tf-plan.yml

name: Terraform Plan

on:
  workflow_call:
    inputs:
      aws_account_id:
        description: "AWS account ID"
        type: string
        default: "553637109631"
      aws_region:
        description: "AWS region"
        type: string
        default: "eu-central-1"
      tf_root:
        description: "Terraform root directory"
        type: string
        default: "terraform"
      team:
        description: "Team from app.yaml (the broker verifies the repo belongs to it)"
        type: string
        default: ""
    outputs:
      has_changes:
        description: "Whether the plan has changes"
        value: ${{ jobs.plan.outputs.has_changes }}
      plan_key:
        description: "S3 key of the plan artifact"
        value: ${{ jobs.plan.outputs.plan_key }}
      plan_sha256:
        description: "SHA256 hash of the plan artifact"
        value: ${{ jobs.plan.outputs.plan_sha256 }}
      risk_level:
        description: "Risk level from LLM review (LOW, MEDIUM, HIGH, FAILED)"
        value: ${{ jobs.plan.outputs.risk_level }}
      planned_sha:
        description: "Commit the plan was made from (includes generated Terraform)"
        value: ${{ jobs.plan.outputs.planned_sha }}

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.plan.outputs.has_changes }}
      plan_key: ${{ steps.upload.outputs.plan_key }}
      plan_sha256: ${{ steps.upload.outputs.plan_sha256 }}
      risk_level: ${{ steps.review.outputs.risk_level }}
      planned_sha: ${{ steps.sha.outputs.sha }}
    env:
      PLAN_BUCKET: javabin-ci-plan-artifacts-${{ inputs.aws_account_id }}
    steps:
      - name: Set session name
        # Bot actors (renovate[bot]) contain characters STS rejects in session names
        run: echo "SESSION_NAME=$(echo "${GITHUB_ACTOR}-${GITHUB_SHA:0:8}-${GITHUB_RUN_ID}" | tr -c 'A-Za-z0-9+=,.@_\n-' '-' | head -c 64)" >> "$GITHUB_ENV"

      # Branch head, not github.sha: expand may have just committed generated
      # Terraform on top of the triggering commit.
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.head_ref || github.ref }}

      - name: Record planned commit
        id: sha
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: "1.7"
          terraform_wrapper: false

      # javaBin/platform is public: the caller's own GITHUB_TOKEN can read it,
      # so app repos need no GitHub App credentials for any pipeline step.
      - name: Checkout platform scripts
        uses: actions/checkout@v6
        with:
          repository: javaBin/platform
          ref: main
          path: .platform
          sparse-checkout: scripts
          persist-credentials: false

      - name: Assume broker role via OIDC
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ inputs.aws_account_id }}:role/javabin-ci-app-broker
          aws-region: ${{ inputs.aws_region }}
          role-session-name: ${{ env.SESSION_NAME }}

      - name: Get team credentials from broker
        id: broker
        env:
          PROJECT: javabin
          APP_TEAM: ${{ inputs.team }}
        run: sh .platform/scripts/invoke-ci-broker.sh plan

      - name: Ensure Terraform boilerplate
        env:
          AWS_ACCOUNT_ID: ${{ inputs.aws_account_id }}
          AWS_REGION: ${{ inputs.aws_region || 'eu-central-1' }}
          GH_TOKEN: ${{ github.token }}
        run: sh .platform/scripts/ensure-tf-boilerplate.sh "${{ inputs.tf_root }}"

      - name: Terraform Init
        working-directory: ${{ inputs.tf_root }}
        run: terraform init -input=false

      - name: Terraform Validate
        working-directory: ${{ inputs.tf_root }}
        run: terraform validate

      - name: Terraform Format Check
        working-directory: ${{ inputs.tf_root }}
        run: terraform fmt -check -recursive

      - name: Terraform Plan
        id: plan
        run: .platform/scripts/run-plan.sh "${{ inputs.tf_root }}"

      - name: Upload plan to S3
        id: upload
        if: steps.plan.outputs.has_changes == 'true'
        run: .platform/scripts/upload-plan.sh "${{ inputs.tf_root }}"

      # ----------------------------------------------------------------
      # LLM plan review — done by the javabin-plan-review Lambda with
      # platform credentials (team roles have no Bedrock access, and only
      # the Lambda may write risk.json). Re-assume the broker OIDC role,
      # which may invoke it.
      # ----------------------------------------------------------------
      - name: Assume broker role for plan review
        if: steps.plan.outputs.has_changes == 'true'
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ inputs.aws_account_id }}:role/javabin-ci-app-broker
          aws-region: ${{ inputs.aws_region }}
          role-session-name: ${{ env.SESSION_NAME }}

      - name: Run LLM review
        id: review
        if: steps.plan.outputs.has_changes == 'true'
        env:
          NOTIFY: ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
        run: sh .platform/scripts/invoke-plan-review.sh "${{ steps.upload.outputs.plan_key }}"

      - name: Post plan + review to PR
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: sh .platform/scripts/post-plan-comment.sh "${{ inputs.tf_root }}/plan-output.txt" "${{ steps.plan.outputs.has_changes }}"