constellation/.github/workflows/test-tf.yml

name: Terraform validation

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - "release/**"
    paths:
      - "**.tf"
      - "**.lock.hcl"
      - ".github/workflows/test-tf.yml"
  pull_request:
    paths:
      - "**.tf"
      - "**.lock.hcl"
      - ".github/workflows/test-tf.yml"

jobs:
  tfsec:
    name: terraform
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
        with:
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
          # No token available for forks, so we can't push changes
          token: ${{ !github.event.pull_request.head.repo.fork && secrets.TIDY_RENOVATE_PUSH || '' }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # tag=v2.0.3

      - name: Terraform format and validate
        shell: bash
        run: |
          dirs=$(find . -type f -name "*.tf" -exec dirname "{}" \; | sort -ud)
          result=0
          for dir in $dirs; do
            echo "Checking $dir"
            terraform -chdir="$dir" init || result=1
            terraform -chdir="$dir" fmt -check=true -diff=true || result=1
            terraform -chdir="$dir" validate -no-color || result=1
          done
          exit $result

      - name: Check HCL lock files are up to date
        id: hcl-lock
        shell: bash
        run: |
          dirs=$( find . -type f -name "*.lock.hcl" -exec dirname "{}" \; | sort -ud)
          for dir in $dirs; do
            echo "Checking $dir"
            terraform -chdir="$dir" init
            terraform -chdir="$dir" providers lock -platform=linux_arm64 -platform=linux_amd64 -platform=darwin_arm64 -platform=darwin_amd64 -platform=windows_amd64
          done
          git diff --exit-code

      - name: Push changes on renovate
        if: failure() && (steps.hcl-lock.conclusion == 'failure') && startsWith(github.head_ref, 'renovate/')
        shell: bash
        run: |
          git config --global user.name "edgelessci"
          git config --global user.email "edgelessci@users.noreply.github.com"
          git commit -am "deps: update HCL lock files"
          git push