plan.yml

name: Plan

on:
  pull_request_target:
    branches: [master] # no need to create plans on other PRs because they can be only used after a merge to the default branch
  workflow_dispatch:

defaults:
  run:
    shell: bash

concurrency:
  group: plan-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true # we only care about the most recent plan for any given PR/ref

jobs:
  prepare:
    permissions:
      actions: read
      contents: read
      pull-requests: read
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      workspaces: ${{ steps.workspaces.outputs.this }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - if: github.event_name == 'pull_request_target'
        env:
          NUMBER: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch origin "pull/${NUMBER}/head"
          # we delete github directory first to ensure we only get YAMLs from the PR
          rm -rf github && git checkout "${SHA}" -- github
      - name: Discover workspaces
        id: workspaces
        run: echo "this=$(ls github | jq --raw-input '[.[0:-4]]' | jq -sc add)" >> $GITHUB_OUTPUT
      - name: Wait for Apply to finish
        run: |
          while [[ "$(gh api /repos/${{ github.repository }}/actions/workflows/apply.yml/runs --jq '.workflow_runs | map(.status) | map(select(. != "completed")) | length')" != '0' ]]; do
            echo "Waiting for all Apply workflow runs to finish..."
            sleep 10
          done
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        timeout-minutes: 10
  classify:
    needs: [prepare]
    permissions:
      contents: read
      pull-requests: read
    name: Classify
    runs-on: ubuntu-latest
    environment: read
    outputs:
      matrix: ${{ steps.classify.outputs.matrix }}
    env:
      TF_IN_AUTOMATION: 1
      TF_INPUT: 0
      AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
      WORKSPACES: ${{ needs.prepare.outputs.workspaces }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - if: github.event_name == 'pull_request_target'
        env:
          NUMBER: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch origin "pull/${NUMBER}/head"
          rm -rf github && git checkout "${SHA}" -- github
      - name: Setup terraform
        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
        with:
          terraform_version: 1.12.0
          terraform_wrapper: false
      - name: Initialize terraform
        run: terraform init
        working-directory: terraform
      - name: Install pnpm
        uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
        with:
          version: 10
      - name: Use Node.js lts/*
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: lts/*
          cache: ''
      - run: pnpm install --frozen-lockfile && pnpm run build
        working-directory: scripts
      - name: Classify workspaces
        id: classify
        env:
          MODE: read
        run: node lib/actions/classify-allow-destroy.js
        working-directory: scripts
  plan:
    needs: [prepare, classify]
    permissions:
      contents: read
      pull-requests: read
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.classify.outputs.matrix) }}
    name: Plan
    runs-on: ubuntu-latest
    environment: ${{ matrix.environment }}
    env:
      TF_IN_AUTOMATION: 1
      TF_INPUT: 0
      TF_WORKSPACE: ${{ matrix.workspace }}
      AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
      GITHUB_APP_ID: ${{ secrets.RO_GITHUB_APP_ID }}
      GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RO_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] || secrets.RO_GITHUB_APP_INSTALLATION_ID }}
      GITHUB_APP_PEM_FILE: ${{ secrets.RO_GITHUB_APP_PEM_FILE }}
      TF_VAR_write_delay_ms: 300
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - if: github.event_name == 'pull_request_target'
        env:
          NUMBER: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch origin "pull/${NUMBER}/head"
          rm -rf github && git checkout "${SHA}" -- github
      - name: Setup terraform
        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
        with:
          terraform_version: 1.12.0
          terraform_wrapper: false
      - name: Initialize terraform
        run: terraform init
        working-directory: terraform
      - name: Allow destroy in guarded environment
        if: matrix.environment == 'read-allow-destroy'
        env:
          ALLOW_DESTROY: ${{ vars.ALLOW_DESTROY }}
        run: |
          if [[ "${ALLOW_DESTROY}" != "true" ]]; then
            echo "The read-allow-destroy environment must define ALLOW_DESTROY=true."
