tf-smurf.yml

---
name: 🦸‍♂️ Smurf Terraform Workflow
run-name: "🌍 Terraform Workflow with Smurf"

on:
  workflow_call:
    inputs:
      terraform_directory:
        required: true
        type: string
        description: Root directory of Terraform configuration.

      provider:
        required: true
        type: string
        description: Cloud provider where Terraform resources will be deployed (aws, azurerm, gcp, digitalocean).

      aws_region:
        required: false
        type: string
        default: us-east-2
        description: AWS region where resources will be provisioned.

      gcp_region:
        required: false
        type: string
        description: GCP region where resources will be provisioned.

      var_file:
        required: false
        type: string
        description: Terraform variable file (.tfvars) to use during execution.

      destroy:
        required: false
        type: boolean
        default: false
        description: Whether to destroy Terraform-managed infrastructure instead of creating/updating resources.

      approvers:
        required: false
        type: string
        description: List of users or teams authorized to approve Terraform execution.

      terraform_version:
        required: false
        type: string
        default: "1.3.6"
        description: Terraform CLI version to use for running Terraform commands.

      smurf_version:
        required: false
        type: string
        default: latest
        description: Version of Smurf tool to use for Terraform workflow execution.

      timeout:
        required: false
        type: number
        default: 10
        description: Maximum timeout duration for the Terraform workflow execution.

      minimum-approvals:
        required: false
        type: string
        default: "1"
        description: Minimum number of approvals required before Terraform execution proceeds.

      token_format:
        required: false
        type: string
        default: access_token
        description: Format of authentication token generated for cloud provider access.

      access_token_lifetime:
        required: false
        type: string
        default: 300s
        description: Lifetime duration of the generated access token.

      project_id:
        required: false
        type: string
        description: Cloud project identifier used for resource deployment.

      create_credentials_file:
        required: false
        type: string
        default: true
        description: Whether to create a credentials file for cloud authentication.

      git_ssh_key_setup:
        required: false
        type: string
        default: false
        description: Whether to configure SSH keys for accessing Git repositories.

      target_environment:
        required: false
        type: string
        default: ""
        description: Target deployment environment name (for example dev, staging, production).

      plan_only:
        required: false
        type: boolean
        default: false
        description: Run only Terraform plan without applying changes.


    secrets:

        AZURE_CREDENTIALS:
          required: false
          description: Azure service principal credentials used for authentication.

        AWS_ACCESS_KEY_ID:
          required: false
          description: AWS access key ID used for authentication.

        BUILD_ROLE:
          required: false
          description: IAM role or cloud build role used for deployment permissions.

        AWS_SECRET_ACCESS_KEY:
          required: false
          description: AWS secret access key used for authentication.

        AWS_SESSION_TOKEN:
          required: false
          description: Temporary AWS session token for authenticated requests.

        GCP_CREDENTIALS:
          required: false
          description: GCP service account credentials used for authentication.

        DIGITALOCEAN_ACCESS_TOKEN:
          required: false
          description: DigitalOcean API token used for resource provisioning.

        env-vars:
          required: false
          description: Environment variables required during Terraform execution.

        WORKLOAD_IDENTITY_PROVIDER:
          required: false
          description: Workload Identity Provider used for cloud authentication without static credentials.

        SERVICE_ACCOUNT:
          required: false
          description: Cloud service account identifier used for authentication.

        SSH_PRIVATE_KEY:
          required: false
          description: Private SSH key used for secure Git repository access.

jobs:

  terraform-plan:
    name: "⚙️ Terraform Init + Validate + Plan"
    runs-on: ubuntu-latest
    environment: ${{ inputs.target_environment }}

    steps:

      - name: 📦 Checkout Repository
        uses: actions/checkout@v6

      - uses: webfactory/ssh-agent@v0.10.0
        if: ${{ inputs.git_ssh_key_setup == true }}
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: 🌱 Set environment variables
        run: |
          (
          cat <<'_EOT'
          ${{ secrets.env-vars }}
          _EOT
          ) >> "$GITHUB_ENV"

      ##########################
      # Authentication
      ##########################

      - name: 🟦 Configure AWS
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ secrets.BUILD_ROLE }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: 900
          role-skip-session-tagging: true

      - name: ☁️ Azure Login
        if: ${{ inputs.provider == 'azurerm' }}
        uses: azure/login@v3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: ☁️ Authenticate to Google Cloud
        if: ${{ inputs.provider == 'gcp' }}
        uses: google-github-actions/auth@v3
        with:
          credentials_json: ${{ secrets.GCP_CREDENTIALS }}
          create_credentials_file: ${{ inputs.create_credentials_file }}
          token_format: ${{ inputs.token_format }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: ${{ inputs.access_token_lifetime }}
          project_id: ${{ inputs.project_id }}

