.gitlab-ci.yml

image:
  name: registry.gitlab.com/gitlab-org/gitlab-build-images:terraform
  entrypoint:
    - '/usr/bin/env'
    - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

cache:
  paths:
    - .terraform

variables:
  YC_SERVICE_ACCOUNT_KEY_FILE: /tmp/sa-key.json

before_script:
  - |
    cat <<EOF >> ~/.terraformrc
    provider_installation {
      network_mirror {
        url = "https://terraform-mirror.yandexcloud.net/"
        include = ["registry.terraform.io/*/*"]
      }
      direct {
        exclude = ["registry.terraform.io/*/*"]
      }
    }
    EOF
  - terraform init
  - echo $YC_KEY > /tmp/sa-key.json

stages:
  - validate
  - lint
  - plan
  - apply

validate:
  stage: validate
  script:
    - terraform validate

lint:checkov:
  stage: lint
  image:
    name: bridgecrew/checkov:2.2.299
    entrypoint:
      - '/usr/bin/env'
      - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
  before_script:
    - echo OK
  script: checkov -d .

lint:tflint:
  stage: lint
  image:
    name: ghcr.io/terraform-linters/tflint:v0.45.0
    entrypoint:
      - '/usr/bin/env'
      - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
  before_script:
    - echo OK
  script:
    - tflint -f compact

    
plan:
  stage: plan
  script:
    - terraform plan -out="planfile"
  artifacts:
    paths:
      - planfile

apply:
  stage: apply
  script:
    - terraform apply -auto-approve "planfile"
  when: manual