deploy-terraform-plan.yaml

name: Terraform Plan for Artifact Registry
on:
  pull_request:
    branches:
      - main
    paths:
      - 'terraform/**'
jobs:
  run-terraform-plan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup aqua
        uses: aquaproj/aqua-installer@v2.3.0
        with:
          aqua_version: v2.25.1

      - name: Login to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: 'projects/938038185918/locations/global/workloadIdentityPools/default/providers/provider-github'
          service_account: 'gh-actions@lumos-profile-management.iam.gserviceaccount.com'

      - name: Terraform Init
        run: terraform init
        working-directory: terraform

      - name: TFlint
        working-directory: terraform
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tflint --config .tflint.hcl --init
          tflint --config .tflint.hcl --format=checkstyle | \
          reviewdog -f=checkstyle \
                    -name="tflint" \
                    -reporter=github-pr-review \
                    -filter-mode=nofilter \
                    -fail-on-error

      - name: Check terraform fmt
        working-directory: terraform
        run: terraform fmt -check

      - name: Terraform validate
        working-directory: terraform
        run: terraform validate

      - name: Terraform plan
        working-directory: terraform
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: tfcmt plan -patch -- terraform plan