tf-workflow.yml

---
name: 🌎 Terraform workflow
on:
  workflow_call:
    inputs:
      working_directory:
        required: true
        type: string
        description: 'Root directory of the terraform where all resources exist.'
      provider:
        required: true
        type: string
        description: 'Cloud provider to run the workflow. e.g. azurerm, aws, gcp or digitalocean'
      aws_region:
        required: false
        type: string
        default: us-east-2
        description: 'AWS region of terraform deployment.'
      role_duration_seconds:
        description: "The duration in seconds for the AWS IAM role session."
        required: false
        type: number
        default: 3600
      role_skip_session_tagging:
        description: "Whether to skip adding session tags when assuming the AWS IAM role."
        required: false
        type: boolean
        default: true
      gcp_region:
        required: false
        type: string
        description: 'GCP region of terraform deployment.'
      var_file:
        required: false
        type: string
        description: 'Terraform var file directory. e.g. vars/dev.tfvars'
      destroy:
        required: false
        type: boolean
        default: false
        description: 'Set true to destroy terraform infrastructure.'
      approvers:
        required: false
        type: string
        description: 'Approvals list to approve apply or destroy'
      terraform_version:
        type: string
        default: 1.3.6
        description: 'Required Terraform version'
      timeout:
        required: false
        type: number
        default: 10
        description: 'Timeout for approval step'
      minimum-approvals:
        required: false
        type: string
        default: 1
        description: 'Minimum approvals required to accept the plan'
      token_format:
        required: false
        type: string
        default: access_token
        description: 'Output format for the generated authentication token. For OAuth 2.0 access tokens, specify "access_token". For OIDC tokens, specify "id_token". To skip token generation, leave this value empty'
      access_token_lifetime:
        required: false
        type: string
        default: 300s
        description: 'Desired lifetime duration of the access token, in seconds'
      project_id:
        required: false
        type: string
        description: 'ID of the default project to use for future API calls and invocations.'
      create_credentials_file:
        required: false
        type: string
        default: true
        description: 'If true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs.'
      git_ssh_key_setup:
        required: false
        type: string
        default: false
        description: 'If true, sets up SSH keys for Git access to clone private repositories.'
      target_environment:
        description: "Name of the deployment environment (e.g., dev, staging, prod). Leave empty if no environment-specific context is needed."
        required: false
        type: string
        default: ""
      plan_only:
        description: "Set this to `true` to run `terraform plan` only"
        required: false
        type: boolean
        default: false
      target:
        required: false
        type: string
        description: 'Target specific Terraform resource (e.g., module.vpc_ec2). If not set, fallback to target_file or target.txt.'
      target_file:
        required: false
        type: string
        description: 'Path to file with target resource (e.g., vars/target.txt)'
    secrets:
      AZURE_CREDENTIALS:
        required: false
        description: 'Azure Credentials to install Azure in github runner.'
      AWS_ACCESS_KEY_ID:
        required: false
        description: 'AWS Access Key ID to install AWS CLI.'
      BUILD_ROLE:
        required: false
        description: 'AWS OIDC role for aws authentication.'
      AWS_SECRET_ACCESS_KEY:
        required: false
        description: 'AWS Secret access key to install AWS CLI'
      AWS_SESSION_TOKEN:
        required: false
        description: 'AWS Session Token to install AWS CLI'
      GCP_CREDENTIALS:
        required: false
        description: 'The Google Cloud JSON service account key to use for authentication'
      DIGITALOCEAN_ACCESS_TOKEN:
        required: false
        description: 'The DigitalOcean Personal Access Token for Application & API'
      env-vars:
        required: false
        description: 'Pass required environment variables'
      WORKLOAD_IDENTITY_PROVIDER:
        required: false
        description: 'The full identifier of the Workload Identity Provider'
      SERVICE_ACCOUNT:
        required: false
        description: 'The service account to be used'
      SSH_PRIVATE_KEY:
        required: false
        description: 'Private SSH key to register in the SSH agent'
      NAORU_API_KEY:
        required: false
        description: 'API key for naoru AI failure diagnosis (OpenRouter provider by default).'