      - name: 🌊 Configure DigitalOcean
        if: ${{ inputs.provider == 'digitalocean' }}
        uses: digitalocean/action-doctl@v2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      ##########################
      # Terraform
      ##########################

      - name: 🛠 Setup Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: ${{ inputs.terraform_version }}

      - name: ⚙️ Setup Smurf
        uses: clouddrove/smurf@master
        with:
          version: latest

      - name: 🧹 Terraform Format
        run: |
          smurf stf format

      - name: 🏗 Terraform Init
        run: |
          smurf stf init --dir=${{ inputs.terraform_directory }}

      - name: ✅ Terraform Validate
        run: |
          smurf stf validate --dir=${{ inputs.terraform_directory }}

      - name: 📋 Terraform Plan
        if: ${{ !inputs.destroy }}
        shell: bash
        run: |
          if [ -f "${{ inputs.terraform_directory }}/${{ inputs.var_file }}" ]; then
            echo "Using var file: ${{ inputs.var_file }}"
            smurf stf plan \
              --dir="${{ inputs.terraform_directory }}" \
              --var-file="${{ inputs.var_file }}"
          else
            echo "No tfvars file found"
            smurf stf plan \
              --dir="${{ inputs.terraform_directory }}"
          fi

  terraform-apply:
    name: "${{ inputs.destroy && '🔥 Terraform Destroy' || '🚀 Terraform Apply' }}"
    needs: terraform-plan
    if: ${{ !inputs.plan_only }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.target_environment }}

    steps:

      - name: 📦 Checkout Repository
        uses: actions/checkout@v6

      - uses: webfactory/ssh-agent@v0.10.0
        if: ${{ inputs.git_ssh_key_setup == true }}
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: 🌱 Set environment variables
        run: |
          (
          cat <<'_EOT'
          ${{ secrets.env-vars }}
          _EOT
          ) >> "$GITHUB_ENV"

      ##################################################
      # Authentication
      ##################################################

      - name: 🟦 Configure AWS
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ secrets.BUILD_ROLE }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: 900
          role-skip-session-tagging: true

      - name: ☁️ Azure Login
        if: ${{ inputs.provider == 'azurerm' }}
        uses: azure/login@v3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: ☁️ Authenticate to Google Cloud
        if: ${{ inputs.provider == 'gcp' }}
        uses: google-github-actions/auth@v3
        with:
          credentials_json: ${{ secrets.GCP_CREDENTIALS }}
          create_credentials_file: ${{ inputs.create_credentials_file }}
          token_format: ${{ inputs.token_format }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: ${{ inputs.access_token_lifetime }}
          project_id: ${{ inputs.project_id }}

      - name: 🌊 Configure DigitalOcean
        if: ${{ inputs.provider == 'digitalocean' }}
        uses: digitalocean/action-doctl@v2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      ##################################################
      # Terraform Setup
      ##################################################

      - name: 🛠 Setup Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: ${{ inputs.terraform_version }}

      - name: ⚙️ Setup Smurf
        uses: clouddrove/smurf@master
        with:
          version: latest

      - name: 🏗 Terraform Init
        run: |
          smurf stf init --dir=${{ inputs.terraform_directory }}

      ##################################################
      # Manual Approval
      ##################################################

      - name: ⏳ Approval
        uses: trstringer/manual-approval@v1
        with:
          secret: ${{ secrets.GITHUB_TOKEN }}
          approvers: ${{ inputs.approvers }}
          minimum-approvals: ${{ inputs['minimum-approvals'] }}
          issue-title: "${{ inputs.destroy && 'Approve Terraform Destroy' || 'Approve Terraform Apply' }}"

      ##################################################
      # Destroy
      ##################################################

      - name: 💣 Terraform Destroy
        if: ${{ inputs.destroy }}
        shell: bash
        run: |
          if [ -f "${{ inputs.terraform_directory }}/${{ inputs.var_file }}" ]; then
            echo "Using var file: ${{ inputs.var_file }}"
            smurf stf destroy \
              --auto-approve \
              --dir="${{ inputs.terraform_directory }}" \
              --var-file="${{ inputs.var_file }}"
          else
            echo "No tfvars file found"
            smurf stf destroy \
              --auto-approve \
              --dir="${{ inputs.terraform_directory }}"
          fi

      ##################################################
      # Apply
      ##################################################

      - name: 🚀 Terraform Apply
        if: ${{ !inputs.destroy }}
        shell: bash
        run: |
          if [ -f "${{ inputs.terraform_directory }}/${{ inputs.var_file }}" ]; then
            echo "Using var file: ${{ inputs.var_file }}"
            smurf stf apply \
              --auto-approve \
              --dir="${{ inputs.terraform_directory }}" \
              --var-file="${{ inputs.var_file }}"
          else
            echo "No tfvars file found"
            smurf stf apply \
              --auto-approve \
              --dir="${{ inputs.terraform_directory }}"
          fi