feat: add terragrunt functionality

.github/workflows/test_terragrunt.yaml

@@ -0,0 +1,179 @@
+---
+name: Test Terragrunt
+
+on:
+  pull_request: # Plan.
+    paths: [tests/terragrunt/**, .github/workflows/test_terragrunt.yaml]
+    types: [opened, synchronize, reopened, labeled]
+  merge_group: # Apply.
+    types: [checks_requested]
+  workflow_dispatch:
+    inputs:
+      command:
+        description: 'Infrastructure command to run'
+        required: true
+        default: 'plan'
+        type: choice
+        options:
+          - plan
+          - apply
+          - destroy
+
+env:
+  TF_VERSION: "1.5.0"
+  TG_VERSION: "0.48.0"
+  AWS_REGION: "us-west-1"
+
+jobs:
+  Target:
+    runs-on: ubuntu-24.04
+
+    permissions:
+      issues: write # Required to add PR label.
+      pull-requests: write # Required to add PR comment.
+
+    outputs:
+      targets: ${{ steps.changed.outputs.targets }}
+
+    steps:
+      - name: Changed files
+        id: changed
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
+        run: |
+          # Add link to PR during apply job summary.
+          if [[ "${{ github.event_name }}" == "merge_group" ]]; then
+            PR_NUMBER=$(echo "${{ github.ref_name }}" | sed -n 's/.*pr-\([0-9]*\)-.*/\1/p')
+            echo "View PR [#${PR_NUMBER}](https://github.com/${{ github.repository }}/pull/${PR_NUMBER}) to review planned proposal." >> $GITHUB_STEP_SUMMARY
+          fi
+          # Remove "tg-plan" PR label if it exists.
+          if [[ "${{ github.event.action }}" == "labeled" ]]; then gh api /repos/${{ github.repository }}/issues/${PR_NUMBER}/labels/tg-plan --method DELETE --silent; fi
+          # Output changed targets.
+          changed=$(gh api /repos/${{ github.repository }}/pulls/${PR_NUMBER}/files --paginate --jq '.[].filename')
+          echo "targets=$(echo "$changed" | jq -R 'select(test("^tests/terragrunt/live/")) | split("/")[4]' | jq -c -s 'unique | sort')" >> $GITHUB_OUTPUT
+
+  TG:
+    runs-on: ubuntu-24.04
+    needs: [Target]
+    if: ${{ needs.Target.outputs.targets != '[]' || github.event_name == 'workflow_dispatch' }}
+
+    permissions:
+      actions: read # Required to identify workflow run.
+      checks: write # Required to add status summary.
+      contents: read # Required to checkout repository.
+      id-token: write # Required to authenticate via OIDC.
+      issues: write # Required to add PR label.
+      pull-requests: write # Required to add PR comment.
+
+    strategy:
+      fail-fast: false
+      matrix:
+        target: ${{ fromJson(needs.Target.outputs.targets) }}
+
+    concurrency:
+      cancel-in-progress: false
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name}}-${{ matrix.target }}
+
+    environment: ${{ matrix.target }}
+
+    steps:
+      - name: Authenticate AWS
+        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: ${{ vars.AWS_ROLE }}
+          role-session-name: tg-via-pr-${{ github.run_id }}-${{ github.run_attempt }}
+
+      - name: Authenticate GitHub
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.number }}
+        run: |
+          # Authenticate with GitHub token.
+          git config --global url."https://token:${GH_TOKEN}@github.com".insteadOf "https://github.com"
+          # Add the target name as a PR label if it does not exist.
+          if [[ "${{ github.event_name }}" == "pull_request" && "${{ !contains(github.event.pull_request.labels.*.name, matrix.target) }}" == "true" ]]; then
+            gh api /repos/${{ github.repository }}/issues/${PR_NUMBER}/labels --method POST --field "labels[]=${{ matrix.target }}" --silent
+          fi
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+
+      - name: Setup Terragrunt
+        run: |
+          wget https://github.com/gruntwork-io/terragrunt/releases/download/v${{ env.TG_VERSION }}/terragrunt_linux_amd64
+          chmod +x terragrunt_linux_amd64
+          sudo mv terragrunt_linux_amd64 /usr/local/bin/terragrunt
+
+      - name: Checkout PR
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: Provision TG
+        id: tg
+        uses: ./
+        with:
+          working-directory: tests/terragrunt/live/project/${{ matrix.target }}
+          tool: terragrunt
+          command: ${{ github.event_name == 'merge_group' && 'apply' || (github.event_name == 'workflow_dispatch' && github.event.inputs.command || 'plan') }}
+          arg-lock-timeout: 3m
+          plan-encrypt: secrets.TF_ENCRYPTION
+          plan-parity: true
+          retention-days: 1
+          expand-diff: true
+          tag-actor: never
+          arg-auto-approve: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.command == 'apply' || github.event.inputs.command == 'destroy') }}
+
+      - name: Troubleshoot TG
+        if: ${{ failure() && github.event_name == 'merge_group' }}
+        uses: op5dev/prompt-ai@4cacb93e4a1e101f3a89650b31a3582321f2461d # v2.0.0
+        with:
+          model: openai/gpt-4.1-mini
+          system-prompt: You are a helpful DevOps assistant and expert at troubleshooting Terragrunt errors.
+          user-prompt: Troubleshoot the following Terragrunt output; ${{ steps.tg.outputs.result }}
+
+      - name: Clear directory
+        if: ${{ failure() && github.event_name == 'merge_group' }}
+        run: find ${{ github.workspace }} -mindepth 1 -delete
+
+      - name: Checkout main
+        if: ${{ failure() && github.event_name == 'merge_group' }}
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: main
+          persist-credentials: false
+
+      - name: Rollback TG
+        if: ${{ failure() && github.event_name == 'merge_group' }}
+        uses: ./
+        with:
+          working-directory: tests/terragrunt/live/project/${{ matrix.target }}
+          tool: terragrunt
+          command: apply
+          arg-auto-approve: true
+          arg-lock-timeout: 3m
+          comment-pr: never
+
+# Todo:  Will uncomment when this workflow is fully implemented.
+  Notify:
+    runs-on: [ubuntu-24.04]
+    needs: [Target, TG]
+    if: ${{ !cancelled() }}
+
+    permissions:
+      actions: read # Required to identify workflow run.
+
+    steps:
+      - name: Notify Slack on failure
+        if: ${{ github.event_name == 'merge_group' && contains(needs.*.result, 'failure') }}
+        uses: gamesight/slack-workflow-status@68bf00d0dbdbcb206c278399aa1ef6c14f74347a # v1.3.0
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          slack_webhook_url: https://hooks.slack.com/services/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
+
+      - name: Exit status
+        run: exit ${{ contains(needs.*.result, 'failure') && 1 || 0 }}