terragrunt-plan.yml

name: "Run terragrunt plan on PR submission"
on:
  pull_request:
    branches:
      - main
    types:
      - opened
      - synchronize
jobs:
  run-terraform-plan:
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'
      pull-requests: 'write'
    steps:
      - name: setup repository
        uses: actions/checkout@v4

      - name: Setup aqua
        uses: aquaproj/aqua-installer@v2.3.0
        with:
          aqua_version: v2.24.1

      - name: Login to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: 'projects/228944830644/locations/global/workloadIdentityPools/gh-pool/providers/provider-github'
          service_account: 'gh-actions@lgtmgen-project.iam.gserviceaccount.com'

      - name: Terragrunt Init
        run: terragrunt run-all init

      - name: TFlint
        working-directory: envs/dev
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tflint --config $GITHUB_WORKSPACE/.tflint.hcl --init
          tflint --config $GITHUB_WORKSPACE/.tflint.hcl --format=checkstyle | \
          reviewdog -f=checkstyle \
                    -name="tflint" \
                    -reporter=github-pr-review \
                    -filter-mode=nofilter \
                    -fail-on-error

      - name: Check terragrunt fmt
        working-directory: envs/dev
        run: terragrunt fmt -check

      - name: Terragrunt validate
        working-directory: envs/dev
        run: terragrunt validate

      - name: Terragrunt plan
        working-directory: envs/dev
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          chmod 755 $GITHUB_WORKSPACE/.github/scripts/tfwrapper.sh
          terragrunt run-all plan --terragrunt-non-interactive --terragrunt-tfpath $GITHUB_WORKSPACE/.github/scripts/tfwrapper.sh