
          arg_detailed_exitcode: true
          arg_or_create: true
          cache_plugins: true
          encrypt_passphrase: ${{ secrets.TF_ENCRYPTION }}