tf-drift.yml

---
name: '📡 Terraform Configuration Drift Detection'
on:
  workflow_call:
    inputs:
      working_directory:
        required: true
        type: string
        default: examples
        description: 'Root directory of the terraform where all resources exist.'
      provider:
        required: true
        type: string
        default: azurerm
        description: 'Cloud provider to run the workflow. e.g. azurerm or aws or gcp'
      aws_region:
        required: false
        type: string
        default: us-east-1
        description: 'AWS region of terraform deployment.'
      var_file:
        required: false
        default: ""
        type: string
        description: 'Terraform var file directory. e.g. vars/dev.tfvars'
      terraform_version:
        type: string
        default: 1.3.6
        description: 'Required terraform version'
      token_format:
        required: false
        type: string
        default: access_token
        description: 'Output format for the generated authentication token. For OAuth 2.0 access tokens, specify "access_token". For OIDC tokens, specify "id_token". To skip token generation, leave this value empty'
      access_token_lifetime:
        required: false
        type: string
        default: 300s
        description: 'Desired lifetime duration of the access token, in seconds'
      project_id:
        required: false
        type: string
        description: 'ID of the default project to use for future API calls and invocations.'
      create_credentials_file:
        required: false
        type: string
        default: true
        description: 'If true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs.'
    secrets:
      AZURE_CREDENTIALS:
        required: false
        description: 'Azure Credentials to install Azure in github runner.'
      aws_access_key_id:
        required: false
        description: 'AWS Access Key ID to install AWS CLI.'
      aws_secret_access_key:
        required: false
        description: 'AWS Secret access key to install AWS CLI'
      aws_session_token:
        required: false
        description: 'AWS Session Token to install AWS CLI'
      build_role:
        required: false
        description: 'AWS OIDC role for aws authentication'
      GCP_CREDENTIALS:
        description: 'The Google Cloud JSON service account key to use for authentication'
        required: false
      GITHUB:
        required: true
        description: 'PAT of the user to run the jobs.'
      TF_API_TOKEN:
        required: false
        description: 'Terraform cloud token if your backend is terraform cloud.'
      env-vars:
        required: false
        description: 'Pass required environment variables'
      WORKLOAD_IDENTITY_PROVIDER:
        required: false
        description: 'The full identifier of the Workload Identity Provider'
      SERVICE_ACCOUNT:
        required: false
        description: 'The service account to be used'

jobs:
  terraform-plan:
    name: 'Terraform Plan'
    runs-on: ubuntu-latest
    env:
      # This is needed since we are running terraform with read-only permissions
      ARM_SKIP_PROVIDER_REGISTRATION: true
    outputs:
      tfplanExitCode: ${{ steps.tf-plan.outputs.exitcode }}

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: 📦 Checkout Repository
        uses: actions/checkout@v7

      - name: 🔧 Set environment variables
        run: |
          (
          cat <<'_EOT'
          ${{ secrets.env-vars }}
          _EOT
          ) >> "$GITHUB_ENV"

      - name: ☁️ Install AWS CLI
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.aws_access_key_id }}
          aws-secret-access-key: ${{ secrets.aws_secret_access_key }}
          aws-session-token: ${{ secrets.aws_session_token }}
          role-to-assume: ${{ secrets.build_role }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: 900
          role-skip-session-tagging: true

      # Authenticate to GCP
      - name: 🔐 Authenticate to Google Cloud
        if: ${{ inputs.provider == 'gcp' }}
        uses: 'google-github-actions/auth@v3'
        with:
          credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
          create_credentials_file: ${{ inputs.create_credentials_file }}
          token_format: ${{ inputs.token_format }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: ${{ inputs.access_token_lifetime }}
          project_id: ${{ inputs.project_id }}

      # Install azure-cli
      - name: 🔧 Install Azure CLI
        if: ${{ inputs.provider == 'azurerm' }}
        uses: azure/login@v3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: ⚙️ Set up Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: ${{ inputs.terraform_version }}

