action.yml

name: 'GitHub Action Atmos Terraform Plan'
description: 'GitHub Action Atmos Terraform Plan'
author: hello@cloudposse.com
branding:
  icon: 'server'
  color: 'white'
inputs:
  component:
    description: "The name of the component to plan."
    required: true
  stack:
    description: "The stack name for the given component."
    required: true
  sha:
    description: "Commit SHA to plan. Default: github.sha"
    required: true
    default: "${{ github.event.pull_request.head.sha }}"
  drift-detection-mode-enabled:
    description: "Indicate whether this action is used in drift detection workflow."
    required: true
    default: 'false'
  atmos-pro-base-url:
    description: The base URL of Atmos Pro
    required: false
    default: "https://atmos-pro.com"    
  atmos-pro-upload-status:
    description: "If set atmos will upload the plan result to the pro API"
    required: false
    default: 'false'
  atmos-version:
    description: The version of atmos to install
    required: false
    default: ">= 1.158.0"
  atmos-config-path:
    description: The path to the atmos.yaml file
    required: true
  infracost-api-key:
    description: "Infracost API key"
    required: false
  metadata-retention-days:
    description: "Infracost API key"
    required: false
    default: "1"
  branding-logo-image:
    description: "Branding logo image url"
    required: false
    default: "https://cloudposse.com/logo-300x69.svg"
  branding-logo-url:
    description: "Branding logo url"
    required: false
    default: "https://cloudposse.com/"
  debug:
    description: "Enable action debug mode. Default: 'false'"
    default: 'false'
    required: false
  token:
    description:
      Used to pull node distributions for Atmos from Cloud Posse's GitHub repository. Since there's a default, this is typically
      not supplied by the user. When running this action on github.com, the default value is sufficient. When running on
      GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
  skip-checkout:
    description: "Disable actions/checkout. Useful for when the checkout happens in a previous step and file are modified outside of git through other actions"
    required: false
    default: 'false'
  pr-comment:
    description: "Set to 'true' to create a PR comment with the summary of the plan"
    required: false
    default: 'false'
  plan-storage:
    description: "Enable plan storage. Default: 'true'. Set to 'false' to disable plan storage."
    required: false
    default: 'true'
  identity:
    description: Atmos auth identity
    required: false
    default: ""
outputs:
  summary:
    description: "Summary"
    value: "${{ steps.summary.outputs.result }}"
  plan_file:
    description: "Path to the terraform plan file"
    value: "${{ steps.results.outputs.plan_file }}"
  plan_json:
    description: "Path to the terraform plan in JSON format"
    value: "${{ steps.results.outputs.plan_file_json }}"
  has-changes:
    description: "Whether the plan has changes. Value is string 'true' or 'false'"
    value: "${{ steps.atmos-plan.outputs.changes }}"


runs:
  using: "composite"
  steps:
    - name: Checkout
      if: ${{ inputs.skip-checkout != 'true' }}
      uses: actions/checkout@v4
      with:
        ref: ${{ inputs.sha }}

    - name: Set atmos cli config path vars
      shell: bash
      run: |-
        echo "ATMOS_CLI_CONFIG_PATH=$(realpath ${{ inputs.atmos-config-path }})" >> $GITHUB_ENV

    - name: Install Atmos
      if: ${{ inputs.atmos-version != '' }}
      uses: cloudposse/github-action-setup-atmos@v2
      with:
        atmos-version: ${{ inputs.atmos-version }}
        token: ${{ inputs.token }}
        install-wrapper: false

