name: Terraform validation

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - "release/**"
    paths:
      - "**.tf"
  pull_request:
    paths:
      - "**.tf"

jobs:
  tfsec:
    name: terraform
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@5c3ccc22eb2c950a0fa5bc7c47190d8e3f7e681a
        with:
          ref: ${{ github.head_ref }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # tag=v2.0.3

      - name: Terraform format and validate
        shell: bash
        run: |
          dirs=$(find . -type f -name "*.tf" -exec dirname "{}" \; | sort -ud)
          result=0
          for dir in $dirs; do
            echo "Checking $dir"
            terraform -chdir="$dir" init || result=1
            terraform -chdir="$dir" fmt -check=true -diff=true || result=1
            terraform -chdir="$dir" validate -no-color || result=1
          done
          exit $result