pre-commit.yml

name: Pre-commit

on:
  pull_request:
    branches:
      - main
    paths:
      - '**.tf'
      - '**.yml'
      - '**.yaml'

env:
  TERRAFORM_VERSION: 1.3.10
  TERRAFORM_DOCS_VERSION: v0.19.0
  TFLINT_VERSION: v0.53.0
  TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache

concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true

jobs:
  pre-commit:
    name: Min TF pre-commit
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Remove default Terraform
        run: rm -rf $(which terraform)

      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871

      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            src:
              - '*.tf'

      - name: Config Terraform plugin cache
        if: steps.changes.outputs.src== 'true'
        run: mkdir --parents ${{ env.TERRAFORM_DOCS_VERSION }}

      - name: Cache Terraform
        uses: actions/cache@v4
        if: steps.changes.outputs.src== 'true'
        with:
          path: ${{ env.TERRAFORM_DOCS_VERSION }}
          key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
          restore-keys: ${{ runner.os }}-terraform-

      - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
        uses: clowdhaus/terraform-composite-actions/pre-commit@v1.11.0
        if: steps.changes.outputs.src== 'true'
        with:
          terraform-version: ${{ env.TERRAFORM_VERSION }}
          terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
          tflint-version: ${{ env.TFLINT_VERSION }}