publish-terraform-plan.yml

name: Publish Terraform Plan

on:
  workflow_call:
    inputs:
      tf-fmt-outcome:
        type: string
        required: true
      tf-init-outcome:
        type: string
        required: true
      tf-plan-outcome:
        type: string
        required: true
      tf-plan-summary:
        type: string
        required: true
      tf-validate-outcome:
        type: string
        required: true
      tf-validate-output:
        type: string
        required: true
      pr-number:
        type: string
        required: false
      write-summary:
        type: boolean
        default: true
      write-comment:
        type: boolean
        default: false

permissions:
  contents: read
  pull-requests: write

jobs:
  publish:
    name: Publish Terraform Plan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
      - name: Write the report markdown file
        run: |
          REPORT_FILE=$(mktemp -t summary.md.XXXXX)
          echo "REPORT_FILE=$REPORT_FILE" >> $GITHUB_ENV
          cat >> $REPORT_FILE << 'ENDOFREPORT'
          ## Terraform Summary

          *Pusher: @${{ env.GH_ACTOR }}, Action: `${{ env.GH_ACTION }}`, Workflow: [`${{ env.GH_WORKFLOW }}`](${{ env.GH_SERVER}}/${{ env.GH_REPO }}/actions/runs/${{ env.GH_RUN_ID }})*

          | Step                         | Result  |
          |:-----------------------------|:-------:|
          | 🖌  Terraform Format & Style | ${{ (env.TF_FMT_OUTCOME == 'success' && '✅') || (env.TF_FMT_OUTCOME == 'skipped' && '➖') || '❌'  }} |
          | ⚙️  Terraform Initialization  | ${{ (env.TF_INIT_OUTCOME == 'success' && '✅') || (env.TF_INIT_OUTCOME == 'skipped' && '➖') || '❌' }} |
          | 🤖  Terraform Validation     | ${{ (env.TF_VALIDATE_OUTCOME == 'success' && '✅') || (env.TF_VALIDATE_OUTCOME == 'skipped' && '➖') || '❌' }} |
          | 📖  Terraform Plan           | ${{ (env.TF_PLAN_OUTCOME == 'success' && '✅') || (env.TF_PLAN_OUTCOME == 'skipped' && '➖') || '❌' }} |

          _**Hint:** If "Terraform Format & Style" failed, run `terraform fmt -recursive` from the `terraform/` directory and commit the results._

          ### Output

          <details>
          <summary>Validation Output</summary>

          ```
          ${{ env.TF_VALIDATE_OUTPUT }}
          ```

          </details>

          <details>
          <summary>Plan Summary</summary>

          ${{ env.TF_PLAN_SUMMARY }}

          </details>
          ENDOFREPORT
        env:
          TF_FMT_OUTCOME: ${{ inputs.tf-fmt-outcome }}
          TF_INIT_OUTCOME: ${{ inputs.tf-init-outcome }}
          TF_VALIDATE_OUTCOME: ${{ inputs.tf-validate-outcome }}
          TF_VALIDATE_OUTPUT: ${{ inputs.tf-validate-output }}
          TF_PLAN_OUTCOME: ${{ inputs.tf-plan-outcome }}
          TF_PLAN_SUMMARY: ${{ inputs.tf-plan-summary }}
          GH_ACTOR: ${{ github.actor }}
          GH_ACTION: ${{ github.event_name }}
          GH_WORKFLOW: ${{ github.workflow }}
          GH_SERVER: ${{ github.server_url }}
          GH_REPO: ${{ github.repository }}
          GH_RUN_ID: ${{ github.run_id }}
      - name: Write the step summary
        if: inputs.write-summary
        run: cat $REPORT_FILE | head -c 65500 >> $GITHUB_STEP_SUMMARY # Observe GitHub's 65535 character limit
      - name: Write the comment body
        id: comment-body
        run: |
          CONTENT=$(cat $REPORT_FILE)
          echo "REPORT_CONTENT<<ENDOFREPORT" >> $GITHUB_OUTPUT
          echo "$CONTENT" >> $GITHUB_OUTPUT
          echo "ENDOFREPORT" >> $GITHUB_OUTPUT
      - name: Warn on missing comment requirements
        if: inputs.write-comment && inputs.pr-number == ''
        run: "echo 'WARNING: Cannot write a comment because pr-number is not set'"
      - name: Find previous report comment
        id: find-comment
        if: inputs.write-comment && inputs.pr-number != ''
        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
        with:
          issue-number: ${{ inputs.pr-number }}
          comment-author: 'github-actions[bot]'
          body-includes: Terraform Summary
      - name: Create or update comment
        if: inputs.write-comment && inputs.pr-number != ''
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: ${{ steps.comment-body.outputs.REPORT_CONTENT }}
          edit-mode: replace