ci.yaml

name: CI

on:
  pull_request:
    branches:
    - main
    paths-ignore:
    - .editorconfig
    - .gitignore
    - CHANGELOG.md
    - LICENSE.md
    - README.md
  push:
    branches:
    - main
    paths-ignore:
    - .editorconfig
    - .gitignore
    - CHANGELOG.md
    - LICENSE.md
    - README.md

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: ${{ matrix.terraform_version }}
    - name: Initialise with no backend
      run: terraform init -backend=false
    - name: Check formatting
      run: terraform fmt -check -recursive
    - name: Validate the configuration
      run: terraform validate
    strategy:
      matrix:
        terraform_version: [ "1.0", "1.1", "1.2", "1.3", "1.4", "1.5", "1.6" ]

  caller-identity:
    if: ${{ github.event_name == 'push' }}
    name: Return the IAM user
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-region: ${{ secrets.AWS_REGION }}
        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github
    - run: aws sts get-caller-identity

  release:
    name: Release?
    needs: [ caller-identity ]
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
    - name: Prepare a release
      uses: google-github-actions/release-please-action@v4
      with:
        config-file: .github/release-please-config.json
        manifest-file: .github/release-please-manifest.json
        token: ${{ secrets.GITHUB_TOKEN }}