terraform-ci.yml

name: Terraform CI

on:
  workflow_call:
    inputs:
      aws-region:
        type: string
        default: 'eu-west-1'
      aws-role:
        type: string
        default: ''
      disable-sudo:
        type: boolean
        default: true
      environment:
        type: string
        default: ''
      egress-policy-allowlist:
        type: string
        default: ''
      runs-on:
        type: string
        default: 'ubuntu-latest'
      sops-encrypted-tfvars:
        type: string
        default: './terraform.tfvars.enc'
      sops-plaintext-tfvars:
        type: string
        default: './terraform.tfvars'
      upload-sarif:
        type: boolean
        default: true
      working-directory:
        type: string
        default: '.'
    secrets:
      sops-age-key:
        required: false

jobs:
  terraform-lint:
    name: Terraform Linting
    runs-on: ${{ inputs.runs-on }}
    environment: ${{ inputs.environment != '' && inputs.environment || null }}
    permissions:
      contents: read
      pull-requests: write
      security-events: write
      id-token: write
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          disable-sudo: ${{ inputs.disable-sudo }}
          egress-policy: audit
          allowed-endpoints: >
            codeload.github.com:443
            raw.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            ${{ inputs.egress-policy-allowlist }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        if: ${{ inputs.aws-role != '' }}
        with:
          role-to-assume: ${{ inputs.aws-role }}
          aws-region: ${{ inputs.aws-region }}
          retry-max-attempts: 2
      - run: |
          echo "plugin_cache_dir = '$HOME/.terraform.d/plugin-cache'" > ~/.terraformrc
          mkdir -p ~/.terraform.d/plugin-cache
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.terraform.d/plugin-cache
          key: terraform-providers-${{ hashFiles('**/.terraform.lock.hcl') }}
          restore-keys: terraform-providers-
      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
      - name: Sops Binary Installer
        uses: mdgreenwald/mozilla-sops-action@55177c1ff20a2b396280e4c5f53c32b69f0c1e40
      - name: Decrypt Secrets
        env:
          SOPS_AGE_KEY: ${{ secrets.sops-age-key }}
          ENCRYPTED_FILE: '${{ inputs.sops-encrypted-tfvars }}'
          PLAINTEXT_FILE: '${{ inputs.sops-plaintext-tfvars }}'
        run: |
          sops decrypt "$ENCRYPTED_FILE" --output "$PLAINTEXT_FILE"
      - name: Terraform fmt
        id: fmt
        run: terraform fmt -check

      - name: Terraform Init
        id: init
        run: terraform init -input=false

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: tflint
        uses: reviewdog/action-tflint@54a5e5aed57dcfbb4662ec548de876df33d6288d # v1.25.0
        with:
          working_directory: ${{ inputs.working-directory }}
          fail_level: any
          filter_mode: nofilter

      - name: Run Trivy Scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          hide-progress: true
          format: sarif
          scan-type: config
          exit-code: '1'
          output: ${{ inputs.working-directory }}/trivy_results.sarif
          github-pat: ${{ secrets.GITHUB_TOKEN }}
      - uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
      - name: Run reviewdog
        continue-on-error: true
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo -n "$(cat ./trivy_results.sarif)" | reviewdog -reporter=github-check -f=sarif -level=error -diff="git diff FETCH_HEAD"
      - name: Upload results
        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 #  v4.37.6
        with:
          sarif_file: ${{ inputs.working-directory }}/trivy_results.sarif
          category: devops
        if: ${{ inputs.upload-sarif }}

  terraform-plan:
    name: Terraform Plan
    runs-on: ${{ inputs.runs-on }}
    needs: terraform-lint
    environment: ${{ inputs.environment != '' && inputs.environment || null }}
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          disable-sudo-and-containers: ${{ inputs.disable-sudo }}
          egress-policy: audit
          allowed-endpoints: >
            ${{ inputs.egress-policy-allowlist }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        if: ${{ inputs.aws-role != '' }}
        with:
          role-to-assume: ${{ inputs.aws-role }}
          aws-region: ${{ inputs.aws-region }}
          retry-max-attempts: 2
      - run: |
          echo "plugin_cache_dir = '$HOME/.terraform.d/plugin-cache'" > ~/.terraformrc
          mkdir -p ~/.terraform.d/plugin-cache
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.terraform.d/plugin-cache
          key: terraform-providers-${{ hashFiles('**/.terraform.lock.hcl') }}
          restore-keys: terraform-providers-
      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
      - name: Sops Binary Installer
        uses: mdgreenwald/mozilla-sops-action@55177c1ff20a2b396280e4c5f53c32b69f0c1e40
      - name: Decrypt Secrets
        env:
          SOPS_AGE_KEY: ${{ secrets.sops-age-key }}
          ENCRYPTED_FILE: '${{ inputs.sops-encrypted-tfvars }}'
          PLAINTEXT_FILE: '${{ inputs.sops-plaintext-tfvars }}'
        run: |
          sops decrypt "$ENCRYPTED_FILE" --output "$PLAINTEXT_FILE"
      - name: Terraform Init
        id: init
        run: terraform init -input=false
      - name: Terraform Plan
        id: plan
        run: |
          terraform plan -no-color -input=false | tee plan.txt
          {
            echo "plan<<EOF"
            cat plan.txt
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
        continue-on-error: true
      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        if: github.event_name == 'pull_request'
        env:
          PLAN: '${{ steps.plan.outputs.plan }}'
          ACTOR: '${{ github.actor }}'
          EVENT: '${{ github.event_name }}'
          WORKDIR: '${{ inputs.working-directory }}'
          OUTCOME: '${{ steps.plan.outcome }}'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { PLAN, ACTOR, EVENT, WORKDIR, OUTCOME } = process.env;
            const { data: comments } = await github.rest.issues.listComments({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
            })
            const botComment = comments.find(comment => {
                return comment.user.type === 'Bot' && comment.body.includes('Terraform Plan 📖')
            })

            const output = `#### Terraform Plan 📖\`${OUTCOME}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>

            *Pusher: @${ACTOR}, Action: \`${EVENT}\`, Working Directory: \`${WORKDIR}\`*`;

            if (botComment) {
                github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
                })
            } else {
                github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
                })
            }