SkyForge

.github/workflows/terraform.yml

# SkyForge reference pipeline.
# fmt, validate, tflint, checkov, and terraform test run without AWS credentials.
# plan runs only on a manual dispatch and assumes a deploy role with GitHub OIDC.
# There is no terraform apply step in this file.

name: terraform

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: Which tfvars file to plan
        type: choice
        options:
          - dev
          - prod
        default: dev
      stack:
        description: Which route to plan
        type: choice
        options:
          - single-ec2
          - ecs-fargate
        default: ecs-fargate

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.8

      - uses: terraform-linters/setup-tflint@v4
        with:
          tflint_version: v0.55.1

      - name: fmt
        run: terraform fmt -check -recursive

      - name: init and validate
        run: |
          terraform -chdir=single-ec2 init -backend=false -input=false
          terraform -chdir=single-ec2 validate
          terraform -chdir=ecs-fargate init -backend=false -input=false
          terraform -chdir=ecs-fargate validate
          terraform -chdir=bootstrap init -backend=false -input=false
          terraform -chdir=bootstrap validate

      - name: tflint
        run: |
          tflint --init --config .tflint.hcl
          tflint --recursive --config "$PWD/.tflint.hcl" --minimum-failure-severity=error

      - name: checkov
        run: |
          pip install 'checkov==3.2.449'
          checkov -d . --framework terraform --download-external-modules false --quiet

      - name: terraform test
        env:
          AWS_ACCESS_KEY_ID: ""
          AWS_SECRET_ACCESS_KEY: ""
          AWS_SESSION_TOKEN: ""
          AWS_EC2_METADATA_DISABLED: "true"
        run: |
          terraform init -backend=false -input=false
          terraform test

  plan:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.8

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: plan
        run: |
          terraform -chdir=${{ inputs.stack }} init -input=false
          terraform -chdir=${{ inputs.stack }} plan -input=false -var-file=../envs/${{ inputs.environment }}.tfvars -out=tfplan
          echo "Plan written to ${{ inputs.stack }}/tfplan. This workflow does not apply it."