chore(deps): update actions/cache digest to caa2961 #5605
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform - GitHub | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: terraform-github-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| AWS_ENV_NAME: portfolio | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| - name: Setup mise | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 | |
| with: | |
| install: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 | |
| with: | |
| run_install: false | |
| - name: Install node dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Install betterleaks | |
| env: | |
| BETTERLEAKS_VERSION: 1.1.2 | |
| run: | | |
| set -euo pipefail | |
| curl -fsSL "https://github.com/betterleaks/betterleaks/releases/download/v${BETTERLEAKS_VERSION}/betterleaks_${BETTERLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/betterleaks.tar.gz | |
| tar -xzf /tmp/betterleaks.tar.gz -C /tmp betterleaks | |
| sudo install -m 0755 /tmp/betterleaks /usr/local/bin/betterleaks | |
| betterleaks version | |
| - name: Run lefthook | |
| run: lefthook run pre-commit --all-files | |
| set-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set Matrix | |
| id: set-matrix | |
| uses: ./.github/actions/set-matrix | |
| terraform: | |
| needs: set-matrix | |
| if: needs.set-matrix.outputs.matrix != '["_empty"]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 5 | |
| matrix: | |
| target: ${{ fromJson(needs.set-matrix.outputs.matrix) }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: AWS Credential | |
| uses: ./.github/actions/aws-credential | |
| with: | |
| oidc-iam-role: arn:aws:iam::072693953877:role/portfolio-terraform-github-deploy | |
| - name: Generate GitHub App Token | |
| id: app_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| app-id: ${{ secrets.GHA_APP_ID }} | |
| private-key: ${{ secrets.GHA_APP_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| - uses: ./.github/actions/terraform-plan | |
| with: | |
| working-directory: ./terraform/src/repositories/${{ matrix.target }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_APPS_TOKEN: ${{ secrets.TERRAFORM_GITHUB_TOKEN }} | |
| GHA_APP_ID: ${{ secrets.GHA_APP_ID }} | |
| # NOTE: GitHub App では個人アカウントのリポジトリを作成することが仕様上不可能なので PAT を使用する。 | |
| - uses: ./.github/actions/terraform-apply | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| with: | |
| working-directory: ./terraform/src/repositories/${{ matrix.target }} | |
| GITHUB_TOKEN: ${{ secrets.TERRAFORM_GITHUB_TOKEN }} | |
| GHA_APP_ID: ${{ secrets.GHA_APP_ID }} | |
| delete-nochange-comments: | |
| needs: [set-matrix, terraform] | |
| if: always() && github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| - name: Delete "No changes" PR comments | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ | |
| --jq '.[] | select(.body | contains("No changes. Your infrastructure matches the configuration.")) | .id' \ | |
| | while read -r comment_id; do | |
| echo "Deleting comment: $comment_id" | |
| gh api -X DELETE "repos/${{ github.repository }}/issues/comments/$comment_id" | |
| done | |
| workflow-result: | |
| needs: [lint, set-matrix, terraform, delete-nochange-comments] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check workflow result | |
| run: | | |
| if [ "${{ needs.lint.result }}" == "failure" ]; then | |
| echo "Lint failed" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.set-matrix.outputs.matrix }}" == '["_empty"]' ]; then | |
| echo "No repositories to process" | |
| exit 0 | |
| fi | |
| if [ "${{ needs.terraform.result }}" == "failure" ]; then | |
| echo "Terraform jobs failed" | |
| exit 1 | |
| fi | |
| echo "All jobs completed successfully" |