action.yml

name: Run Terraform

description: Runs various Terraform commands using the Terraform CLI.

inputs:
  github-token:
    description: The GitHub token to use
    default: ${{ github.token }}
    required: false
  tf-cli:
    description: The actual Terraform cli to use
    default: terraform
    required: false
  directory:
    description: The directory containing the Terraform configuration
    required: false
    default: .
  workspace:
    description: The Terraform workspace to use
    required: false
  workspace-select:
    description: |
      Whether to run terraform workspace select. Requires workspace input and the TF_WORKSPACE env var to not be set.
    required: false
    default: 'true'
  workspace-create-if-missing:
    description: Whether to create the workspace if it does not exist. Requires workspace-select input to be true.
    required: false
    default: 'true'
  init:
    description: Whether to run terraform init
    required: false
    default: 'true'
  init-args:
    description: Additional arguments to pass to terraform init
    required: false
  tfbackend-content:
    description: The content of the backend file to use.
    required: false
  fmt:
    description: Whether to run terraform fmt
    required: false
    default: 'true'
  validate:
    description: Whether to run terraform validate
    required: false
    default: 'true'
  action:
    description: The main terraform action to run ("plan", "apply", "test", or "output")
    required: false
  action-args:
    description: Additional arguments to pass to terraform plan, apply, test, or output
    required: false
  destroy:
    description: Whether to destroy the infrastructure
    required: false
    default: 'false'
  output:
    description: Whether to run terraform output separate from the main action (for logging purposes)
    required: false
    default: 'false'
  output-args:
    description: Additional arguments to pass to terraform output (for the output input)
    required: false
  metadata:
    description: >
      Whether to run terraform output in JSON format and produce a flattened "metadata" output that can be used as json
      tfvars.
    required: false
    default: 'false'
  tfvars-content:
    description: The content of the variable file to use.
    required: false
  tfvars-json-content:
    description: The content of the variable file to use in JSON format.
    required: false
  plan-file-name:
    description: The name to the plan file to use. If not provided, a plan file will not be used.
    required: false
  encrypted-plan-password:
    description: The password to use to encrypt the plan artifact. If not provided, the plan will not be encrypted.
    required: false
  plan-retention-days:
    description: >
      Duration after which the plan artifact will expire in days.
      0 means using the default value defined in the repository settings.
      Actual values can range from 1 to 90 (public repositories) or 400 (private repositories).
    required: false
    default: '0'
  comment:
    description: Whether to comment on the PR with the results
    required: false
    default: 'true'
  comment-header:
    description: The header to use in the PR comment
    required: false
  comment-identifier:
    description: The identifier to use in the PR comment
    required: false

outputs:
  fmt-outcome:
    description: The outcome of the terraform fmt command
    value: ${{ steps.fmt.outputs.outcome }}
  fmt-stdout:
    description: The stdout of the terraform fmt command
    value: ${{ steps.fmt.outputs.stdout }}
  fmt-stderr:
    description: The stderr of the terraform fmt command
    value: ${{ steps.fmt.outputs.stderr }}
  init-outcome:
    description: The outcome of the terraform init command
    value: ${{ steps.init.outputs.outcome }}
  init-stdout:
    description: The stdout of the terraform init command
    value: ${{ steps.init.outputs.stdout }}
  init-stderr:
    description: The stderr of the terraform init command
    value: ${{ steps.init.outputs.stderr }}
  workspace-outcome:
    description: The outcome of the terraform workspace select command
    value: ${{ steps.workspace.outputs.outcome }}
  workspace-stdout:
    description: The stdout of the terraform workspace select command
    value: ${{ steps.workspace.outputs.stdout }}
  workspace-stderr:
    description: The stderr of the terraform workspace select command
    value: ${{ steps.workspace.outputs.stderr }}
  validate-outcome:
    description: The outcome of the terraform validate command
    value: ${{ steps.validate.outputs.outcome }}
  validate-stdout:
    description: The stdout of the terraform validate command
    value: ${{ steps.validate.outputs.stdout }}
  validate-stderr:
    description: The stderr of the terraform validate command
    value: ${{ steps.validate.outputs.stderr }}
  test-outcome:
    description: The outcome of the terraform test command
    value: ${{ steps.test.outputs.outcome }}
  test-stdout:
    description: The stdout of the terraform test command
    value: ${{ steps.test.outputs.stdout }}
  test-stderr:
    description: The stderr of the terraform test command
    value: ${{ steps.test.outputs.stderr }}
  plan-outcome:
    description: The outcome of the terraform plan command
    value: ${{ steps.plan.outputs.outcome }}
  plan-stdout:
    description: The stdout of the terraform plan command
    value: ${{ steps.plan.outputs.stdout }}
  plan-stderr:
    description: The stderr of the terraform plan command
    value: ${{ steps.plan.outputs.stderr }}
  apply-outcome:
    description: The outcome of the terraform apply command
    value: ${{ steps.apply.outputs.outcome }}
  apply-stdout:
    description: The stdout of the terraform apply command
    value: ${{ steps.apply.outputs.stdout }}
  apply-stderr:
    description: The stderr of the terraform apply command
    value: ${{ steps.apply.outputs.stderr }}
  output-outcome:
    description: The outcome of the terraform output command
    value: ${{ steps.output.outputs.outcome }}
  output-stdout:
    description: The stdout of the terraform output command
    value: ${{ steps.output.outputs.stdout }}
  output-stderr:
    description: The stderr of the terraform output command
    value: ${{ steps.output.outputs.stderr }}
  metadata:
    description: >
      The metadata (output vars in JSON format) from the terraform state
    value: ${{ steps.metadata.outputs.metadata }}

