terraform-plan.yml

name: Terraform Plan

on:
  pull_request:
    paths:
      - 'infra/terraform/**'
      - '.github/workflows/terraform-plan.yml'

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  plan:
    name: plan-${{ matrix.env }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        env: [dev]
    defaults:
      run:
        working-directory: infra/terraform/envs/${{ matrix.env }}
    env:
      TF_VERSION: '1.9.8'
      AWS_REGION: ${{ vars.AWS_REGION }}
      TF_STATE_BUCKET: ${{ vars.TF_STATE_BUCKET }}
      TF_LOCK_TABLE: ${{ vars.TF_LOCK_TABLE }}
    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform fmt
        run: terraform fmt -check -recursive ../..

      - name: Terraform init
        run: |
          terraform init \
            -backend-config="bucket=${TF_STATE_BUCKET}" \
            -backend-config="key=envs/${{ matrix.env }}/terraform.tfstate" \
            -backend-config="region=${AWS_REGION}" \
            -backend-config="dynamodb_table=${TF_LOCK_TABLE}" \
            -backend-config="encrypt=true"

      - name: Terraform validate
        run: terraform validate

      - name: Terraform plan
        id: plan
        run: |
          terraform plan -var "region=${AWS_REGION}" -no-color -out=tfplan
          terraform show -no-color tfplan > plan.txt

      - name: Comment plan on PR
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const plan = fs.readFileSync('infra/terraform/envs/${{ matrix.env }}/plan.txt', 'utf8');
            const truncated = plan.length > 60000 ? plan.slice(0, 60000) + '\n... (truncated)' : plan;
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `### Terraform plan — \`${{ matrix.env }}\`\n<details><summary>Show plan</summary>\n\n\`\`\`hcl\n${truncated}\n\`\`\`\n\n</details>`
            });