plan.yaml

name: Terraform Plan

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

concurrency:
  group: terraform
  cancel-in-progress: false

jobs:
  terraform:
    name: Terraform
    runs-on: ubuntu-latest
    steps:
      - name: GitHub checkout
        uses: actions/checkout@v4
      - name: Google Cloud authenticate
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.WIF_PROVIDER }}
          service_account: ${{ vars.WIF_SERVICE_ACCOUNT }}
      - name: Terraform setup
        uses: hashicorp/setup-terraform@v3
      - name: Terraform init
        run: terraform init
      - name: Terraform format
        run: terraform fmt -check
      - name: Terraform validate
        run: terraform validate
      - name: Terraform plan
        run: terraform plan
        env:
          TF_VAR_project: ${{ vars.GCP_PROJECT_ID }}
          TF_VAR_iap_client_id: ${{ secrets.IAP_CLIENT_ID }}
          TF_VAR_iap_client_secret: ${{ secrets.IAP_CLIENT_SECRET }}