jobs:
  terraform-workflow:
    runs-on: ubuntu-latest
    environment: ${{ inputs.target_environment }}

    outputs:
      tfplanExitCode: ${{ steps.tf-plan.outputs.exitcode }}

    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
        if: ${{ inputs.git_ssh_key_setup == true }}
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: 🌱 Set environment variables
        run: |
          (
          cat <<'_EOT'
          ${{ secrets.env-vars }}
          _EOT
          ) >> "$GITHUB_ENV"

      - name: 🟦 Install AWS CLI
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ secrets.BUILD_ROLE }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: ${{ inputs.role_duration_seconds }}
          role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}

      - name: ☁️ Install Azure CLI
        if: ${{ inputs.provider == 'azurerm' }}
        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: ☁️ Authenticate to Google Cloud
        if: ${{ inputs.provider == 'gcp' }}
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
          create_credentials_file: ${{ inputs.create_credentials_file }}
          token_format: ${{ inputs.token_format }}
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: ${{ inputs.access_token_lifetime }}
          project_id: ${{ inputs.project_id }}

      - name: 🟦 Install doctl
        if: ${{ inputs.provider == 'digitalocean' }}
        uses: digitalocean/action-doctl@3cb3953159719656269e044e0e24ca16dd2a690f # v2.5.2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      - name: 🛠️ Set up Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: ${{ inputs.terraform_version }}

      - name: 🧹 Terraform Format
        if: ${{ inputs.destroy != true }}
        id: fmt
        uses: dflook/terraform-fmt-check@5702d43749973bd5b54e2380f090c1ad8054ecd4 # v3.0.0
        with:
          actions_subcommand: 'fmt'
          path: ${{ inputs.working_directory }}

      - name: 🏗️ terraform init
        run: |
           cd ${{ inputs.working_directory }}
           terraform init

      - name: 🔎 Terraform validate
        if: ${{ inputs.destroy != true }}
        id: validate
        uses: dflook/terraform-validate@36ef08d500fe2cd9b742b10176d2683707c7074e # v3.0.0
        with:
          path: ${{ inputs.working_directory }}

      # Standard Terraform Plan (when not using targeting)
      - name: 📋 Terraform Plan
        if: ${{ inputs.target == '' && inputs.target_file == '' }}
        id: tf-plan
        uses: dflook/terraform-plan@3f1559b085c5ceff68c3724c9b66c015a6c940cd # v3.0.0
        with:
          path: ${{ inputs.working_directory }}
          var_file: ${{ inputs.var_file }}
        env:
          GITHUB_TOKEN: ${{ github.TOKEN }}

      # Targeted Terraform Plan (when using targeting)
      - name: 📋 Terraform Plan (Targeted)
        if: ${{ inputs.target != '' || inputs.target_file != '' }}
        id: tf-plan-targeted
        run: |
          export exitcode=0
          cd ${{ inputs.working_directory }}

          TARGET=""
          TARGET_FILE_PATH="${{ github.workspace }}/${{ inputs.target_file }}"

          if [ -n "${{ inputs.target }}" ]; then
            TARGET="${{ inputs.target }}"
          elif [ -n "${{ inputs.target_file }}" ] && [ -f "$TARGET_FILE_PATH" ]; then
            TARGET=$(cat "$TARGET_FILE_PATH" | tr -d '\n' | xargs)
          elif [ -f "target.txt" ]; then
            TARGET=$(cat target.txt | tr -d '\n' | xargs)
          fi

          echo "Final Target Value: '$TARGET'"