      # Run some scripts
      - name: 🖥️ Run shell commands
        run: ls -la

      - name: 🚀 terraform init
        run: |
          cd ${{ inputs.working_directory }}
          terraform init

      # Generates an execution plan for Terraform
      # An exit code of 0 indicated no changes, 1 a terraform failure, 2 there are pending changes.
      - name: 📐 Terraform Plan
        id: tf-plan
        run: |
          cd ${{ inputs.working_directory }}
          if [ -n "${{ inputs.var_file }}" ]; then
            terraform plan -detailed-exitcode -no-color -out tfplan --var-file=${{ inputs.var_file }} || export exitcode=$?
          else
            terraform plan -detailed-exitcode -no-color -out tfplan || export exitcode=$?
          fi

      # Save plan to artifacts
      - name: 💾 Publish Terraform Plan
        uses: actions/upload-artifact@v7
        with:
          name: tfplan
          path: tfplan

      # Create string output of Terraform Plan
      - name: 🧵 Create String Output
        id: tf-plan-string
        run: |
          cd ${{ inputs.working_directory }}
          TERRAFORM_PLAN=$(terraform show -no-color tfplan)
          delimiter="$(openssl rand -hex 8)"
          echo "summary<<${delimiter}" >> $GITHUB_OUTPUT
          echo "## Terraform Plan Output" >> $GITHUB_OUTPUT
          echo "### Working Directory: \`${{ inputs.working_directory }}\`" >> $GITHUB_OUTPUT
          echo "<details><summary>Click to expand</summary>" >> $GITHUB_OUTPUT
          echo "" >> $GITHUB_OUTPUT
          echo '```terraform' >> $GITHUB_OUTPUT
          echo "$TERRAFORM_PLAN" >> $GITHUB_OUTPUT
          echo '```' >> $GITHUB_OUTPUT
          echo "</details>" >> $GITHUB_OUTPUT
          echo "${delimiter}" >> $GITHUB_OUTPUT

      # Publish Terraform Plan as task summary
      - name: 📝 Publish Terraform Plan to Task Summary
        env:
          SUMMARY: ${{ steps.tf-plan-string.outputs.summary }}
        run: |
          echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY

      # If changes are detected, create a new issue
      - name: 🚨 Publish Drift Report and create new issue
        if: steps.tf-plan.outputs.exitcode == 2
        uses: actions/github-script@v9
        env:
          SUMMARY: "${{ steps.tf-plan-string.outputs.summary }}"
        with:
          github-token: ${{ secrets.GITHUB }}
          script: |
            const body = `${process.env.SUMMARY}`;
            const title = 'Terraform Configuration Drift Detected';
            const creator = 'github-actions[bot]'

            // Look to see if there is an existing drift issue
            const issues = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              creator: creator,
              title: title
            })

            if( issues.data.length > 0 ) {
              // We assume there shouldn't be more than 1 open issue, since we update any issue we find
              const issue = issues.data[0]

              if ( issue.body == body ) {
                console.log('Drift Detected: Found matching issue with duplicate content')
              } else {
                console.log('Drift Detected: Found matching issue, updating body')
                github.rest.issues.update({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: issue.number,
                  body: body
                })
              }
            } else {
              console.log('Drift Detected: Creating new issue')

              github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: title,
                body: body
              })
            }

      # If changes aren't detected, close any open drift issues
      - name: ✅ Publish Drift Report
        if: steps.tf-plan.outputs.exitcode == 0
        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.GITHUB }}
          script: |
            const title = 'Terraform Configuration Drift Detected';
            const creator = 'github-actions[bot]'

            // Look to see if there is an existing drift issue
            const issues = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              creator: creator,
              title: title
            })

            if( issues.data.length > 0 ) {
              const issue = issues.data[0]

              github.rest.issues.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issue.number,
                state: 'closed'
              })
            }

      # Mark the workflow as failed if drift detected
      - name: ❌ Error on Failure
        if: steps.tf-plan.outputs.exitcode == 2
        run: exit 1
...