plan.yaml

name: Terraform Plan

on:
  pull_request:
    paths:
      - '**/*.tf'
      - '**/*.tfvars'

permissions:
  contents: read
  pull-requests: write

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_REGION: ${{ secrets.AWS_BASE_REGION }}
  TFSTATE_BUCKET: ${{ secrets.TFSTATE_BUCKET }}
  TFSTATE_KEY: ${{ secrets.TFSTATE_KEY }}
  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
  GRAFANA_ADMIN_PASSWORD: ${{ secrets.GRAFANA_ADMIN_PASSWORD }}
  CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
  CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
  CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
  TAILSCALE_CLIENT_ID: ${{ secrets.TAILSCALE_CLIENT_ID }}
  TAILSCALE_CLIENT_SECRET: ${{ secrets.TAILSCALE_CLIENT_SECRET }}
  CROWDSEC_ENROLL_KEY: ${{ secrets.CROWDSEC_ENROLL_KEY }}

jobs: 
  terraform-plan:
    runs-on: ubuntu-latest
    name: Terraform Plan
    defaults:
      run:
        working-directory: ./terraform
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Checkov Scan
        id: checkov-scan
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          soft_fail: true

      - name: Terraform Plan
        id: terraform-plan
        uses: ./.github/actions/terraform-plan
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
          tfstate-bucket: ${{ env.TFSTATE_BUCKET }}
          tfstate-key: ${{ env.TFSTATE_KEY }}
          stage: "prod"
          github-token: ${{ env.GIT_TOKEN }} 
          GRAFANA_ADMIN_PASSWORD: ${{ env.GRAFANA_ADMIN_PASSWORD }}
          CLOUDFLARE_ZONE_ID: ${{ env.CLOUDFLARE_ZONE_ID }}
          CLOUDFLARE_TOKEN: ${{ env.CLOUDFLARE_TOKEN }}
          CLOUDFLARE_EMAIL: ${{ env.CLOUDFLARE_EMAIL }}
          CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN }}
          SLACK_WEBHOOK: ${{ env.SLACK_WEBHOOK }}
          TAILSCALE_CLIENT_ID: ${{ env.TAILSCALE_CLIENT_ID }}
          TAILSCALE_CLIENT_SECRET: ${{ env.TAILSCALE_CLIENT_SECRET }}
          CROWDSEC_ENROLL_KEY: ${{ env.CROWDSEC_ENROLL_KEY }}