          PLAN_CMD="terraform plan -out=tfplan"
          if [ "${{ inputs.destroy }}" = true ]; then
            PLAN_CMD="terraform plan -destroy -out=tfplan"
          fi

          if [ -n "${{ inputs.var_file }}" ]; then
            PLAN_CMD="$PLAN_CMD --var-file=${{ inputs.var_file }}"
          fi

          if [ -n "$TARGET" ]; then
            PLAN_CMD="$PLAN_CMD --target=$TARGET"
          fi

          echo "Running: $PLAN_CMD"
          eval "$PLAN_CMD" || export exitcode=$?
          echo "exitcode=$exitcode" >> $GITHUB_OUTPUT

      # Upload plan artifact when using targeting
      - name: 📤 Publish Terraform Plan Artifact
        if: ${{ inputs.target != '' || inputs.target_file != '' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: tfplan
          path: ${{ inputs.working_directory }}/tfplan

      # Create plan string output when using targeting
      - name: 📝 Create Plan String Output
        if: ${{ (inputs.target != '' || inputs.target_file != '') && inputs.plan_only != true }}
        id: tf-plan-string
        run: |
          cd ${{ inputs.working_directory }}
          TERRAFORM_PLAN=$(terraform show -no-color tfplan)
          delimiter="$(openssl rand -hex 8)"
          echo "summary<<${delimiter}" >> $GITHUB_OUTPUT
          echo "## Terraform Plan Output" >> $GITHUB_OUTPUT
          echo "<details><summary>Click to expand</summary>" >> $GITHUB_OUTPUT
          echo "" >> $GITHUB_OUTPUT
          echo '```terraform' >> $GITHUB_OUTPUT
          echo "$TERRAFORM_PLAN" >> $GITHUB_OUTPUT
          echo '```' >> $GITHUB_OUTPUT
          echo "</details>" >> $GITHUB_OUTPUT
          echo "${delimiter}" >> $GITHUB_OUTPUT

      # Fetch PR comment when not using targeting
      - name: Fetch latest Plan PR comment
        if: ${{ inputs.target == '' && inputs.target_file == '' && github.event_name == 'pull_request' }}
        id: pr_plan_comment
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          COMMENT=$(curl -s \
            -H "Authorization: Bearer $GH_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/$REPO/issues/$PR_NUMBER/comments \
            | jq -r '
              map(select(.user.login=="github-actions[bot]"))
              | last
            ')
          BODY=$(echo "$COMMENT" | jq -r '.body')
          URL=$(echo "$COMMENT" | jq -r '.html_url')
          SUMMARY=$(echo "$BODY" \
          | grep -Eo 'Plan: [0-9]+ to add, [0-9]+ to change, [0-9]+ to destroy\.' \
          | uniq \
          | head -n 1)
          {
            echo "PLAN_SUMMARY<<EOF"
            echo "$SUMMARY"
            echo "EOF"
            echo "PLAN_COMMENT_URL=$URL"
          } >> $GITHUB_ENV

      - name: ✅ Accept plan or deny
        if: ${{ inputs.plan_only != true }}
        uses: trstringer/manual-approval@fa642940caf8412403569b28b2db4a1df08a83a3 # v1.13.1
        timeout-minutes: ${{ inputs.timeout }}
        with:
          secret: ${{ github.TOKEN }}
          approvers: ${{ inputs.approvers }}
          minimum-approvals: ${{ inputs.minimum-approvals }}
          issue-title: "Terraform Plan in ${{inputs.working_directory}}${{ inputs.target != '' || inputs.target_file != '' && ' (Targeted)' || '' }}"
          issue-body: |
            ${{ inputs.target != '' || inputs.target_file != '' && format('## Targeted Resource\nTarget: {0}\n\n', inputs.target || 'From file') || '' }}
            ## Terraform Plan Summary
            ```
            ${{ inputs.target != '' || inputs.target_file != '' && steps.tf-plan-string.outputs.summary || env.PLAN_SUMMARY }}
            ```
            ${{ inputs.target == '' && inputs.target_file == '' && format('🔎 **Full Terraform plan :**\n👉 {0}\n', env.PLAN_COMMENT_URL) || '' }}
            Please approve to continue with `terraform apply`.

