test-changes-only.yaml

name: Test terraform-apply changes-only PR comment

on:
  - pull_request

permissions:
  contents: read

jobs:
  no_changes:
    runs-on: ubuntu-24.04
    name: changes-only should not create a comment
    permissions:
      contents: read
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan without changes
        uses: ./terraform-plan
        id: plan
        with:
          label: test-changes-only change-only THIS SHOULD NOT BE A COMMENT
          path: tests/workflows/test-changes-only
          add_github_comment: changes-only

      - name: Verify outputs
        env:
          CHANGES: ${{ steps.plan.outputs.changes }}
        run: |
          if [[ "$CHANGES" != "false" ]]; then
            echo "::error:: output changes not set correctly"
            exit 1
          fi

      - name: Apply without changes
        uses: ./terraform-apply
        id: apply
        with:
          label: test-changes-only change-only THIS SHOULD NOT BE A COMMENT
          path: tests/workflows/test-changes-only

      - name: Check failure-reason
        env:
          FAILURE_REASON: ${{ steps.apply.outputs.failure-reason }}
        run: |
          if [[ "$FAILURE_REASON" != "" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi

  change_then_no_changes:
    runs-on: ubuntu-24.04
    name: changes-only should still replace a change comment
    permissions:
      contents: read
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan changes
        uses: ./terraform-plan
        id: changes-plan
        with:
          label: test-changes-only change_then_no_changes
          path: tests/workflows/test-changes-only
          variables: |
            cause-changes=true
          add_github_comment: changes-only

      - name: Verify changes
        env:
          CHANGES: ${{ steps.changes-plan.outputs.changes }}
        run: |
          if [[ "$CHANGES" != "true" ]]; then
            echo "::error:: output changes not set correctly"
            exit 1
          fi

      - name: Plan no changes
        uses: ./terraform-plan
        id: plan
        with:
          label: test-changes-only change_then_no_changes
          path: tests/workflows/test-changes-only
          variables: |
            cause-changes=false
          add_github_comment: changes-only

      - name: Verify no changes
        env:
          CHANGES: ${{ steps.plan.outputs.changes }}
        run: |
          if [[ "$CHANGES" != "false" ]]; then
            echo "::error:: output changes not set correctly"
            exit 1
          fi

      - name: Apply no changes
        uses: ./terraform-apply
        id: apply
        with:
          label: test-changes-only change_then_no_changes
          path: tests/workflows/test-changes-only
          variables: |
            cause-changes=false

      - name: Check failure-reason
        env:
          FAILURE_REASON: ${{ steps.apply.outputs.failure-reason }}
        run: |
          if [[ "$FAILURE_REASON" != "" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi

  no_changes_then_changes:
    runs-on: ubuntu-24.04
    name: Apply with changes should fail after a changes-only plan with no changes
    permissions:
      contents: read
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan no changes
        uses: ./terraform-plan
        id: plan
        with:
          path: tests/workflows/test-changes-only
          label: test-changes-only no_changes_then_changes
          variables: |
            cause-changes=false
          add_github_comment: changes-only

      - name: Verify no changes
        env:
          CHANGES: ${{ steps.plan.outputs.changes }}
        run: |
          if [[ "$CHANGES" != "false" ]]; then
            echo "::error:: output changes not set correctly"
            exit 1
          fi

      - name: Apply with changes
        uses: ./terraform-apply
        id: apply
        continue-on-error: true
        with:
          path: tests/workflows/test-changes-only
          label: test-changes-only no_changes_then_changes
          variables: |
            cause-changes=true

      - name: Check failed to apply
        env:
          OUTCOME: ${{ steps.apply.outcome }}
          FAILURE_REASON: ${{ steps.apply.outputs.failure-reason }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "plan-changed" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi

  apply_when_plan_has_changed:
    runs-on: ubuntu-24.04
    name: Apply should fail if the approved plan has changed
    permissions:
      contents: read
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan Changes
        uses: ./terraform-plan
        with:
          path: tests/workflows/test-changes-only
          label: test-changes-only apply_when_plan_has_changed
          variables: |
            cause-changes=true

      - name: Apply different changes
        uses: ./terraform-apply
        id: apply
        continue-on-error: true
        with:
          path: tests/workflows/test-changes-only
          label: test-changes-only apply_when_plan_has_changed
          variables: |
            cause-changes=true
            len=4

      - name: Check failed to apply
        env:
          OUTCOME: ${{ steps.apply.outcome }}
          FAILURE_REASON: ${{ steps.apply.outputs.failure-reason }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "plan-changed" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi