terraform.yml

name: Terraform Reusable

# This is a reusable workflow to run terraform plan and apply on
# 'pull_request' and 'push' events using matrix strategy. Learn more:
# https://github.com/o11y-top/aws-terraform-multiple-environments/#readme

on:
  workflow_call:
    secrets:
      env:
        description: Input environment variables required by terraform
        required: true

# Allow only one of this workflow to run at a time per branch.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

# Allow read repository contents, write deployments and pull requests.
permissions:
  contents: read
  pull-requests: write

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  # Query GitHub API to return a list of labels on the PR or commit
  # then output the list of 'tf' prefixed labels for subsequent use
  # in the format: [['tf', 'label1'], ['tf_auto_approve', 'label2']]
  labels:
    runs-on: ubuntu-latest

    outputs:
      matrix: ${{ steps.labels.outputs.result }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # List changed environment directories when PR is opened or updated by bots.
      - name: Get changed environments once
        if: contains(github.event.action, 'opened') || contains(github.actor, '[bot]')
        id: changed
        uses: tj-actions/changed-files@v35
        with:
          dir_names_max_depth: 2
          dir_names: true
          files: environments/**
          json_raw_format: true
          json: true

      # Add 'tf' prefixed labels for changed environments when PR is opened or updated by bots.
      - name: Add changed environment labels once
        if: steps.changed.outcome == 'success' && toJSON(fromJSON(steps.changed.outputs.all_modified_files)) != '[]'
        uses: actions/github-script@v6
        env:
          changed: ${{ steps.changed.outputs.all_modified_files }}
        with:
          script: |
            // Parse changed environment directory paths then add labels
            // in the format: ['tf:label1', 'tf:label2']
            const labels = JSON.parse(process.env.changed).map((str) => {
              return 'tf:' + str.substring(str.indexOf('/') + 1);
            });
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              labels: labels,
              owner: context.repo.owner,
              repo: context.repo.repo,
            });

      # Output a list of 'tf' prefixed labels.
      - name: Get labels
        uses: actions/github-script@v6
        id: labels
        with:
          script: |
            return (
              await github.rest.repos.listPullRequestsAssociatedWithCommit({
                // Short-circuit evaluation to get a SHA from any change event
                commit_sha: context.payload.after || context.payload.pull_request.head.sha || context.sha,
                owner: context.repo.owner,
                repo: context.repo.repo,
              })
            ).data[0].labels
              .filter((label) => label.name.startsWith('tf'))
              .map((label) => {
                let [head, body] = label.name.split(':');
                return [head, body];
              });

  run:
    # Run terraform if one or more 'tf' prefixed labels are present.
    needs: [labels]
    if: toJSON(fromJSON(needs.labels.outputs.matrix)) != '[]'
    runs-on: ubuntu-latest

    # Run for each label and continue through to release state lock.
    strategy:
      fail-fast: false
      matrix:
        path: ${{ fromJSON(needs.labels.outputs.matrix) }}

    # Update environment deployment status.
    environment: ${{ matrix.path[1] }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # Set environment variables.
      - name: Environment variables
        run: |
          # Add terraform environment and workspace variables to GITHUB_ENV
          string='${{ matrix.path[1] }}'
          if [[ $string == *'--'* ]]; then
            echo tf_environment=${string/--*/} >> $GITHUB_ENV
            echo tf_workspace=${string/*--/} >> $GITHUB_ENV
          else
            echo tf_environment=${string} >> $GITHUB_ENV
            echo tf_workspace='default' >> $GITHUB_ENV
          fi
          # Add input environment variables to GITHUB_ENV
          for i in '${{ secrets.env }}'; do printf '%s\n' $i >> $GITHUB_ENV; done

      # Initialise terraform workspace if one is specified.
      - name: Terraform workspace
        if: env.tf_workspace != 'default'
        uses: dflook/terraform-new-workspace@v1
        with:
          workspace: ${{ env.tf_workspace }}
          path: environments/${{ env.tf_environment }}
          backend_config_file: environments/backend.tfvars
          backend_config: key=environments/${{ env.tf_environment }}/terraform.tfstate

      # Run terraform plan on 'pull_request' event.
      - name: Terraform plan
        if: github.event_name == 'pull_request'
        uses: dflook/terraform-plan@v1
        with:
          label: ${{ matrix.path[1] }}
          destroy: ${{ contains(matrix.path[0], 'destroy') }}
          workspace: ${{ env.tf_workspace }}
          path: environments/${{ env.tf_environment }}
          backend_config_file: environments/backend.tfvars
          backend_config: key=environments/${{ env.tf_environment }}/terraform.tfstate

      # Run terraform apply on 'push' event or if 'auto_approve' label is present.
      - name: Terraform apply
        if: github.event_name == 'push' || contains(matrix.path[0], 'auto_approve')
        uses: dflook/terraform-apply@v1
        with:
          label: ${{ matrix.path[1] }}
          destroy: ${{ contains(matrix.path[0], 'destroy') }}
          workspace: ${{ env.tf_workspace }}
          path: environments/${{ env.tf_environment }}
          backend_config_file: environments/backend.tfvars
          backend_config: key=environments/${{ env.tf_environment }}/terraform.tfstate