    - name: Get atmos settings
      id: atmos-settings
      uses: cloudposse/github-action-atmos-get-setting@v2
      with:
        # Here we do not process-templates because that requires terraform. Which we install after fetching the version
        # processing templates here can cause an issue where cached terraform versions conflict with the version we want to install
        process-templates: 'false'
        process-functions: 'false'
        settings: |
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.github.actions_enabled
            outputPath: github-actions-enabled
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.pro.enabled
            outputPath: atmos-pro-enabled
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: component_info.component_path
            outputPath: component-path
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: atmos_cli_config.base_path
            outputPath: base-path
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: command
            outputPath: command
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.opentofu-version
            outputPath: opentofu-version
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.terraform-version
            outputPath: terraform-version
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.infracost-enabled
            outputPath: enable-infracost
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.role.plan
            outputPath: terraform-plan-role
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.region
            outputPath: aws-region
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.role
            outputPath: terraform-state-role
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.table
            outputPath: terraform-state-table
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.bucket
            outputPath: terraform-state-bucket
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.plan-repository-type
            outputPath: plan-repository-type
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.blob-account-name
            outputPath: blob-account-name
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.blob-container-name
            outputPath: blob-container-name
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.metadata-repository-type
            outputPath: metadata-repository-type
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.cosmos-container-name
            outputPath: cosmos-container-name
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.cosmos-database-name
            outputPath: cosmos-database-name
          - component: ${{ inputs.component }}
            stack: ${{ inputs.stack }}
            settingsPath: settings.integrations.github.gitops.artifact-storage.cosmos-endpoint
            outputPath: cosmos-endpoint

    - name: Add Terraform and OpenTofu to Aqua
      shell: bash
      run: |
        cat << EOF > aqua.yaml
        registries:
          - type: standard
            ref: v4.233.0
        packages:
          - name: suzuki-shunsuke/tfcmt@v4.14.5
        EOF

        # Add Terraform if specified
        if [[ "${{ fromJson(steps.atmos-settings.outputs.settings).terraform-version }}" != "" && "${{ fromJson(steps.atmos-settings.outputs.settings).terraform-version }}" != "null" ]]; then
          VERSION="${{ fromJson(steps.atmos-settings.outputs.settings).terraform-version }}"
          if [[ ! "$VERSION" =~ ^v ]]; then
            VERSION="v$VERSION"
          fi
          echo "  - name: hashicorp/terraform@$VERSION" >> aqua.yaml
        fi

        # Add OpenTofu if specified
        if [[ "${{ fromJson(steps.atmos-settings.outputs.settings).opentofu-version }}" != "" && "${{ fromJson(steps.atmos-settings.outputs.settings).opentofu-version }}" != "null" ]]; then
          VERSION="${{ fromJson(steps.atmos-settings.outputs.settings).opentofu-version }}"
          if [[ ! "$VERSION" =~ ^v ]]; then
            VERSION="v$VERSION"
          fi
          echo "  - name: opentofu/opentofu@$VERSION" >> aqua.yaml
        fi

        # Debug output if debug is enabled
        if [[ "${{ inputs.debug }}" == "true" ]]; then
          echo "Generated aqua.yaml:"
          cat aqua.yaml
        fi

    - name: Cache Aqua
      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
      with:
        path: ~/.local/share/aquaproj-aqua
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-${{hashFiles('aqua.yaml')}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-

    - name: Install dependencies with Aqua
      uses: aquaproj/aqua-installer@5e54e5cee8a95ee2ce7c04cb993da6dfad13e59c # v3.1.2
      with:
        aqua_version: v2.50.0
      env:
        AQUA_CONFIG: aqua.yaml
        AQUA_LOG_LEVEL: debug

    - name: Configure Plan AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).aws-region != '' &&
        fromJson(steps.atmos-settings.outputs.settings).aws-region != 'null' &&
        fromJson(steps.atmos-settings.outputs.settings).terraform-plan-role != '' &&
        fromJson(steps.atmos-settings.outputs.settings).terraform-plan-role != 'null' }}
      with:
        aws-region: ${{ fromJson(steps.atmos-settings.outputs.settings).aws-region }}
        role-to-assume: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-plan-role }}
        role-session-name: "atmos-terraform-plan-gitops"
        mask-aws-account-id: "no"

