validate-and-plan-pr.yaml

name: Validate & Plan Pull-Request

on:
  pull_request_target:
    paths:
    - '.github/**'
    - 'terraform/**'
    - 'ansible/**'

env:
  TF_VERSION: "1.6.3"

jobs:

  validate:
    runs-on: ubuntu-22.04
    steps:
      - uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TERRAFORM_TOKEN }}
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - uses: actions/checkout@v4

      # - run: |
      #     pre-commit -a

      - run: |
          echo "${{ secrets.KUBENODE_SSH_PRIVATE_KEY }}" > kubenode_ssh.key
          chmod 0400 kubenode_ssh.key
          echo "${{ secrets.KUBENODE_SSH_PUBLIC_KEY }}" > kubenode_ssh.key.pub
          chmod 0400 kubenode_ssh.key.pub

      - run: |
          terraform init
        working-directory: ./terraform
        continue-on-error: true

      - run: |
          terraform validate -no-color
        working-directory: ./terraform
        continue-on-error: true
        env:
          TF_VAR_CLOUDFLARE_APITOKEN: ${{ secrets.TF_VAR_CLOUDFLARE_APITOKEN }}
          TF_VAR_HCLOUD_TOKEN: ${{ secrets.TF_VAR_HCLOUD_TOKEN }}

      - run: |
          ansible-galaxy install -r requirements.yaml
        working-directory: ./ansible
        continue-on-error: true

      - run: |
          ansible-playbook kubenodes.yaml \
          --inventory ../inventory.ini \
          --verbose \
          --private-key ../kubenode_ssh.key \
          --check
        working-directory: ./ansible
        continue-on-error: true
        env:
          TAILSCALE_AUTH_TOKEN: ${{ secrets.TAILSCALE_AUTH_TOKEN }}
          TRANSCRYPT_PASSWORD: ${{ secrets.TRANSCRYPT_PASSWORD }}
          GH_TOKEN_FOR_FLUX: ${{ secrets.GH_TOKEN_FOR_FLUX }}
          AGE_KEY: ${{ secrets.AGE_KEY }}
          CLUSTER_NAME: pegasus

  plan:
    needs: validate
    runs-on: ubuntu-22.04
    concurrency: terraform-state
    steps:
      - uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TERRAFORM_TOKEN }}
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - uses: actions/checkout@v4

      - run: |
          echo "${{ secrets.KUBENODE_SSH_PRIVATE_KEY }}" > kubenode_ssh.key
          chmod 0400 kubenode_ssh.key
          echo "${{ secrets.KUBENODE_SSH_PUBLIC_KEY }}" > kubenode_ssh.key.pub
          chmod 0400 kubenode_ssh.key.pub

      - run: |
          terraform init
        working-directory: ./terraform

      - id: tf-plan
        run: |
          terraform refresh # Separating the refresh from the plan results in cleaner output
          terraform plan -input=false -refresh=false -no-color -out=tfplan
          echo '```' > tf.diff # Format body as code
          terraform show -no-color tfplan | tee -a tf.diff
          echo '```' >> tf.diff # Format body as code
        working-directory: ./terraform
        continue-on-error: true
        env:
          TF_VAR_CLOUDFLARE_APITOKEN: ${{ secrets.TF_VAR_CLOUDFLARE_APITOKEN }}
          TF_VAR_HCLOUD_TOKEN: ${{ secrets.TF_VAR_HCLOUD_TOKEN }}

      - run: |
          # Upsert comment
          gh pr comment "${{ github.event.number }}" --body-file terraform/tf.diff --edit-last || gh pr comment "${{ github.event.number }}" --body-file terraform/tf.diff
        env:
          GH_TOKEN: ${{ github.token }}
        if: ${{ steps.tf-plan.outcome == 'success' }}