            exit 1
          fi
          cp allow_destroy_override.tf.disabled allow_destroy_override.tf
        working-directory: terraform
      - name: Summarize plan target
        env:
          SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number || '' }}
          ENVIRONMENT_REASONS: ${{ toJson(matrix.environmentReasons) }}
        run: |
          {
            echo '## Plan target'
            echo ''
            if [[ -n "${PULL_REQUEST_NUMBER}" ]]; then
              echo "- Pull request: #${PULL_REQUEST_NUMBER}"
            fi
            echo "- Source SHA: \`${SOURCE_SHA}\`"
            echo "- Workspace: \`${TF_WORKSPACE}\`"
            echo "- Environment: \`${{ matrix.environment }}\`"
            if [[ "$(jq 'length' <<< "${ENVIRONMENT_REASONS}")" == '0' ]]; then
              echo "- Environment reason: no allow-destroy changes detected"
            else
              echo "- Environment reason:"
              jq -r '.[] | "  - " + .' <<< "${ENVIRONMENT_REASONS}"
            fi
            echo "- Terraform plan artifact: \`${TF_WORKSPACE}_${SOURCE_SHA}.tfplan\`"
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Plan terraform
        run: |
          terraform show -json > "$TF_WORKSPACE.tfstate.json"
          terraform plan -refresh=false -lock=false -out="${TF_WORKSPACE}.tfplan" -no-color
        working-directory: terraform
      - name: Upload terraform plan
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ env.TF_WORKSPACE }}_${{ github.event.pull_request.head.sha || github.sha }}.tfplan
          path: terraform/${{ env.TF_WORKSPACE }}.tfplan
          if-no-files-found: error
          retention-days: 90
  comment:
    needs: [prepare, plan]
    if: github.event_name == 'pull_request_target'
    permissions:
      contents: read
      pull-requests: write
    name: Comment
    runs-on: ubuntu-latest
    environment: read
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - if: github.event_name == 'pull_request_target'
        env:
          NUMBER: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch origin "pull/${NUMBER}/head"
          rm -rf github && git checkout "${SHA}" -- github
      - name: Setup terraform
        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
        with:
          terraform_version: 1.12.0
          terraform_wrapper: false
      - name: Initialize terraform
        run: terraform init
        working-directory: terraform
      - name: Download terraform plans
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: terraform
      - name: Show terraform plans
        run: |
          for plan in $(find . -type f -name '*.tfplan'); do
            echo "<details><summary>$(basename "${plan}" '.tfplan')</summary>" >> TERRAFORM_PLANS.md
            echo '' >> TERRAFORM_PLANS.md
            echo '~~~~terraform' >> TERRAFORM_PLANS.md
            terraform show -no-color "${plan}" 2>&1 | sed 's/^~~~~/~~~~ /' >> TERRAFORM_PLANS.md
            echo '~~~~' >> TERRAFORM_PLANS.md
            echo '' >> TERRAFORM_PLANS.md
            echo '</details>' >> TERRAFORM_PLANS.md
          done
          cat TERRAFORM_PLANS.md
        working-directory: terraform
      - name: Publish terraform plans summary
        run: cat TERRAFORM_PLANS.md >> "$GITHUB_STEP_SUMMARY"
        working-directory: terraform
      - name: Upload terraform plans summary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: terraform-plans-${{ github.event.pull_request.head.sha || github.sha }}
          path: terraform/TERRAFORM_PLANS.md
          if-no-files-found: error
          retention-days: 14
      - name: Prepare comment
        run: |
          delimiter="$(uuidgen)"
          echo "COMMENT<<${delimiter}" >> $GITHUB_ENV
          if [[ $(wc -c TERRAFORM_PLANS.md | cut -d' ' -f1) -ge 65000 ]]; then
            echo "Terraform plans are too long to post as a comment. Please inspect [Plan > Comment > Show terraform plans](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) instead." >> $GITHUB_ENV
          else
            cat TERRAFORM_PLANS.md >> $GITHUB_ENV
          fi
          echo "${delimiter}" >> $GITHUB_ENV
        working-directory: terraform
      - name: Comment on pull request
        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          header: plan
          number: ${{ github.event.pull_request.number }}
          message: |
            Before merge, verify that all the following plans are correct. After merge, Apply will regenerate the plans from the merged commit and continue only if they match.

            #### Terraform plans
            ${{ env.COMMENT }}