plan.yml

name: Plan

on:
  push:
    paths-ignore:
      - "scripts/**"
    branches: ["main"]
    tags-ignore: ["**"]
  workflow_dispatch:

env:
  TF_LOG: ${{ secrets.TF_LOG}}
  TF_VAR_billing_account_id: ${{ secrets.BILLING_ACCOUNT_ID }}
  TF_VAR_seed_sa_email: ${{ secrets.SEED_SA_EMAIL_ADDRESS }}
  TF_VAR_github_admin_token: ${{ secrets.ADMIN_GITHUB_TOKEN }}
  TF_VAR_project_postfix: ${{ secrets.GCP_PROJECT_POSTFIX }}
  TF_VAR_workload_identity_provider_name: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
  TF_VAR_workload_identity_pool_name: ${{ secrets.WORKLOAD_IDENTITY_POOL_ID }}
  TF_VAR_codacy_api_token: ${{ secrets.CODACY_API_TOKEN }}
  TF_VAR_docker_registry_username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
  TF_VAR_docker_registry_token: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
  TF_IN_AUTOMATION: true
  TF_INPUT: false
  GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
  GH_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
  CLOUDSDK_CORE_PROJECT: ${{ secrets.GCP_PROJECT_ID }}

permissions:
  id-token: write

jobs:
  security-scan:
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
      - name: Security scan
        uses: aquasecurity/trivy-action@0.29.0
        with:
          scan-type: config
          trivy-config: trivy.yaml
          ignore-unfixed: false

  compliance-scan:
    runs-on: ubuntu-20.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@v12.2926.0

  lint:
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
      - uses: terraform-linters/setup-tflint@v4
        name: Setting up TFLint
        with:
          tflint_version: v0.29.0
      - name: Initializing TFLint
        run: tflint --init
      - name: Linting
        run: tflint -f compact --disable-rule=terraform_module_pinned_source

  qa:
    runs-on: ubuntu-20.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Authenticating
        uses: google-github-actions/auth@v2.1.7
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SEED_SA_EMAIL_ADDRESS }}
      - name: Setting up GCP environment
        uses: google-github-actions/setup-gcloud@v2.1.2
      - run: gcloud projects list
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
      - name: Terraform Init
        run: terraform init -backend-config="bucket=${{ secrets.TERRAFORM_STATE_BUCKET }}"
      - name: Terraform Format
        run: terraform fmt -check -recursive
      - name: Terraform Validate
        run: terraform validate -no-color

  plan:
    runs-on: ubuntu-20.04

    needs:
      - qa
      - lint
      - compliance-scan
      - security-scan

    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Authenticating
        uses: google-github-actions/auth@v2.1.7
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SEED_SA_EMAIL_ADDRESS }}
      - name: Setting up GCP environment
        uses: google-github-actions/setup-gcloud@v2.1.2
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
      - name: Init
        run: terraform init -backend-config="bucket=${{ secrets.TERRAFORM_STATE_BUCKET }}"
      - name: Plan
        run: terraform plan -no-color -out=tfplan
      - name: Show Terraform Plan as Summary
        run: |
          {
            echo "### Terraform Plan Output";
            echo "\`\`\`";
            terraform show -no-color tfplan;
            echo "\`\`\`";
          }  > "${GITHUB_STEP_SUMMARY}"