    - name: Set atmos cli base path vars
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled }}
      shell: bash
      run: |-
        # Set ATMOS_BASE_PATH allow `cloudposse/utils` provider to read atmos config from the correct path
        ATMOS_BASE_PATH="${{ fromJson(steps.atmos-settings.outputs.settings).base-path }}"
        echo "ATMOS_BASE_PATH=$(realpath ${ATMOS_BASE_PATH:-./})" >> $GITHUB_ENV

    - name: Prepare Artifacts Directory
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled }}
      shell: bash
      run: |
        mkdir -p metadata

    - name: Define Job Variables
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled }}
      id: vars
      shell: bash
      run: |
        STACK_NAME=$(echo "${{ inputs.stack }}" | sed 's#/#_#g')
        COMPONENT_PATH=${{ fromJson(steps.atmos-settings.outputs.settings).component-path }}
        COMPONENT_CACHE_PATH=$(realpath ${{ fromJson(steps.atmos-settings.outputs.settings).component-path }})
        COMPONENT_NAME=$(echo "${{ inputs.component }}" | sed 's#/#_#g')
        COMPONENT_SLUG="$STACK_NAME-$COMPONENT_NAME"
        COMPONENT_CACHE_KEY=$(basename "${{ fromJson(steps.atmos-settings.outputs.settings).component-path }}")
        PLAN_FILE="$( realpath ${COMPONENT_PATH})/$COMPONENT_SLUG-${{ inputs.sha }}.planfile"
        PLAN_FILE_JSON="$( realpath ${COMPONENT_PATH})/$COMPONENT_SLUG-${{ inputs.sha }}.planfile.json"
        LOCK_FILE="$( realpath ${COMPONENT_PATH})/.terraform.lock.hcl"

        ISSUE_SUMMARY_FILE="$GITHUB_WORKSPACE/metadata/issue-description-${COMPONENT_SLUG}.md"
        STEP_SUMMARY_FILE="$GITHUB_WORKSPACE/metadata/step-summary-${COMPONENT_SLUG}.md"
        SUMMARY_FILE="$GITHUB_WORKSPACE/metadata/summary-${COMPONENT_SLUG}.md"

        COMPONENT_RELPATH=$(realpath --relative-to="${PWD}" ${COMPONENT_PATH})

        echo "stack_name=${STACK_NAME}" >> $GITHUB_OUTPUT
        echo "component_name=${COMPONENT_NAME}" >> $GITHUB_OUTPUT
        echo "component_slug=${COMPONENT_SLUG}" >> $GITHUB_OUTPUT
        echo "component_path=${COMPONENT_RELPATH}" >> $GITHUB_OUTPUT
        echo "component_cache_path=${COMPONENT_CACHE_PATH}" >> $GITHUB_OUTPUT
        echo "cache-key=${COMPONENT_CACHE_KEY}" >> $GITHUB_OUTPUT
        echo "plan_file=${PLAN_FILE}" >> $GITHUB_OUTPUT
        echo "plan_file_json=${PLAN_FILE_JSON}" >> $GITHUB_OUTPUT
        echo "lock_file=${LOCK_FILE}" >> $GITHUB_OUTPUT

        echo "summary_file=${SUMMARY_FILE}" >> $GITHUB_OUTPUT
        echo "step_summary_file=${STEP_SUMMARY_FILE}" >> $GITHUB_OUTPUT
        echo "issue_file=${ISSUE_SUMMARY_FILE}" >> $GITHUB_OUTPUT

    - name: Cache .terraform
      id: cache
      uses: actions/cache@v4
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled }}
      with:
        path: |
          ${{ steps.vars.outputs.component_cache_path }}/.terraform
        key: ${{ steps.vars.outputs.cache-key }}

    - name: Atmos Terraform Plan
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled }}
      id: atmos-plan
      shell: bash
      env:
        ATMOS_PRO_BASE_URL: ${{ inputs.atmos-pro-base-url }}
        TFCMT_GITHUB_TOKEN: ${{ inputs.token }}
      run: |
        # Verify tfcmt is installed
        # Since we disable exit on error, the real error will be swallowed later on
        echo "Ensure tfcmt is installed:"
        tfcmt --version

        # Disable exit on error so we can capture the terraform exit code
        # and handle it appropriately later in the script
        set +e

        # Remove the environment file from the cache to avoid conflicts with workspace select
        rm -f ./${{ steps.vars.outputs.component_path }}/.terraform/environment

        TERRAFORM_OUTPUT_FILE="./terraform-${GITHUB_RUN_ID}-output.txt"

        base_cmd=""

        if [[ -n "${{ inputs.identity }}" ]]; then
          base_cmd+=" --identity=${{ inputs.identity }}"
        fi

        atmos_pro_flags=""

        if [[ "${{ inputs.atmos-pro-upload-status }}" == "true" ]]; then
          atmos_pro_flags+="--upload-status"
        fi

        tfcmt \
        --config ${GITHUB_ACTION_PATH}/config/summary.yaml \
        -owner "${{ github.repository_owner }}" \
        -repo "${{ github.event.repository.name }}" \
        -var "target:${{ steps.vars.outputs.component_slug }}" \
        -var "component:${{ inputs.component }}" \
        -var "componentPath:${{ steps.vars.outputs.component_path }}" \
        -var "commitSHA:${{ inputs.sha }}" \
        -var "stack:${{ inputs.stack }}" \
        -var "job:${{ github.job }}" \
        -var "logoImage:${{ inputs.branding-logo-image }}" \
        -var "logoUrl:${{ inputs.branding-logo-url }}" \
        -var "infracost_enabled:${{ fromJson(steps.atmos-settings.outputs.settings).enable-infracost }}" \
        -var "driftModeEnabled:${{ inputs.drift-detection-mode-enabled }}" \
        $([[ "${{ inputs.pr-comment }}" == "false" ]] && echo "--output ${{ steps.vars.outputs.summary_file }}") \
        --log-level $([[ "${{ inputs.debug }}" == "true" ]] && echo "DEBUG" || echo "INFO") \
        plan \
        $([[ "${{ inputs.pr-comment }}" == "true" ]] && echo "-patch") \
        -- \
          atmos terraform plan ${{ inputs.component }} \
          --stack ${{ inputs.stack }} \
          ${base_cmd} \
          ${atmos_pro_flags} \
          -out="${{ steps.vars.outputs.plan_file }}" \
          -lock=false \
          -input=false \
          -no-color \
        &> ${TERRAFORM_OUTPUT_FILE}

        TERRAFORM_RESULT=$?

        if [[ "${{ inputs.pr-comment }}" == "true" ]]; then
          tfcmt \
          --config ${GITHUB_ACTION_PATH}/config/summary.yaml \
          -owner "${{ github.repository_owner }}" \
          -repo "${{ github.event.repository.name }}" \
          -var "target:${{ steps.vars.outputs.component_slug }}" \
          -var "component:${{ inputs.component }}" \
          -var "componentPath:${{ steps.vars.outputs.component_path }}" \
          -var "commitSHA:${{ inputs.sha }}" \
          -var "stack:${{ inputs.stack }}" \
          -var "job:${{ github.job }}" \
          -var "logoImage:${{ inputs.branding-logo-image }}" \
          -var "logoUrl:${{ inputs.branding-logo-url }}" \
          -var "infracost_enabled:${{ fromJson(steps.atmos-settings.outputs.settings).enable-infracost }}" \
          -var "driftModeEnabled:${{ inputs.drift-detection-mode-enabled }}" \
          --output ${{ steps.vars.outputs.summary_file }} \
          --log-level $([[ "${{ inputs.debug }}" == "true" ]] && echo "DEBUG" || echo "INFO") \
          plan \
          -- \
            bash -c "cat ${TERRAFORM_OUTPUT_FILE}"
        fi

        set -e

        if [[ "${{ inputs.drift-detection-mode-enabled }}" == "true" ]]; then
          # Split summary to 2 files - issue and step summary files
          # Remove \0 at the end of the grep output
          grep -Pzo '(.|\n)*(?=_______________ISSUE-MARKDOWN_______________\n)' ${{ steps.vars.outputs.summary_file }} | grep -Pav  "\x00" > ${{ steps.vars.outputs.step_summary_file }}
          grep -Pzo '(?<=_______________ISSUE-MARKDOWN_______________\n)(.|\n)*' ${{ steps.vars.outputs.summary_file }} | grep -Pav  "\x00" > ${{ steps.vars.outputs.issue_file }}
          rm -f ${{ steps.vars.outputs.summary_file }}
        else
          mv ${{ steps.vars.outputs.summary_file }} ${{ steps.vars.outputs.step_summary_file }}
        fi

        cat "${TERRAFORM_OUTPUT_FILE}"

        HAS_CHANGES=false
        HAS_NO_CHANGES=false
        HAS_ERROR=false
        if [[ "${TERRAFORM_RESULT}" == "0" ]]; then
          if grep -q '^No changes. Your infrastructure matches the configuration.' ${TERRAFORM_OUTPUT_FILE} ; then
            echo "No changes found"
            HAS_NO_CHANGES=true
          else
            HAS_CHANGES=true
            echo "Found changes"
          fi
        else
          HAS_ERROR=true
          echo "Error appears"
        fi

        # One of changes, no-changes, error should be true
        echo "changes=${HAS_CHANGES}" >> $GITHUB_OUTPUT
        echo "no-changes=${HAS_NO_CHANGES}" >> $GITHUB_OUTPUT
        echo "error=${HAS_ERROR}" >> $GITHUB_OUTPUT

        echo "result=${TERRAFORM_RESULT}" >> $GITHUB_OUTPUT

        rm -f ${TERRAFORM_OUTPUT_FILE}

        # Convert planfile to JSON if Infracost is enabled
        # Infracost requires a JSON representation of the plan to analyze cost changes
        if [[ "${{ fromJson(steps.atmos-settings.outputs.settings).enable-infracost }}" == "true" && "${TERRAFORM_RESULT}" == "0" ]]; then
          cd "${{ steps.vars.outputs.component_path }}"
          ${{ fromJson(steps.atmos-settings.outputs.settings).command }} show -json "${{ steps.vars.outputs.plan_file }}" > "${{ steps.vars.outputs.plan_file }}.json"
        fi

    - name: Configure State AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      if: ${{ ( fromJson(steps.atmos-settings.outputs.settings).plan-repository-type == 's3' ||
                fromJson(steps.atmos-settings.outputs.settings).plan-repository-type == ''  ||
                fromJson(steps.atmos-settings.outputs.settings).plan-repository-type == 'null' ) &&
        steps.atmos-plan.outputs.error == 'false' &&
        fromJson(steps.atmos-settings.outputs.settings).aws-region != '' &&
        fromJson(steps.atmos-settings.outputs.settings).aws-region != 'null' &&
        fromJson(steps.atmos-settings.outputs.settings).terraform-state-role != '' &&
        fromJson(steps.atmos-settings.outputs.settings).terraform-state-role != 'null' }}
      with:
        aws-region: ${{ fromJson(steps.atmos-settings.outputs.settings).aws-region }}
        role-to-assume: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-role }}
        role-session-name: "atmos-terraform-state-gitops"
        mask-aws-account-id: "no"

    - name: Store New Plan
      if: ${{ steps.atmos-plan.outputs.error == 'false' && inputs.plan-storage == 'true'}}
      uses: cloudposse/github-action-terraform-plan-storage@v1
      with:
        action: storePlan
        commitSHA: ${{ inputs.sha }}
        planPath: ${{ steps.vars.outputs.plan_file }}
        component: ${{ inputs.component }}
        stack: ${{ inputs.stack }}
        planRepositoryType: ${{ fromJson(steps.atmos-settings.outputs.settings).plan-repository-type || 's3' }}
        metadataRepositoryType: ${{ fromJson(steps.atmos-settings.outputs.settings).metadata-repository-type || 'dynamo' }}
        blobAccountName: ${{ fromJson(steps.atmos-settings.outputs.settings).blob-account-name  }}
        blobContainerName: ${{ fromJson(steps.atmos-settings.outputs.settings).blob-container-name }}
        cosmosContainerName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-container-name }}
        cosmosDatabaseName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-database-name }}
        cosmosEndpoint: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-endpoint }}
        tableName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-table }}
        bucketName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-bucket }}

    - name: Store Lockfile for New Plan
      if: ${{ steps.atmos-plan.outputs.error == 'false' && inputs.plan-storage == 'true'}}
      uses: cloudposse/github-action-terraform-plan-storage@v1
      with:
        action: storePlan
        commitSHA: ${{ inputs.sha }}
        planPath: ${{ steps.vars.outputs.lock_file }}
        component: ${{ inputs.component }}
        stack: ${{ inputs.stack }}-lockfile
        planRepositoryType: ${{ fromJson(steps.atmos-settings.outputs.settings).plan-repository-type || 's3' }}
        metadataRepositoryType: ${{ fromJson(steps.atmos-settings.outputs.settings).metadata-repository-type || 'dynamo' }}
        blobAccountName: ${{ fromJson(steps.atmos-settings.outputs.settings).blob-account-name }}
        blobContainerName: ${{ fromJson(steps.atmos-settings.outputs.settings).blob-container-name }}
        cosmosContainerName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-container-name }}
        cosmosDatabaseName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-database-name }}
        cosmosEndpoint: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-endpoint }}
        tableName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-table }}
        bucketName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-bucket }}

    - name: Setup Infracost
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).enable-infracost == true && steps.atmos-plan.outputs.changes == 'true' }}
      uses: infracost/actions/setup@v3
      with:
        api-key: ${{ inputs.infracost-api-key }}

    - name: Set Plan Results
      id: results
      shell: bash
      run: |
        if [[ -f "${{ steps.vars.outputs.plan_file }}" ]]; then
          echo "plan_file=${{ steps.vars.outputs.plan_file }}" >> $GITHUB_OUTPUT
        else
          echo "plan_file=" >> $GITHUB_OUTPUT
        fi

        if [[ -f "${{ steps.vars.outputs.plan_file_json }}" ]]; then
          echo "plan_file_json=${{ steps.vars.outputs.plan_file_json }}" >> $GITHUB_OUTPUT
        else
          echo "plan_file_json=" >> $GITHUB_OUTPUT
        fi

    - name: Generate Infracost Diff
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).enable-infracost == true && steps.atmos-plan.outputs.changes == 'true' }}
      id: infracost
      shell: bash
      run: |
        echo "Running Infracost diff"
        infracost diff \
          --path="${{ steps.vars.outputs.plan_file }}.json" \
          --format=diff \
          --project-name "${{ inputs.stack }}-${{ inputs.component }}" \
          --out-file=/tmp/infracost.txt
        infracost diff \
          --path="${{ steps.vars.outputs.plan_file }}.json" \
          --format=json \
          --project-name "${{ inputs.stack }}-${{ inputs.component }}" \
          --out-file=/tmp/infracost.json

        echo "finished=true" >> $GITHUB_OUTPUT

    - name: Debug Infracost
      if: ${{ steps.infracost.outputs.finished == 'true' && inputs.debug == 'true' }}
      shell: bash
      run: |
        cat ${{ steps.vars.outputs.plan_file }}.json
        cat /tmp/infracost.txt
        cat /tmp/infracost.json