runs:
  using: composite
  steps:
    - name: Create tfbackend file
      if: inputs.tfbackend-content != ''
      shell: bash
      run: echo '${{ inputs.tfbackend-content }}' > ${{ github.action_path }}/action.tfbackend

    - name: Create tfvars variable files
      env:
        tfvarsContent: ${{ inputs.tfvars-content }}
        tfvarsJsonContent: ${{ inputs.tfvars-json-content }}
      shell: bash
      run: |
        if [ -n "$tfvarsContent" ]; then
          echo "$tfvarsContent" > ${{ inputs.directory }}/action-variables.auto.tfvars
        fi
        if [ -n "$tfvarsJsonContent" ]; then
          echo "$tfvarsJsonContent" > ${{ inputs.directory }}/action-variables.auto.tfvars.json
        fi

    - name: ${{ inputs.tf-cli }} fmt
      id: fmt
      if: fromJSON(inputs.fmt)
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} fmt -check -diff \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }}

    - name: ${{ inputs.tf-cli }} init
      id: init
      if: fromJSON(inputs.init)
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} init -input=false \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }} \
          ${{ inputs.tfbackend-content != '' && format('-backend-config={0}/action.tfbackend', github.action_path) || '' }} \
          ${{ inputs.init-args }}

    - name: ${{ inputs.tf-cli }} workspace select
      id: workspace
      if: fromJSON(inputs.workspace-select) && inputs.workspace && !env.TF_WORKSPACE
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} workspace select \
          ${{ fromJSON(inputs.workspace-create-if-missing) && '-or-create' || '' }} \
          ${{ inputs.workspace }} \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }}

    - name: ${{ inputs.tf-cli }} validate
      id: validate
      if: fromJSON(inputs.validate)
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} validate \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }}

    - name: ${{ inputs.tf-cli }} test
      id: test
      if: inputs.action == 'test'
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} test \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }} \
          ${{ inputs.action-args }}

    - name: ${{ inputs.tf-cli }} plan
      id: plan
      if: inputs.action == 'plan'
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} plan -input=false \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }} \
          ${{ fromJSON(inputs.destroy) && '-destroy' || '' }} \
          ${{ inputs.plan-file-name && format('-out={0}', inputs.plan-file-name) || '' }} \
          ${{ inputs.action-args }}

    - name: Encrypt Plan
      if: inputs.action == 'plan' && inputs.plan-file-name && inputs.encrypted-plan-password
      shell: bash
      working-directory: ${{ inputs.directory }}
      run: |
        echo "Compressing and encrypting plan file"
        tar cf - ${{ inputs.plan-file-name }} \
          | 7z a -si -t7z -mx=0 -mhe=on -p"${{ inputs.encrypted-plan-password }}" artifact.tar.7z

    - name: Upload Plan
      if: inputs.action == 'plan' && inputs.plan-file-name
      uses: actions/upload-artifact@v4
      with:
        name: ${{ inputs.plan-file-name }}
        path: ${{ inputs.directory }}/${{ inputs.encrypted-plan-password && 'artifact.tar.7z' || inputs.plan-file-name }}
        if-no-files-found: error
        compression-level: 0
        retention-days: ${{ inputs.plan-retention-days }}
        overwrite: true

    - name: Create Temporary Directory for Encrypted Plan
      if: inputs.action == 'apply' && inputs.plan-file-name && inputs.encrypted-plan-password
      shell: bash
      run: |
        echo "Creating temporary destination directory for encrypted plan"
        temp_dir=$(mktemp -d /tmp/XXXXXXXXX)
        echo "temp_dir=$temp_dir" >> "$GITHUB_ENV"

    - name: Download Plan
      if: inputs.action == 'apply' && inputs.plan-file-name
      uses: actions/download-artifact@v4
      with:
        name: ${{ inputs.plan-file-name }}
        path: ${{ env.temp_dir || inputs.directory }}

    - name: Decrypt Plan
      if: inputs.action == 'apply' && inputs.plan-file-name && inputs.encrypted-plan-password
      shell: bash
      run: |
        echo "Decrypting and extracting plan file"
        7z x -so "${{ env.temp_dir }}/artifact.tar.7z" -p"${{ inputs.encrypted-plan-password }}" \
          | tar xf - -C "${{ inputs.directory }}"

