feat: Add CI for tfcmt (plan & apply) (#5)

- Add tfcmt pipeline
- Update github actions secrets name

.github/workflows/opentofu-ci.yml

@@ -11,6 +11,7 @@ jobs:
     name: TFLint
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         module: ["github"]
 

.github/workflows/opentofu-format.yml

@@ -32,6 +32,7 @@ jobs:
     name: Lock
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         module: ["github"]
 
@@ -68,7 +69,7 @@ jobs:
         id: create-github-app-token
         with:
           app-id: ${{ secrets.ACTIONS_PYTHON_CI_APP_ID }}
-          private-key: ${{ secrets.ACTIONS_PYTHON_CI_PRIVATE_KEY }}
+          private-key: ${{ secrets.ACTIONS_PYTHON_CI_APP_PEM_FILE }}
 
       - uses: actions/checkout@v4
         with:

.github/workflows/opentofu-tfcmt.yml

@@ -0,0 +1,74 @@
+name: Tfcmt
+
+on:
+  push:
+    branches: [main]
+    paths: ["**.tf", "**.tfvars", "**/.terraform.lock.hcl"]
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths: ["**.tf", "**.tfvars", "**/.terraform.lock.hcl"]
+
+jobs:
+  opentofu-tfcmt:
+    name: ${{ github.event_name == 'push' && 'Apply' || 'Plan' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: ["github"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/create-github-app-token@v1
+        id: create-github-app-token
+        with:
+          app-id: ${{ secrets.ACTIONS_PYTHON_CI_APP_ID }}
+          private-key: ${{ secrets.ACTIONS_PYTHON_CI_APP_PEM_FILE }}
+
+      - uses: kislerdm/setup-opentofu@main
+        with:
+          cli_config_credentials_token: ${{ secrets.APP_TERRAFORM_IO_TOKEN }}
+          tofu_version: 1.6.0-alpha1
+
+      - uses: shmokmt/actions-setup-tfcmt@v2
+        with:
+          version: v4.7.1
+
+      - name: Init
+        run: tofu init
+        working-directory: ${{ matrix.module }}
+
+      - name: Plan
+        if: ${{ github.event_name == 'pull_request' }}
+        run: |
+          tfcmt \
+            -owner ${{ github.event.repository.owner.login }} \
+            -repo ${{ github.event.repository.name }} \
+            -pr ${{ github.event.pull_request.number }} \
+            -var "target:${{ matrix.module }}" \
+            plan -patch -- tofu plan -lock=false -no-color \
+              -var "app_terraform_io_token=${{ secrets.APP_TERRAFORM_IO_TOKEN }}" \
+              -var "github_provider_app_id=${{ secrets.ACTIONS_PYTHON_CI_APP_ID }}" \
+              -var "github_provider_app_installation_id=${{ secrets.ACTIONS_PYTHON_CI_APP_INSTALLATION_ID }}" \
+              -var "github_provider_app_pem_file=${{ secrets.ACTIONS_PYTHON_CI_APP_PEM_FILE }}"
+        env:
+          GITHUB_TOKEN: ${{ steps.create-github-app-token.outputs.token }}
+        working-directory: ${{ matrix.module }}
+
+      - name: Apply
+        if: ${{ github.event_name == 'push' }}
+        run: |
+          tfcmt \
+            -owner ${{ github.event.repository.owner.login }} \
+            -repo ${{ github.event.repository.name }} \
+            -sha ${{ github.sha }} \
+            -var "target:${{ matrix.module }}" \
+            apply -- tofu apply -auto-approve \
+              -var "app_terraform_io_token=${{ secrets.APP_TERRAFORM_IO_TOKEN }}" \
+              -var "github_provider_app_id=${{ secrets.ACTIONS_PYTHON_CI_APP_ID }}" \
+              -var "github_provider_app_installation_id=${{ secrets.ACTIONS_PYTHON_CI_APP_INSTALLATION_ID }}" \
+              -var "github_provider_app_pem_file=${{ secrets.ACTIONS_PYTHON_CI_APP_PEM_FILE }}"
+        env:
+          GITHUB_TOKEN: ${{ steps.create-github-app-token.outputs.token }}
+        working-directory: ${{ matrix.module }}

.tfcmt.yaml

@@ -0,0 +1,3 @@
+terraform:
+  plan:
+    disable_label: true

github/nested_repos.tf

@@ -41,9 +41,10 @@ module "github_repository_infra" {
   ]
 
   secrets = [
-    { name = "APP_TERRAFORM_IO_TOKEN", value = var.app_terraform_io_token },
     { name = "ACTIONS_PYTHON_CI_APP_ID", value = var.github_provider_app_id },
-    { name = "ACTIONS_PYTHON_CI_PRIVATE_KEY", value = var.github_provider_app_pem_file },
+    { name = "ACTIONS_PYTHON_CI_APP_INSTALLATION_ID", value = var.github_provider_app_installation_id },
+    { name = "ACTIONS_PYTHON_CI_APP_PEM_FILE", value = var.github_provider_app_pem_file },
+    { name = "APP_TERRAFORM_IO_TOKEN", value = var.app_terraform_io_token },
   ]
 }