alert_terraform_changes.yml

name: Alert Terraform Changes

on:
  schedule:
    # The workflow runs every day at 8:20am
    - cron: "7 13 * * *"  #UTC-5
jobs:
  alert_tf_changes:
    name: Check Terraform plan for ${{ matrix.env }}
    strategy:
      fail-fast: false
      matrix:
        env: [staging, prod]
    environment: ${{ matrix.env }}
    runs-on: ubuntu-latest
    steps:
      - name: Check Out Changes
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
      - name: Connect to VPN and login to Azure
        uses: ./.github/actions/vpn-azure
        with:
          env-name: ${{ matrix.env }}
          tls-key: ${{ secrets.TLS_KEY }}
          ca-cert: ${{ secrets.CA_CRT}}
          user-crt: ${{ secrets.USER_CRT }}
          user-key: ${{ secrets.USER_KEY }}
          sp-creds: ${{ secrets.SERVICE_PRINCIPAL_CREDS }}
          tf-auth: true

      - name: Collect Terraform stats

        uses: josiahsiegel/terraform-stats@68b8cbe42c494333fbf6f8d90ac86da1fb69dcc2
        ## DevSecOps - Aquia (Replace) - uses: ./.github/actions/terraform-stats

        id: stats1
        with:
          terraform-directory: operations/app/terraform/vars/${{ matrix.env }}
          terraform-version: 1.7.4
          add-args: "-refresh=false"

      - name: Format outputs for slack
        id: format_out
        if: steps.stats1.outputs.change-count > 0
        run: |
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          echo "CHANGES<<$EOF" >> $GITHUB_OUTPUT
          echo "resource-changes=$(echo '${{ steps.stats1.outputs.resource-changes }}' \
            | sed 's/\"/\\\"/g' | sed 's/\\\\\"/\\\\\\"/g')" >> $GITHUB_OUTPUT
          echo "resource-drifts=$(echo '${{ steps.stats1.outputs.resource-drifts }}' \
            | sed 's/\"/\\\"/g' | sed 's/\\\\\"/\\\\\\"/g')" >> $GITHUB_OUTPUT
          echo "$EOF" >> $GITHUB_OUTPUT

      - name: Slack Notification
        if: ${{ steps.format_out.outputs.CHANGES  != '' }}
        uses: ./.github/actions/notifications
        with:
          method: slack
          title: Current Terraform Plan Changes in ${{ matrix.env }} env
          message: |
            "change-count": "${{ steps.stats1.outputs.change-count }}"
            "drift-count": "${{ steps.stats1.outputs.drift-count }}"
            "resource-drifts": "${{ env.resource-drifts }}"

          icon-emoji: ':bell:'
          channel: pagerduty-alert-dump
          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
          color: warning