pr.yml

name: Run plan for PR

on:
  pull_request:
    branches:
      - master
      - main

permissions:
  contents: read
  id-token: write # required for AWS OIDC
  pull-requests: write # required for writing the PR comment

jobs:
  plan:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout Git Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1
        with:
          tofu_version: 1.8.8

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.BACKEND_ROLE }}

      - name: OpenTofu init
        run: |
          tofu init \
              -backend-config="bucket=${{ secrets.BACKEND_BUCKET }}" \
              -backend-config="dynamodb_table=${{ secrets.BACKEND_DDB_TABLE }}"

      - name: OpenTofu validate
        run: tofu validate

      - name: OpenTofu plan
        env:
          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
          # Legacy, pending new provider version
          TF_VAR_application_credential_id: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
          TF_VAR_application_credential_secret: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
        run: tofu plan -out tfplan

      - name: Get plan output for PR comment
        id: plan
        run: tofu show -no-color tfplan

      - name: Update Pull Request
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `<details><summary>Show OpenTofu Plan</summary>
      
            \`\`\`\n
            ${{ steps.plan.outputs.stdout }}
            \`\`\`
      
            </details>
      
            *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;
      
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })