tf-plan.yaml

name: Terraform Plan

on:
  workflow_call:
    inputs:
      commit_sha:
        type: string
        description: 'The commit SHA to promote'
        required: true
      gcss_ref:
        type: string
        description: "GCSS ref to checkout"
        required: false
        default: "main"
      tfc_org:
        type: string
        description: 'The Terraform Cloud organization'
        required: true
    secrets:
      app_private_key:
        required: true
      gh_token:
        required: true
      tfc_token:
        required: true

jobs:
  terraform-plan:
    runs-on: ubuntu-latest
    environment: plan
    permissions:
      pull-requests: write
      contents: read
    steps:
      - name: Generate a token
        uses: actions/create-github-app-token@v2
        id: generate-token
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.app_private_key }}
          owner: ${{ github.repository_owner }}

      - name: Create in-progress check-run
        uses: actions/github-script@v7
        env:
          COMMIT_SHA: ${{ inputs.commit_sha }}
        with:
          github-token: ${{ steps.generate-token.outputs.token }}
          script: |
            const detailsUrl = `${context.serverUrl}/${context.payload.repository.full_name}/actions/runs/${context.runId}`;

            await github.rest.checks.create({
                owner: context.payload.repository.owner.login,
                repo: context.payload.repository.name,
                name: "Terraform plan",
                head_sha: process.env.COMMIT_SHA,
                status: "in_progress",
                details_url: detailsUrl,
                output: {
                  title: "Terraform Plan running",
                  summary: `Follow workflow logs for details: ${detailsUrl}`
                }
              });

      - name: Checkout GCSS
        uses: actions/checkout@v6
        with:
          repository: G-Research/github-terraformer
          ref: ${{ inputs.gcss_ref }}
          persist-credentials: false

      - name: GCSS config setup
        uses: ./.github/actions/gcss-config-setup
        with:
          checkout-sha: ${{ inputs.commit_sha }}
          checkout-token: ${{ secrets.gh_token }}

      - name: Setup terraform and run plan
        uses: ./.github/actions/graformer
        id: graformer
        with:
          tfc-token: ${{ secrets.tfc_token }}
          tfc-organization: ${{ inputs.tfc_org }}
          tfc-workspace: ${{ vars.WORKSPACE }}

      - name: Post plan summary and handle check-run
        if: always()
        uses: actions/github-script@v8
        env:
          PLAN_SUMMARY: ${{ steps.graformer.outputs.plan-summary }}
          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
          PLAN_EXITCODE: ${{ steps.graformer.outputs.plan-exitcode }}
          COMMIT_SHA: ${{ inputs.commit_sha }}
        with:
          github-token: ${{ steps.generate-token.outputs.token }}
          script: |
            function isPlanSuccessful() {
              let error = false;
              let planSummary = null;
              
              if(process.env.PLAN_EXITCODE === "1"){
                error = true;
              } else {
                try {
                  planSummary = JSON.parse(process.env.PLAN_SUMMARY);
                } catch(e){
                  error = true;
                  console.log("Error parsing plan summary:", e);
                }  
              }
            
              return { error, planSummary };
            }
            
            function formatResources(arr) {
              return arr?.length ? arr.join("\n") : "";
            }
            
            const detailsUrl = `${context.serverUrl}/${context.payload.repository.full_name}/actions/runs/${context.runId}`;
            let conclusion, title, summary, text, body;
            
            const { error, planSummary } = isPlanSuccessful();
            if (error) {
              conclusion = "failure";
              title = "Terraform Plan Failed";
              summary = `The Terraform plan did not complete successfully. Please check workflow logs for details: ${detailsUrl}`;
              text = "Error running terraform plan";
              body = `Error running terraform plan. Please check workflow logs for details: ${detailsUrl}`;
            } else {
              const recreateCount = planSummary.recreate?.length || 0;
              const updateCount = planSummary.update?.length || 0;
              const importCount = planSummary.import?.length || 0;
              const createCount = (planSummary.create?.length || 0) + recreateCount;
              const deleteCount = (planSummary.delete?.length || 0) + recreateCount;
            
              // build body dynamically. indentation inside if statements is important because if text is indented as it should be (4 spaces), it will be rendered as code block in markdown
              body = `
              ### Terraform Plan Result
              
              Terraform plan: ${importCount} to import, ${createCount} to add, ${updateCount} to change, ${deleteCount} to destroy.
              `;
                
              if (deleteCount > 0) {
              body += `
            
              Resources to delete:
              \`\`\`
              ${formatResources(planSummary?.delete)}
              \`\`\`
              `;
              }
                
              if (createCount > 0) {
              body += `
            
              Resources to create:
              \`\`\`
              ${formatResources(planSummary?.create)}
              \`\`\`
              `;
              }
                
              if (updateCount > 0) {
              body += `
            
              Resources to update:
              \`\`\`
              ${formatResources(planSummary?.update)}
              \`\`\`
              `;
              }
                
              if (importCount > 0) {
              body += `
            
              Resources to import:
              \`\`\`
              ${formatResources(planSummary?.import)}
              \`\`\`
              `;
              }
                
              if (recreateCount > 0) {
              body += `
            
              Resources to recreate:
              \`\`\`
              ${formatResources(planSummary?.recreate)}
              \`\`\`
              `;
              }
              
              body = body.trim();
            
              conclusion = "success";
            
              switch (process.env.PLAN_EXITCODE) {
                case "0":      
                  title = "Terraform Plan Succeeded (no changes)";
                  summary = `Terraform executed successfully with **no changes** required. Please check workflow logs for details: ${detailsUrl}`;
                  text = "No infrastructure changes detected";
                  break;
                case "2":
                  title = "Terraform Plan Succeeded (with changes)";
                  summary = `Terraform executed successfully and **changes are required**. Please check workflow logs for details: ${detailsUrl}`;
                  text = body;
                  if (text.length > 65535) {
                    text = "Log output is too big. Please check the workflow logs for details.";
                  }
                  break;
              }
            }
            
            const prNumber = process.env.PR_NUMBER;
            if (prNumber) {
              await github.rest.issues.createComment({
                owner: context.payload.repository.owner.login,
                repo: context.payload.repository.name,
                issue_number: prNumber,
                body,
              });
            }
            
            await github.rest.checks.create({
              owner: context.payload.repository.owner.login,
              repo: context.payload.repository.name,
              name: "Terraform plan",
              head_sha: process.env.COMMIT_SHA,
              status: "completed",
              conclusion: conclusion,
              details_url: detailsUrl,
              output: {
                title: title,
                summary: summary,
                text: text
              }
            });