automatic.yml

name: Terraform Pull Request
on:
  pull_request:
    types: [opened, synchronize, reopened, closed]

jobs:
  fmt:
    runs-on: ubuntu-latest
    if: github.event.action != 'closed'
    steps:
      - uses: actions/checkout@v6

      - uses: hashicorp/setup-terraform@v4

      - name: Terraform fmt
        id: fmt
        run: terraform fmt -check -diff

  policy-checks:
    runs-on: ubuntu-latest
    if: github.event.action != 'closed' && github.event.pull_request.base.ref == 'main'
    needs: execute
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v6

      - name: Terraform Init (for policies)
        uses: ./.github/actions/terraform_init/
        with:
          terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
          terraform_workspace: terraform-example
          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}

      - name: Download terraform plan
        uses: actions/download-artifact@v8
        with:
          name: tfplan

      - name: Convert plan to JSON
        run: |
          terraform show -json tfplan > tfplan.json

      - uses: overmindtech/policy-signals-action@v1
        with:
          policies-path: './policies'
          terraform-plan-json: './tfplan.json'
          overmind-api-key: ${{ secrets.OVM_API_KEY }}
          ticket-link: ${{ needs.execute.outputs.run-url }}

  execute:
    runs-on: ubuntu-latest
    if: github.event.pull_request.base.ref == 'main'
    outputs:
      run-url: ${{ steps.submit-plan.outputs.run-url }}
    permissions:
      contents: read # required for checkout
      id-token: write # mint AWS credentials through OIDC
      pull-requests: write # create/update a comment
      actions: read # access artifacts
    concurrency:
      group: tfstate

    steps:
      - uses: actions/checkout@v6

      - name: Terraform Init
        uses: ./.github/actions/terraform_init/
        with:
          terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
          terraform_workspace: terraform-example
          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}

      - name: Terraform Validate
        if: github.event.action != 'closed'
        id: validate
        run: terraform validate -no-color

      - name: Terraform Plan
        if: github.event.action != 'closed'
        id: plan
        run: |
          set -o pipefail -ex
          terraform plan -compact-warnings -no-color -input=false -lock=false -out tfplan 2>&1 \
            | tee terraform_log
          terraform show -json tfplan > tfplan.json

      - name: upload tfplan
        if: github.event.action != 'closed'
        uses: actions/upload-artifact@v7
        with:
          name: tfplan
          path: tfplan

      - uses: overmindtech/actions/install-cli@main
        with:
          version: latest
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - uses: overmindtech/actions/submit-plan@main
        if: github.event.action != 'closed'
        id: submit-plan
        with:
          ovm-api-key: ${{ secrets.OVM_API_KEY }}
          plan-json: ./tfplan.json
          tags: 'model=risks_v6'

      - name: Install prerequisites
        if: github.event.pull_request.merged == true
        shell: bash
        run: |
          sudo apt install -y netcat-traditional

      - uses: overmindtech/actions/start-change@main
        if: github.event.pull_request.merged == true
        with:
          ovm-api-key: ${{ secrets.OVM_API_KEY }}

      - name: "Deploy marker: Record start_time"
        if: github.event.pull_request.merged == true
        run: echo "DEPLOY_START_TIME=$(date +%s)" >> $GITHUB_ENV

      - name: download tfplan
        if: github.event.pull_request.merged == true
        uses: dawidd6/action-download-artifact@v19
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          name: tfplan
          pr: ${{ github.event.pull_request.number }}

      - name: Terraform Apply
        if: github.event.pull_request.merged == true
        id: apply
        run: terraform apply -auto-approve -no-color -input=false -lock-timeout=5m tfplan

      - uses: overmindtech/actions/end-change@main
        if: (success() || failure() || cancelled()) && github.event.pull_request.merged == true
        with:
          ovm-api-key: ${{ secrets.OVM_API_KEY }}

  cost-analysis:
    runs-on: ubuntu-latest
    if: github.event.action != 'closed' && github.event.pull_request.base.ref == 'main'
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v6

      - name: Terraform Init
        uses: ./.github/actions/terraform_init/
        with:
          terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
          terraform_workspace: terraform-example
          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}

      - name: Terraform Plan for Cost Analysis
        id: plan-cost
        run: |
          set -o pipefail -ex
          terraform plan -compact-warnings -no-color -input=false -lock=false -out tfplan-cost 2>&1
          terraform show -json tfplan-cost > tfplan-cost.json

      - uses: overmindtech/cost-signals-action@v1
        with:
          overmind-api-key: ${{ secrets.OVM_API_KEY }}
          infracost-api-key: ${{ secrets.INFRACOST_API_KEY }}
          terraform-plan-json: ./tfplan-cost.json

  auto-approval:
    runs-on: ubuntu-latest
    if: github.event.action != 'closed' && github.event.pull_request.base.ref == 'main'
    needs: execute
    permissions:
      pull-requests: write
    steps:
      - uses: overmindtech/approval-action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          block-on-high-risks: true
          max-medium-risks: 3