ci.yaml

name: 'CI checks'

on:
  push:
    branches:
      - master
      - main
  pull_request:
    branches:
      - master
      - main

env:
  tf_version: '0.13.7'
  tfsec_path: '.github/configs/tfsec.yml'

jobs:
  run-terraform-check:
    runs-on: [ ubuntu-latest ]
    # runs-on: [ self-hosted, devops, terraform ]

    steps:
      - name: 'Checkout'
        uses: actions/checkout@v2

      - name: 'Get all changed files'
        id: changed_files
        uses: jitterbit/get-changed-files@v1
      
      - name: 'Print out list of changed files'
        run: |
          for changed_file in ${{ steps.changed_files.outputs.all }}; do
            echo "${changed_file}."
          done

      - name: 'Prepare CI environment'
        uses: hashicorp/setup-terraform@v1
        with:
          terraform_version: ${{ env.tf_version }}

      - name: 'Run terraform format'
        id: fmt
        run: python scripts/helper.py run-terraform-fmt --check -f "${{ steps.changed_files.outputs.all }}"
        continue-on-error: true

      - name: 'Run terraform validate'
        id: validate
        run: python scripts/helper.py run-terraform-validate -f "${{ steps.changed_files.outputs.all }}"

      - name: Configure AWS credentials from Test account
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.TF_TEST_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.TF_TEST_AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Configure GCP credentials from supermetrics-dev-sandbox project
        uses: google-github-actions/setup-gcloud@v0.6.0
        with:
          project_id: supermetrics-dev-sandbox
          service_account_key: ${{ secrets.TF_TEST_GCP_SA_KEY }}
          export_default_credentials: true

      - name: 'Run terraform plan'
        id: plan
        run: python scripts/helper.py run-terraform-plan -f "${{ steps.changed_files.outputs.all }}"

      - name: 'Run tfsec'
        uses: tfsec/tfsec-pr-commenter-action@v1.1.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Add comment on PR'
        uses: actions/github-script@0.9.0
        if: github.event_name == 'pull_request' && (steps.fmt.outcome != 'success' || steps.validate.outcome != 'success' || steps.plan.outcome != 'success')
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `
            #### Terraform Format and Style 🖌  \`${{ steps.fmt.outcome }}\`
            #### Terraform Validation 🤖  \`${{ steps.validate.outcome }}\`
            #### Terraform Plan 📖  \`${{ steps.plan.outcome }}\`
            
            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Workflow: \`${{ github.workflow }}\`*`;
              
            github.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })