pull-request.yaml

name: Pull request checks

on:
  pull_request:

jobs:
  configs:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4
      - name: Find changed OpenTofu modules
        id: modified
        uses: ./.github/actions/changed-modules
        with:
          working-directory: tofu/configs
      - name: Strip prefix from modified configs
        id: configs
        uses: actions/github-script@v7
        with:
          script: |
            const modules = ${{ steps.modified.outputs.modules }}
            const configs = modules.map(m => m.replace(/^tofu\/configs\//, ''))
            core.setOutput('configs', configs)
      - name: Show modified configs
        run: |
          echo "${{ steps.configs.outputs.configs }}"
    outputs:
      configs: ${{ steps.configs.outputs.configs }}

  plan:
    uses: ./.github/workflows/plan.yaml
    needs: configs
    permissions:
      contents: read
      id-token: write
    strategy:
      matrix:
        config: ${{ fromJson(needs.configs.outputs.configs) }}
    with:
      environment: development
      config: ${{ matrix.config }}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
      TF_VAR_PRIVATE_SUBNET_CIDRS: ${{ secrets.TF_VAR_PRIVATE_SUBNET_CIDRS }}
      TF_VAR_PUBLIC_SUBNET_CIDRS: ${{ secrets.TF_VAR_PUBLIC_SUBNET_CIDRS }}
      TF_VAR_VPC_CIDR: ${{ secrets.TF_VAR_VPC_CIDR }}

  comment:
    runs-on: ubuntu-latest
    needs:
      - configs
      - plan
    permissions:
      contents: read
      pull-requests: write
    strategy:
      matrix:
        config: ${{ fromJson(needs.configs.outputs.configs) }}
    steps:
      - name: Download plan file
        uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.config }}-tfplan
      - uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // Retrieve existing bot comments for the pull request.
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            })
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('## Plan output for ${{ matrix.config }} config')
            })

            // Read the contents of the plan.
            const fs = require('fs');
            const plan = fs.readFileSync('./plan.txt', 'utf8');

            // Prepare the format of the comment.
            const output = `## Plan output for ${{ matrix.config }} config\n\n\`\`\`\n${plan}\n\`\`\``

            // If we have a comment, update it. Otherwise, create a new one.
            if (botComment) {
              github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
              })
            } else {
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              })
            }