Run tofu plan on pull requests

Author: larsks

.github/workflows/plan.yaml

@@ -0,0 +1,52 @@
+name: Plan configuration
+
+on:
+  pull_request:
+    paths:
+      - "**/*.tf"
+      - "**/*.tfvars"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  plan:
+    # This workflow cannot run on pull requests from forked repositories
+    # (because we do not want to grant access to our AWS credentials to
+    # third-party code).
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    env:
+      TF_CLI_ARGS: "-no-color"
+      TF_IN_AUTOMATION: "true"
+      TF_VAR_aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+      TF_VAR_aws_account_id_secondary: ${{ secrets.AWS_ACCOUNT_ID_SECONDARY }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@v2
+        with:
+          tofu_wrapper: false
+
+      - name: TF init
+        run: |
+          tofu init
+
+      - name: TF Validate
+        run: |
+          tofu validate
+
+      - name: TF Plan & Policy
+        run: |
+          ./scripts/check-policy.sh

.github/workflows/pre-commit.yaml

@@ -3,9 +3,9 @@ name: pre-commit
 on:
   workflow_dispatch:
   pull_request:
-  push:
-    branches-ignore:
-      - main
+
+env:
+  TERRAFORM_DOCS_VERSION: "0.24.0"
 
 jobs:
   pre-commit:
@@ -21,6 +21,10 @@ jobs:
       - uses: opentofu/setup-opentofu@v2
         with:
           tofu_wrapper: false
+      - name: Install terraform-docs
+        run: |
+          curl -sSLo terraform-docs.tar.gz https://github.com/terraform-docs/terraform-docs/releases/download/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz
+          tar -C /usr/local/bin -xf terraform-docs.tar.gz terraform-docs
       - uses: pre-commit/action@v3.0.1
         with:
           extra_args: --all-files