    - name: Set Infracost Variables
      if: ${{ steps.infracost.outputs.finished == 'true' }}
      id: infracost-diff
      shell: bash
      run: |
        INFRACOST_DIFF_TOTAL_MONTHLY_COST=$(cat /tmp/infracost.json | jq --raw-output .diffTotalMonthlyCost)
        INFRACOST_DETAILS_DIFF_BREAKDOWN="$(cat /tmp/infracost.txt)"

        if [[ "${INFRACOST_DIFF_TOTAL_MONTHLY_COST}" == "0" ]]; then
          INFRA_COST_SUMMARY="Infracost Estimate: monthly cost will not change"
        elif [[ "${INFRACOST_DIFF_TOTAL_MONTHLY_COST:0:1}" == "-" ]]; then
          INFRA_COST_SUMMARY="Infracost Estimate: monthly cost will decrease by ${INFRACOST_DIFF_TOTAL_MONTHLY_COST} 📉"
        else
          INFRA_COST_SUMMARY="Infracost Estimate: monthly cost will increase by ${INFRACOST_DIFF_TOTAL_MONTHLY_COST} 📈"
        fi

        sed -i "s/%INFRACOST_SUMMARY%/${INFRA_COST_SUMMARY}/" ${{ steps.vars.outputs.step_summary_file }}
        sed -i -e '/%INFRACOST_DIFF%/{r /tmp/infracost.txt' -e 'd}' ${{ steps.vars.outputs.step_summary_file }}

    - name: Store Component Metadata to Artifacts
      if: ${{ (fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled) && inputs.drift-detection-mode-enabled == 'true' }}
      shell: bash
      run: |
        echo -n '{ "stack": "${{ inputs.stack }}", "component": "${{ inputs.component }}", "componentPath": "${{ steps.vars.outputs.component_path }}", "drifted": '"${{ steps.atmos-plan.outputs.changes }}"', "error": '"${{ steps.atmos-plan.outputs.error }}"' }' > "metadata/${{ steps.vars.outputs.component_slug }}.metadata.json"

    - name: Publish Summary or Generate GitHub Issue Description for Drift Detection
      id: summary
      shell: bash
      working-directory: ${{ steps.vars.outputs.component_path }}
      
      run: |
        if [[ "${{ inputs.drift-detection-mode-enabled }}" == "true" ]]; then
          STEP_SUMMARY_FILE="${{ steps.vars.outputs.issue_file }}"

          if [[ "${{ steps.atmos-plan.outputs.no-changes }}" == "true" ]]; then
            rm -f ${STEP_SUMMARY_FILE}
          fi

        else
          STEP_SUMMARY_FILE="${{ steps.vars.outputs.step_summary_file }}"
        fi


        if [ -f ${STEP_SUMMARY_FILE} ]; then
          echo "${STEP_SUMMARY_FILE} found"

          STEP_SUMMARY=$(cat ${STEP_SUMMARY_FILE} | jq -Rs .)
          echo "result=${STEP_SUMMARY}" >> $GITHUB_OUTPUT

          if [[ "${{ inputs.drift-detection-mode-enabled }}" == "false" ]]; then
            echo "Drift detection mode disabled"
            cat $STEP_SUMMARY_FILE >> $GITHUB_STEP_SUMMARY
          fi
        else
          echo "${STEP_SUMMARY_FILE} not found"
          echo "result=\"\"" >> $GITHUB_OUTPUT
        fi

    - name: Generate a unique id
      id: generate
      shell: bash
      run: |
        echo "rand=$(openssl rand -hex 5)" >> "$GITHUB_OUTPUT"

    - name: Upload Artifacts
      if: ${{ (fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled) && inputs.drift-detection-mode-enabled == 'true' }}
      uses: actions/upload-artifact@v4
      with:
        # The name of the artifact needs to be unique for every job run!
        # This name is filtered in cloudposse/github-action-atmos-terraform-drift-detection by the "metadata-*" prefix
        name: metadata-${{ github.run_id }}-${{ steps.generate.outputs.rand }}
        path: metadata
        retention-days: ${{ inputs.metadata-retention-days }}

    - name: Exit status
      if: ${{ fromJson(steps.atmos-settings.outputs.settings).github-actions-enabled || fromJson(steps.atmos-settings.outputs.settings).atmos-pro-enabled }}
      shell: bash
      run: |
        exit ${{ steps.atmos-plan.outputs.result }}