action.yaml

name: Terraform (wemogy)
author: wemogy
description: Connects to a Terraform backend, applies or plans the changes and outputs the Terraform Output variables
branding:
  icon: "upload-cloud"
  color: "blue"

inputs:
  working-directory:
    required: true
    description: "The directory of your terraform scripts"
  workspace:
    description: "The terraform workspace"
    required: false
  plan:
    description: "Plan the changes"
    default: "false"
    required: true
  apply:
    description: "Apply the changes"
    default: "true"
    required: true
  destroy:
    description: "Destroy the changes"
    default: "false"
    required: true
  force:
    description: "Enforce changes, even if prevent_destroy is set to 'true'"
    default: "false"
    required: true
  client-id:
    description: "The Azure Service Pricipal Client ID"
    required: true
  client-secret:
    description: "The Azure Service Pricipal Secret"
    required: true
  tenant-id:
    description: "The Azure Service Pricipal Tenant ID"
    required: true
  backend-storage-account-name:
    description: "The Name of the Azure Storage Account that hosts the remote Terraform backend"
    required: true
  backend-container-name:
    description: "The Name of the the storage container that hosts the remote Terraform backend"
    required: true
  backend-key:
    description: "The name of the file that hosts the remote Terraform backend"
    required: true
  backend-access-key:
    description: "The ARM Access Key to the Azure Storage Account that hosts the remote Terraform backend"
    required: true

outputs:
  output:
    description: "The Terraform output in JSON format"
    value: ${{ steps.terraform-output.outputs.output }}

runs:
  using: "composite"
  steps:
    # Check if 'force' is set.
    # If so, this script replace s'prevent_destroy = true' with 'prevent_destroy = false' in all .tf files
    # see: https://notes.rioastamal.net/2020/03/terraform-force-destroy-resource-when-prevent-destroy-true.html
    - name: Check if force is set
      run: |
        if [[ "${{ inputs.force }}" == "true" ]]; then
          find . -name '*.tf' -type f -exec perl -i -pe 's@prevent_destroy = true@prevent_destroy = false@g' {} \;
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    # Setup terraform
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3

    # Initialize terraform
    - name: Init Terraform
      run: |
        terraform init \
          -upgrade \
          -reconfigure \
          -backend-config="storage_account_name=${{ inputs.backend-storage-account-name }}" \
          -backend-config="container_name=${{ inputs.backend-container-name }}" \
          -backend-config="key=${{ inputs.backend-key }}"
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        ARM_ACCESS_KEY: ${{ inputs.backend-access-key }}

    # Switch terraform workspace
    - name: Switch to dev workspace
      run: |
        if [[ "${{ inputs.workspace }}" != "" ]]; then
          echo "Switching workspace to ${{ inputs.workspace }}..."
          terraform workspace select ${{ inputs.workspace }}
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        ARM_ACCESS_KEY: ${{ inputs.backend-access-key }}

    # Plan the terraform changes
    - name: Plan terraform
      run: |
        if [[ "${{ inputs.plan }}" == "true" ]]; then
          echo "Running terraform plan..."
          terraform plan
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        ARM_CLIENT_ID: ${{ inputs.client-id }}
        ARM_CLIENT_SECRET: ${{ inputs.client-secret }}
        ARM_TENANT_ID: ${{ inputs.tenant-id }}
        ARM_ACCESS_KEY: ${{ inputs.backend-access-key }}

    # Apply / Destroy
    - name: Apply / Destroy terraform
      run: |
        if [[ "${{ inputs.apply }}" == "true" ]]; then
          echo "Running terraform apply..."
          terraform apply -auto-approve
        elif [[ "${{ inputs.destroy }}" == "true" ]]; then
          echo "Running terraform destroy..."
          terraform destroy -auto-approve
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        ARM_CLIENT_ID: ${{ inputs.client-id }}
        ARM_CLIENT_SECRET: ${{ inputs.client-secret }}
        ARM_TENANT_ID: ${{ inputs.tenant-id }}
        ARM_ACCESS_KEY: ${{ inputs.backend-access-key }}

    # Export terraform outputs to output of this job
    - name: Terraform Output
      id: terraform-output
      working-directory: ${{ inputs.working-directory }}
      run: |
        TERRAFORM_OUTPUT=$(terraform output --json | jq -c .)
        echo "::set-output name=output::$TERRAFORM_OUTPUT"
      shell: bash
      env:
        ARM_ACCESS_KEY: ${{ inputs.backend-access-key }}