chore: upgrade azurerm to 5.0.1 #89
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform plan | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| paths: | |
| - "terraform/**" | |
| - ".github/workflows/terraform-plan.yml" | |
| permissions: | |
| contents: read | |
| id-token: write | |
| pull-requests: write | |
| jobs: | |
| terraform-plan: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: terraform | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| # when we run terraform plan, we assume that the container image tag will remain on the currently deployed SHA | |
| - name: Get head SHA of main | |
| id: get_main_sha | |
| run: | | |
| git fetch origin main --depth=1 | |
| MAIN_SHA=$(git rev-parse origin/main) | |
| echo "sha=${MAIN_SHA}" >> $GITHUB_OUTPUT | |
| - name: Log in to azure using federated identity credentials | |
| uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 | |
| with: | |
| client-id: ${{ secrets.AZURE_SP_PLAN_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Setup terraform | |
| uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4 | |
| with: | |
| terraform_version: 1.15.8 # should match TF_VERSION in .devcontainer/Dockerfile | |
| - name: Initialize terraform and select workspace | |
| run: ./init.sh "dev" | |
| - name: Terraform Plan | |
| env: | |
| TF_VAR_CONTAINER_TAG: ${{ steps.get_main_sha.outputs.sha }} | |
| TF_VAR_DEVSECOPS_OBJECT_ID: ${{ secrets.TF_VAR_DEVSECOPS_OBJECT_ID }} | |
| TF_VAR_ENGINEERING_GROUP_OBJECT_ID: ${{ secrets.TF_VAR_ENGINEERING_GROUP_OBJECT_ID }} | |
| TF_VAR_sp_apply_object_id: ${{ secrets.AZURE_SP_DEV_OBJECT_ID }} | |
| TF_VAR_sp_plan_object_id: ${{ secrets.AZURE_SP_PLAN_OBJECT_ID }} | |
| run: terraform plan -out=tfplan -lock-timeout=5m | |
| # tf-summarize generates a course-grained summary w/ no sensitive infra details | |
| - name: Setup tf-summarize | |
| uses: kishaningithub/setup-tf-summarize@1596bb06f9509eb36b71bc1b304407cc111059c0 #v3.0.0 | |
| - name: Create tf-summarize markdown file | |
| run: tf-summarize -md tfplan >> tf-summary.md | |
| - name: Check for existing comment | |
| uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 | |
| id: fc | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| comment-author: "github-actions[bot]" | |
| body-includes: CHANGE | |
| direction: last | |
| - name: Create or update PR comment with course-grained plan summary | |
| uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 | |
| with: | |
| comment-id: ${{ steps.fc.outputs.comment-id }} | |
| issue-number: ${{ github.event.number }} | |
| body-path: "./terraform/tf-summary.md" | |
| edit-mode: replace |