    - name: ${{ inputs.tf-cli }} apply
      id: apply
      if: inputs.action == 'apply'
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} apply -input=false -auto-approve \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }} \
          ${{ fromJSON(inputs.destroy) && '-destroy' || '' }} \
          ${{ inputs.action-args }} \
          ${{ inputs.plan-file-name }}

    - name: ${{ inputs.tf-cli }} output
      id: output
      if: inputs.action == 'output'
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} output \
          ${{ github.event_name == 'pull_request' && '-no-color' || '' }} \
          ${{ inputs.action-args }}

    - name: Build PR Comment
      id: comment
      if: always() && fromJSON(inputs.comment) && github.event_name == 'pull_request'
      uses: actions/github-script@v7
      env:
        # Capture the stdout/stderr in env vars to get them from process in the script to avoid unescaped quote issues
        header: ${{ inputs.comment-header }}
        fmtStdout: ${{ steps.fmt.outputs.stdout }}
        fmtStderr: ${{ steps.fmt.outputs.stderr }}
        initStdout: ${{ steps.init.outputs.stdout }}
        initStderr: ${{ steps.init.outputs.stderr }}
        workspaceStdout: ${{ steps.workspace.outputs.stdout }}
        workspaceStderr: ${{ steps.workspace.outputs.stderr }}
        validateStdout: ${{ steps.validate.outputs.stdout }}
        validateStderr: ${{ steps.validate.outputs.stderr }}
        testStdout: ${{ steps.test.outputs.stdout }}
        testStderr: ${{ steps.test.outputs.stderr }}
        planStdout: ${{ steps.plan.outputs.stdout }}
        planStderr: ${{ steps.plan.outputs.stderr }}
        outputStdout: ${{ steps.output.outputs.stdout }}
        outputStderr: ${{ steps.output.outputs.stderr }}
      with:
        github-token: ${{ inputs.github-token }}
        result-encoding: string
        script: |
          const content = {
            header: `${process.env.header}`,
            fmt: {
              enabled: ${{ inputs.fmt }},
              outcome: "${{ steps.fmt.outcome }}",
              stdout: `${process.env.fmtStdout}`,
              stderr: `${process.env.fmtStderr}`
            },
            init: {
              enabled: ${{ inputs.init }},
              outcome: "${{ steps.init.outcome }}",
              stdout: `${process.env.initStdout}`,
              stderr: `${process.env.initStderr}`
            },
            workspace: {
              enabled: ${{ fromJSON(inputs.workspace-select) && !!inputs.workspace && !env.TF_WORKSPACE }},
              outcome: "${{ steps.workspace.outcome }}",
              stdout: `${process.env.workspaceStdout}`,
              stderr: `${process.env.workspaceStderr}`
            },
            validate: {
              enabled: ${{ inputs.validate }},
              outcome: "${{ steps.validate.outcome }}",
              stdout: `${process.env.validateStdout}`,
              stderr: `${process.env.validateStderr}`
            },
            test: {
              enabled: ${{ inputs.action == 'test' }},
              outcome: "${{ steps.test.outcome }}",
              stdout: `${process.env.testStdout}`,
              stderr: `${process.env.testStderr}`
            },
            plan: {
              enabled: ${{ inputs.action == 'plan' }},
              outcome: "${{ steps.plan.outcome }}",
              stdout: `${process.env.planStdout}`,
              stderr: `${process.env.planStderr}`
            },
            output: {
              enabled: ${{ inputs.action == 'output' }},
              outcome: "${{ steps.output.outcome }}",
              stdout: `${process.env.outputStdout}`,
              stderr: `${process.env.outputStderr}`
            }
          }
          const terraformComment = require('${{ github.action_path }}/terraform_comment.js')
          return terraformComment(context, content)

    - name: PR Comment
      uses: 7Factor/action-pr-comment@v1
      if: always() && fromJSON(inputs.comment) && github.event_name == 'pull_request'
      with:
        github-token: ${{ inputs.github-token }}
        comment-identifier: ${{ inputs.comment-identifier }}
        comment-body: ${{ steps.comment.outputs.result }}

    - name: ${{ inputs.tf-cli }} output
      if: fromJSON(inputs.output)
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} output \
          ${{ inputs.output-args }}

    - name: ${{ inputs.tf-cli }} output
      id: metadata
      if: fromJSON(inputs.metadata)
      working-directory: ${{ inputs.directory }}
      shell: bash
      run: |
        ${{ inputs.tf-cli }} output -no-color -json \
          > ${{ github.action_path }}/output
        set -e
        echo "metadata=$(cat ${{ github.action_path }}/output | jq -c 'with_entries(.value |= .value)')" >> "$GITHUB_OUTPUT"