terraform.yaml

name: Terraform
on:
  push:
    paths:
      - "*.tf"
    branches:
      - "*"
  pull_request:

env:
  TF_VAR_ARGOCD_SERVER: "argocd.naturalselectionlabs.com:443"
  TF_VAR_ARGOCD_PASSWORD: ${{ secrets.TF_VAR_ARGOCD_PASSWORD }}
  TF_VAR_PAT: ${{ secrets.TF_VAR_PAT }}
  TF_VAR_GITHUB_APP_ID: ${{ secrets.TF_VAR_GITHUB_APP_ID }}
  TF_VAR_GITHUB_APP_PRIVATE_KEY_BASE64: ${{ secrets.TF_VAR_GITHUB_APP_PRIVATE_KEY_BASE64 }}
  GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}

jobs:
  terraform:
    name: "Terraform"
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2

      - name: Init
        run: terraform init

      - name: Plan
        id: plan
        run: terraform plan

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false