tf-checks.yml

---
name: 🌎 Terraform Checks

on:
  workflow_call:
    inputs:
      working_directory:
        required: false
        type: string
        default: './examples/complete/'
        description: 'Directory where terraform code exists. Default: ./examples/complete/'
      provider:
        required: false
        type: string
        default: ""
        description: 'Cloud provider to run the workflow. e.g. azurerm, aws, gcp, digitalocean, or none (skip cloud auth for validate-only)'
      aws_region:
        required: false
        type: string
        default: us-east-1
        description: 'AWS region of terraform deployment.'
      var_file:
        required: false
        default: ""
        type: string
        description: 'Terraform var file directory. e.g. vars/dev.tfvars'
      terraform_version:
        required: false
        type: string
        description: 'Terraform version to use. Leave empty to use latest or min/max versions.'
      role_duration_seconds:
        required: false
        type: number
        default: 3600
        description: 'The assumed role duration in seconds, if assuming a role. Defaults to 1 hour (3600 seconds). Acceptable values range from 15 minutes (900 seconds) to 12 hours (43200 seconds).'
      enable_plan:
        required: false
        type: boolean
        default: false
        description: 'Allow workflow to run terraform plan.'
      show_plan:
        required: false
        type: boolean
        default: false
        description: 'Controls Terraform plan output. When true, displays full plan details. When false, shows only a concise summary (e.g., Plan: X to add, Y to change, Z to destroy).'
      token_format:
        required: false
        type: string
        default: access_token
        description: 'Output format for the generated authentication token. For OAuth 2.0 access tokens, specify "access_token". For OIDC tokens, specify "id_token". To skip token generation, leave this value empty'
      access_token_lifetime:
        required: false
        type: string
        default: 300s
        description: 'Desired lifetime duration of the access token, in seconds'
      project_id:
        required: false
        type: string
        description: 'ID of the default project to use for future API calls and invocations.'
      create_credentials_file:
        required: false
        type: string
        default: true
        description: 'If true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs.'

    secrets:
      AZURE_CREDENTIALS:
        required: false
        description: 'Azure Credentials to install Azure in github runner.'
      AWS_ACCESS_KEY_ID:
        required: false
        description: 'AWS Access Key ID to install AWS CLI.'
      AWS_SECRET_ACCESS_KEY:
        required: false
        description: 'AWS Secret access key to install AWS CLI'
      AWS_SESSION_TOKEN:
        required: false
        description: 'AWS Session Token to install AWS CLI'
      BUILD_ROLE:
        required: false
        description: 'AWS OIDC role for aws authentication.'
      DIGITALOCEAN_ACCESS_TOKEN:
        required: false
        description: 'Digitalocean access Token to install Digitalocean CLI'
      GITHUB:
        required: false
        description: 'PAT of the user to run the jobs.'
      TF_API_TOKEN:
        required: false
        description: 'Terraform cloud token if your backend is terraform cloud.'
      GCP_CREDENTIALS:
        required: false
        description: 'The Google Cloud JSON service account key to use for authentication'
      WORKLOAD_IDENTITY_PROVIDER:
        required: false
        description: 'The full identifier of the Workload Identity Provider'
      SERVICE_ACCOUNT:
        required: false
        description: 'The service account to be used'

jobs:

  terraform-checks:
    name: 🌎 Terraform Full Checks
    runs-on: ubuntu-latest
    env:
      TF_PLUGIN_CACHE_DIR: /tmp/terraform-plugin-cache

    strategy:
      fail-fast: false
      matrix:
        version: ["min", "max"]

    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: 📁 Create Terraform plugin cache dir
        run: mkdir -p "$TF_PLUGIN_CACHE_DIR"

      - name: 🧮 Get Terraform min/max versions
        id: minmax
        uses: clowdhaus/terraform-min-max@main

      - name: 🎯 Set Terraform version
        id: set-version
        run: |
          if [ "${{ matrix.version }}" = "min" ]; then
            echo "tf_version=${{ steps.minmax.outputs.minVersion }}" >> $GITHUB_OUTPUT
          else
            if [ -n "${{ inputs.terraform_version }}" ]; then
              echo "tf_version=${{ inputs.terraform_version }}" >> $GITHUB_OUTPUT
            else
              echo "tf_version=${{ steps.minmax.outputs.maxVersion }}" >> $GITHUB_OUTPUT
            fi
          fi

      - name: ♻️ Cache Terraform plugins
        uses: actions/cache@v6
        with:
          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
          key: terraform-${{ runner.os }}-${{ hashFiles('**/.terraform.lock.hcl') }}
          restore-keys: |
            terraform-${{ runner.os }}-

      - name: ☁️ Install AWS CLI
        if: ${{ inputs.provider == 'aws' && inputs.enable_plan }}
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ secrets.BUILD_ROLE }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: ${{ inputs.role_duration_seconds }}
          role-skip-session-tagging: true

      - name: ☁️ Install Azure CLI
        if: ${{ inputs.provider == 'azurerm' && inputs.enable_plan }}
        uses: azure/login@v3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: ☁️ Install DigitalOcean CLI
        if: ${{ inputs.provider == 'digitalocean' }}
        uses: digitalocean/action-doctl@v2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      - name: ☁️ Authenticate to Google Cloud
        if: ${{ inputs.provider == 'gcp' && inputs.enable_plan }}
        uses: google-github-actions/auth@v3
        with:
          credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
          create_credentials_file: ${{ inputs.create_credentials_file }}
          token_format: ${{ inputs.token_format }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: ${{ inputs.access_token_lifetime }}
          project_id: ${{ inputs.project_id }}

      - name: 🛠️ Setup Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_wrapper: false
          terraform_version: ${{ steps.set-version.outputs.tf_version }}

      - name: 🧹 Terraform Format
        run: terraform fmt --recursive -check=true

      - name: 🏗️ Terraform Init & Terraform Validate
        working-directory: ${{ inputs.working_directory }}
        run: |
          terraform init -input=false -no-color
          terraform validate -no-color

      - name: 📋 Terraform Plan
        id: tf-plan
        if: ${{ inputs.enable_plan }}
        working-directory: ${{ inputs.working_directory }}
        run: |
          export exitcode=0
          terraform version | head -n 1

          if [ -n "${{ inputs.var_file }}" ]; then
            terraform plan -detailed-exitcode -no-color -out=tfplan --var-file=${{ inputs.var_file }} > plan.txt 2>&1 || exitcode=$?
          else
            terraform plan -detailed-exitcode -no-color -out=tfplan > plan.txt 2>&1 || exitcode=$?
          fi

          if [ $exitcode -eq 1 ]; then
            echo "Terraform Plan Failed!"
            cat plan.txt
            exit 1
          fi

          echo "exitcode=$exitcode" >> $GITHUB_OUTPUT

          if [ "${{ inputs.show_plan }}" == "true" ]; then
            cat plan.txt
          else
            grep -E '^Plan:|^No changes' plan.txt || echo "No changes."
          fi
...