terraform-apply.yml

name: "Terraform apply"

concurrency: terraform-ci

on:
  push:
    paths-ignore:
      # YAML anchors doesn't seem to work in GitHub Actions, so we have to copy
      # this field.
      - .gitignore
      - "*.md"
      - CODEOWNERS
    branches:
      - main

jobs:
  terraform-apply:
    name: "Terraform apply"
    runs-on: ubuntu-latest
    env:
      # Google Cloud Storage state backend
      GOOGLE_APPLICATION_CREDENTIALS_DATA: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS_DATA }}
      GOOGLE_APPLICATION_CREDENTIALS: '/tmp/tf-google-application-credentials.json'
      # GitHub provider
      TF_VAR_app_node_id: ${{ secrets.TF_VAR_APP_NODE_ID }}
      TF_VAR_github_app_id: ${{ secrets.GH_APP_ID }}
      TF_VAR_github_app_installation_id: ${{ secrets.GH_APP_INSTALLATION_ID }}
      TF_VAR_github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }}
    steps:
      - name: Write GCS credentials
        run: echo $GOOGLE_APPLICATION_CREDENTIALS_DATA > $GOOGLE_APPLICATION_CREDENTIALS

      - name: Checkout
        uses: actions/checkout@v4

      - name: Terraform init
        id: init
        run: terraform init

      - name: Terraform validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform apply
        run: terraform apply -auto-approve