Merge pull request #73 from hackforla/update-tf-plan-action-72

Updating logic for plan action and adding module validation
hackforla · May 30, 2024 · 4ff6abb · 4ff6abb
2 parents 74b6584 + 61195a0
commit 4ff6abb
Showing 1 changed file with 72 additions and 45 deletions.
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
@@ -1,6 +1,10 @@
 name: PR Terraform Plan
 
-on: [pull_request]
+on: 
+  pull_request:
+    paths:
+      - 'terraform-incubator/**'
+      - 'terraform-modules/**'
 
 permissions:
   contents: read
@@ -11,14 +15,17 @@ jobs:
     name: Get changed terraform directories
     runs-on: ubuntu-latest
     outputs:
-      module-change: ${{ steps.changed-files.outputs.module-change }}
-      project-change: ${{ steps.changed-files.outputs.project-change }}
-      environment-change: ${{ steps.changed-files.outputs.environment-change }}
+      module-directory: ${{ steps.module-directory.outputs.directory }}
+      project-directory: ${{ steps.project-directory.outputs.directory }}
+      environment-directory: ${{ steps.environment-directory.outputs.directory }}
+      has-environment-changes: ${{ steps.check-changes.outputs.has-environment-changes }}
+      has-project-changes: ${{ steps.check-changes.outputs.has-project-changes }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - name: Get changed files
         id: changed-files
         uses: dorny/paths-filter@v2
@@ -31,59 +38,79 @@ jobs:
             environment-change:
               - 'terraform-incubator/*/!(project)/*.tf'
           list-files: json
+
       - name: List all changed files
-        run: echo '${{ steps.changed-files.outputs.module-change_files }}'; echo '${{ steps.changed-files.outputs.project-change_files }}'; echo '${{ steps.changed-files.outputs.environment-change_files }}'
-  plan-all:
+        run: |
+          echo 'module-change: ${{ steps.changed-files.outputs.module-change_files }}'
+          echo 'project-change: ${{ steps.changed-files.outputs.project-change_files }}'
+          echo 'environment-change: ${{ steps.changed-files.outputs.environment-change_files }}'
+
+      - name: Extract module directory
+        id: module-directory
+        if: ${{ steps.changed-files.outputs['module-change'] == 'true' }}
+        run: |
+          directory=$(dirname "${{ fromJson(steps.changed-files.outputs.module-change_files)[0] }}")
+          echo "Extracted Directory: $directory"
+          echo "::set-output name=directory::$directory"
+
+      - name: Extract project directory
+        id: project-directory
+        if: ${{ steps.changed-files.outputs['project-change'] == 'true' }}
+        run: |
+          directory=$(dirname "${{ fromJson(steps.changed-files.outputs.project-change_files)[0] }}")
+          echo "Extracted Directory: $directory"
+          echo "::set-output name=directory::$directory"
+
+      - name: Extract environment directory
+        id: environment-directory
+        if: ${{ steps.changed-files.outputs['environment-change'] == 'true' }}
+        run: |
+          directory=$(dirname "${{ fromJson(steps.changed-files.outputs.environment-change_files)[0] }}")
+          echo "Extracted Directory: $directory"
+          echo "::set-output name=directory::$directory"
+
+      - name: Check for conflicting changes
+        id: check-changes
+        run: |
+          echo "::set-output name=has-environment-changes::${{ steps.changed-files.outputs.environment-change_files != '[]' }}"
+          echo "::set-output name=has-project-changes::${{ steps.changed-files.outputs.project-change_files != '[]' }}"
+
+  plan:
     runs-on: ubuntu-latest
-    name: Terraform plan - all directories
+    name: Terraform Plan
     needs: [changed-files]
-    if: ${{ needs.changed-files.outputs.module-change == 'true' }}
-    strategy:
-      matrix:
-        directory: ${{ needs.changed-files.outputs.environment-change }}
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{secrets.INCUBATOR_AWS_ACCESS_KEY_ID}}
-      AWS_SECRET_ACCESS_KEY: ${{secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY}}    
+      AWS_ACCESS_KEY_ID: ${{ secrets.INCUBATOR_AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: terraform plan
-        uses: dflook/terraform-plan@v1
+      - name: Fail on multiple plans
+        if: ${{ needs.changed-files.outputs.has-environment-changes == 'true' && needs.changed-files.outputs.has-project-changes == 'true' }}
+        run: |
+          echo "Multiple plans detected: Please make changes to environments and projects in separate pull requests."
+          exit 1
+
+      - name: Terraform validate - Modules
+        if: ${{ needs.changed-files.outputs.module-directory != '' && needs.changed-files.outputs.environment-directory == '' && needs.changed-files.outputs.project-directory == '' }}
+        uses: dflook/terraform-validate@v1
         with:
-          path: ${{ matrix.directory }}
-  plan-project:
-    runs-on: ubuntu-latest
-    name: Terraform plan - Project changes
-    needs: [changed-files]
-    if: ${{ needs.changed-files.outputs.project-change == 'true' && needs.changed-files.outputs.module-change == 'false'}}
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{secrets.INCUBATOR_AWS_ACCESS_KEY_ID}}
-      AWS_SECRET_ACCESS_KEY: ${{secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY}}    
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+          path: ${{ needs.changed-files.outputs.module-directory }}
 
-      - name: terraform plan
+      - name: Module validation failed
+        if: ${{ failure() && steps.validate.outputs.failure-reason == 'validate-failed' }}
+        run: echo "Module validation failed"
+
+      - name: Terraform plan - Environment
+        if: ${{ needs.changed-files.outputs.environment-directory != '' && (needs.changed-files.outputs.project-directory == '' || needs.changed-files.outputs.has-environment-changes == 'true') }}
         uses: dflook/terraform-plan@v1
         with:
-          path: terraform-incubator/people-depot/dev
-  plan-environment:
-    runs-on: ubuntu-latest
-    name: Terraform plan - Env changes
-    needs: [changed-files]
-    if: ${{ needs.changed-files.outputs.environment-change == 'true' && needs.changed-files.outputs.module-change == 'false' && needs.changed-files.outputs.project-change == 'false' }}
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{secrets.INCUBATOR_AWS_ACCESS_KEY_ID}}
-      AWS_SECRET_ACCESS_KEY: ${{secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY}}    
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: terraform plan
+          path: ${{ needs.changed-files.outputs.environment-directory }}
+
+      - name: Terraform plan - Project
+        if: ${{ needs.changed-files.outputs.project-directory != '' && needs.changed-files.outputs.has-environment-changes != 'true' }}
         uses: dflook/terraform-plan@v1
         with:
-          path: terraform-incubator/people-depot/dev
+          path: ${{ needs.changed-files.outputs.project-directory }}