terraform.yml

name: "Terraform Workflow"

on:
  workflow_call:
    inputs:
      environment:
        type: string
        required: true
      aws-assume-role-arn:
        type: string
        required: true
      aws-region:
        type: string
        required: true
      aws-statefile-s3-bucket:
        type: string
        required: true
      aws-lock-dynamodb-table:
        type: string
        required: true

jobs:
  terraform:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.8.3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ inputs.aws-assume-role-arn }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ inputs.aws-region }}

      - name: Read destroy configuration
        id: read-destroy-config
        run: |
          DESTROY="$(jq -r '.${{ inputs.environment }}' ./infra/destroy_config.json)"
          echo "destroy=$(echo $DESTROY)" >> $GITHUB_OUTPUT

      - name: Terraform Init
        run: |
          cd infra && terraform init \
            -backend-config="bucket=${{ inputs.aws-statefile-s3-bucket }}" \
            -backend-config="key=${{ github.event.repository.name }}" \
            -backend-config="region=${{ inputs.aws-region }}" \
            -backend-config="dynamodb_table=${{ inputs.aws-lock-dynamodb-table }}"

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Destroy
        if: steps.read-destroy-config.outputs.destroy == 'true'
        id: terraform-destroy
        run: cd infra &&
          terraform workspace select ${{ inputs.environment }} || terraform workspace new ${{ inputs.environment }} &&
          terraform destroy -var-file="./envs/${{ inputs.environment }}/terraform.tfvars" -auto-approve

      - name: Terraform Plan
        if: steps.read-destroy-config.outputs.destroy != 'true'
        id: terraform-plan
        run: cd infra &&
          terraform workspace select ${{ inputs.environment }} || terraform workspace new ${{ inputs.environment }} &&
          terraform plan -var-file="./envs/${{ inputs.environment }}/terraform.tfvars" -out="${{ inputs.environment }}.plan"

      - name: Terraform Apply
        if: steps.read-destroy-config.outputs.destroy != 'true'
        id: terraform-apply
        run: cd infra &&
          terraform workspace select ${{ inputs.environment }} || terraform workspace new ${{ inputs.environment }} &&
          terraform apply "${{ inputs.environment }}.plan"