      # Standard terraform apply (when not using targeting)
      - name: 🚀 terraform apply
        if: ${{ inputs.destroy != true && inputs.plan_only != true && inputs.target == '' && inputs.target_file == '' }}
        run: |
          if [ -n "${{ inputs.var_file }}" ]; then
           cd ${{ inputs.working_directory }}
           terraform apply -var-file="${{ inputs.var_file }}" -auto-approve
          else
           cd ${{ inputs.working_directory }}
           terraform apply -auto-approve
          fi

      # Targeted terraform apply (when using targeting)
      - name: 🚀 terraform apply (Targeted)
        if: ${{ inputs.destroy != true && inputs.plan_only != true && (inputs.target != '' || inputs.target_file != '') }}
        run: |
          cd ${{ inputs.working_directory }}
          terraform apply -auto-approve tfplan

      - name: 🕵️ Find Errored Terraform State
        if: ${{ always() }}
        id: find_errored_tfstate
        run: |
          cd ${{ inputs.working_directory }}
          if [ -f "errored.tfstate" ]; then
            ls -la errored.tfstate
            echo "errored_found=true" >> $GITHUB_OUTPUT
            echo "Uploading errored.tfstate as artifact..."
          else
            echo "errored_found=false" >> $GITHUB_OUTPUT
            echo "Errored Terraform state file not found."
          fi

      - name: 📤 Upload Errored Terraform State Artifact
        if: ${{ always() && steps.find_errored_tfstate.outputs.errored_found == 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: errored_tfstate
          path: ${{ inputs.working_directory }}/errored.tfstate

      # Standard terraform destroy (when not using targeting)
      - name: 💣 Terraform destroy
        if: ${{ inputs.destroy == true && inputs.target == '' && inputs.target_file == '' }}
        id: destroy
        run: |
          if [ -n "${{ inputs.var_file }}" ]; then
           cd ${{ inputs.working_directory }}
           terraform destroy -var-file="${{ inputs.var_file }}" -auto-approve
          else
           cd ${{ inputs.working_directory }}
           terraform destroy -auto-approve
          fi

      # Targeted terraform destroy (when using targeting)
      - name: 💣 Terraform destroy (Targeted)
        if: ${{ inputs.destroy == true && (inputs.target != '' || inputs.target_file != '') }}
        id: destroy-targeted
        run: |
          cd ${{ inputs.working_directory }}

          TARGET=""
          TARGET_FILE_PATH="${{ github.workspace }}/${{ inputs.target_file }}"

          if [ -n "${{ inputs.target }}" ]; then
            TARGET="${{ inputs.target }}"
          elif [ -n "${{ inputs.target_file }}" ] && [ -f "$TARGET_FILE_PATH" ]; then
            TARGET=$(cat "$TARGET_FILE_PATH" | tr -d '\n' | xargs)
          elif [ -f "target.txt" ]; then
            TARGET=$(cat target.txt | tr -d '\n' | xargs)
          fi

          echo "Final Target Value: '$TARGET'"

          if [ -n "$TARGET" ]; then
            terraform destroy --target="$TARGET" -auto-approve
          elif [ -n "${{ inputs.var_file }}" ]; then
            terraform destroy -var-file="${{ inputs.var_file }}" -auto-approve
          else
            terraform destroy -auto-approve
          fi

  naoru:
    name: 🩺 Diagnose failure (naoru)
    needs: [terraform-workflow]
    if: ${{ failure() }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      pull-requests: write
    steps:
      - name: 🩺 Diagnose with naoru
        env:
          NAORU_KEY: ${{ secrets.NAORU_API_KEY }}
        if: ${{ env.NAORU_KEY != '' }}
        uses: clouddrove/naoru@1fbf9f8977d855a35865c771679bb51f7474e397 # v0.2.3
        with:
          api-key: ${{ secrets.NAORU_API_KEY }}
          provider: openrouter
          model: openai/gpt-4o