On PR

Use 1password to manage envvars #77

	name: On PR

	on:
	pull_request: {}
	push:
	branches:
	- main

	permissions:
	id-token: write
	contents: read

	jobs:
	tflint-plan:
	name: tflint + terraform plan
	runs-on: ubuntu-latest

	steps:
	- name: Checkout branch
	uses: actions/checkout@v4

	- name: Install Terraform
	uses: hashicorp/setup-terraform@v2
	with:
	terraform_version: 1.5.7
	terraform_wrapper: false

	- uses: terraform-linters/setup-tflint@v2
	name: Setup TFLint
	with:
	github_token: ${{ secrets.GITHUB_TOKEN }}

	- name: Install virtualenv
	run: pip install virtualenv

	- name: Install AWS CLI
	uses: unfor19/install-aws-cli-action@v1
	with:
	arch: amd64

	- name: Install Kubectl
	uses: azure/setup-kubectl@v1
	with:
	version: latest

	- name: Install Helm
	uses: azure/setup-helm@v3
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	version: latest

	- name: configure aws credentials
	uses: aws-actions/configure-aws-credentials@v1.7.0
	with:
	role-to-assume: arn:aws:iam::391835788720:role/ossci_gha_terraform
	aws-region: us-east-1

	- name: "Run TFLint runners"
	shell: bash
	run: make tflint
	env:
	EKS_USERS: ${{ secrets.EKS_USERS }}

	- name: Make plan
	shell: bash
	run: make plan
	env:
	EKS_USERS: ${{ secrets.EKS_USERS }}
	GHA_PRIVATE_KEY_CANARY: ${{ secrets.GHA_PRIVATE_KEY_CANARY }}
	GHA_PRIVATE_KEY: ${{ secrets.GHA_PRIVATE_KEY }}
	KUBECONFIG: ${{ runner.temp }}/kubeconfig
	TERRAFORM_EXTRAS: -lock-timeout=15m

Provide feedback