apply.yaml

name: Terraform Apply

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

concurrency:
  group: terraform
  cancel-in-progress: false

jobs:
  terraform:
    name: Terraform
    runs-on: ubuntu-latest
    environment: ${{ vars.GCP_PROJECT_ID }}
    steps:
      - name: GitHub checkout
        uses: actions/checkout@v4
      - name: Google Cloud authenticate
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.WIF_PROVIDER }}
          service_account: ${{ vars.WIF_SERVICE_ACCOUNT }}
      - name: Terraform setup
        uses: hashicorp/setup-terraform@v3
      - name: Terraform init
        run: terraform init
      - name: Terraform apply
        run: terraform apply -auto-approve
        env:
          TF_VAR_project: ${{ vars.GCP_PROJECT_ID }}
          TF_VAR_iap_client_id: ${{ secrets.IAP_CLIENT_ID }}
          TF_VAR_iap_client_secret: ${{ secrets.IAP_CLIENT_SECRET }}