ci: add GitHub Actions terraform pipeline (OIDC) #1

	name: terraform-oidc

	on:
	workflow_dispatch:
	push:
	branches: [ "main" ]
	paths:
	- "infra/workload/01-local-state/**"
	- ".github/workflows/terraform.yml"

	permissions:
	id-token: write
	contents: read

	env:
	TF_IN_AUTOMATION: true
	TF_INPUT: false
	TF_WORKING_DIR: infra/workload/01-local-state

	jobs:
	plan:
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash
	working-directory: ${{ env.TF_WORKING_DIR }}

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: 1.6.6

	- name: Azure Login (OIDC)
	uses: azure/login@v2
	with:
	client-id: ${{ secrets.AZURE_CLIENT_ID }}
	tenant-id: ${{ secrets.AZURE_TENANT_ID }}
	subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

	- name: Terraform Init
	run: terraform init

	- name: Terraform Validate
	run: terraform validate

	- name: Terraform Plan
	run: terraform plan -lock-timeout=0s

	apply:
	needs: plan
	runs-on: ubuntu-latest
	if: github.event_name == 'workflow_dispatch'
	defaults:
	run:
	shell: bash
	working-directory: ${{ env.TF_WORKING_DIR }}

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: 1.6.6

	- name: Azure Login (OIDC)
	uses: azure/login@v2
	with:
	client-id: ${{ secrets.AZURE_CLIENT_ID }}
	tenant-id: ${{ secrets.AZURE_TENANT_ID }}
	subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

	- name: Terraform Init
	run: terraform init

	- name: Terraform Apply
	run: terraform apply -auto-approve -lock-timeout=0s

Navigation Menu