terraform-ci.yml

name: Terraform CI

on:
  pull_request:
    paths:
      - "infrastructure/terraform/**"
  push:
    branches: [main]
    paths:
      - "infrastructure/terraform/**"

concurrency:
  group: terraform-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: false   # queue runs; never clobber state

env:
  TF_VERSION: "1.7.5"
  WORKSPACE: pr-${{ github.event.pull_request.number || github.run_id }}

jobs:
  terraform:
    name: Plan & Apply
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write

    defaults:
      run:
        working-directory: infrastructure/terraform

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
          aws-region: us-east-1

      - name: Create isolated workspace
        run: bash ../../infrastructure/scripts/create-workspace.sh "${{ env.WORKSPACE }}"

      - name: Terraform fmt check
        run: terraform fmt -check -recursive

      - name: Terraform validate
        run: terraform validate

      - name: Terraform plan
        id: plan
        run: |
          terraform plan -input=false -no-color -out=tfplan 2>&1 | tee plan.txt
          echo "exitcode=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"

      - name: Upload plan artifact
        uses: actions/upload-artifact@v4
        with:
          name: tfplan-${{ env.WORKSPACE }}
          path: infrastructure/terraform/tfplan
          retention-days: 7

      - name: Post plan to PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const plan = fs.readFileSync('infrastructure/terraform/plan.txt', 'utf8');
            const body = `### Terraform Plan — \`${{ env.WORKSPACE }}\`\n\`\`\`hcl\n${plan.slice(0, 60000)}\n\`\`\``;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body,
            });

      - name: Terraform apply (main only)
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false tfplan

  cleanup:
    name: Cleanup workspace
    runs-on: ubuntu-latest
    needs: terraform
    if: always() && github.event_name == 'pull_request'
    permissions:
      id-token: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
          aws-region: us-east-1

      - name: Cleanup workspace
        run: bash infrastructure/scripts/cleanup-workspace.sh "${{ env.WORKSPACE }}"