pre-commit.yml

name: pre-commit

on:
  pull_request:
    branches:
      - main
    paths:
      - '**.tf'
      - '**.yml'
      - '**.yaml'

env:
  TERRAFORM_DOCS_VERSION: v0.16.0
  TFSEC_VERSION: v1.22.0
  TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache
  TFLINT_VERSION: v0.42.1

concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true

jobs:
  collectInputs:
    name: Collect workflow inputs
    runs-on: ubuntu-latest
    outputs:
      directories: ${{ steps.dirs.outputs.directories }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac

      - name: Get root directories
        id: dirs
        uses: clowdhaus/terraform-composite-actions/directories@v1.8.3

  preCommitMinVersions:
    name: Min TF pre-commit
    needs: collectInputs
    runs-on: ubuntu-latest
    strategy:
      matrix:
        directory: ${{ fromJson(needs.collectInputs.outputs.directories) }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Remove default Terraform
        run: rm -rf $(which terraform)

      - name: Checkout
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac

      - uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
            src:
              - '${{ matrix.directory }}/*.tf'

      - name: Config Terraform plugin cache
        if: steps.changes.outputs.src== 'true'
        run: mkdir --parents ${{ env.TERRAFORM_DOCS_VERSION }}

      - name: Cache Terraform
        uses: actions/cache@v3
        if: steps.changes.outputs.src== 'true'
        with:
          path: ${{ env.TERRAFORM_DOCS_VERSION }}
          key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
          restore-keys: ${{ runner.os }}-terraform-

      - name: Terraform min/max versions
        uses: clowdhaus/terraform-min-max@v1.2.7
        if: steps.changes.outputs.src== 'true'
        id: minMax
        with:
          directory: ${{ matrix.directory }}

      - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
        uses: clowdhaus/terraform-composite-actions/pre-commit@v1.8.3
        if: steps.changes.outputs.src== 'true'
        with:
          terraform-version: ${{ steps.minMax.outputs.maxVersion }}
          terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
          tflint-version: ${{ env.TFLINT_VERSION }}
          args: '--files ${{ matrix.directory }}/*'