pr.yml

on:
  pull_request:
    branches:
      - main

jobs:
  getDirs:
    runs-on: ubuntu-latest
    outputs:
      dir: ${{ steps.set-dirs.outputs.dir }}
    steps:
      - uses: actions/checkout@v4
      - id: set-dirs
        run: echo "dir=$(ls -d *-cluster/ | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT

  plan:
    runs-on: ubuntu-latest
    needs: [getDirs]
    strategy:
      matrix:
        cluster: ${{fromJson(needs.getDirs.outputs.dir)}}
    defaults:
      run:
        working-directory: ${{ matrix.cluster }}
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false
      - uses: aquasecurity/tfsec-action@v1.0.3
        id: tfsec
        with:
          additional_args: "--out tfsec.xml"
          soft_fail: true
          format: junit
      - uses: mikepenz/action-junit-report@v4
        if: always()
        with:
          report_paths: 'tfsec.xml'

      - name: Terraform Init
        id: init
        run: terraform init -upgrade
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Set Cluster ID
        id: env_var
        run: |
          echo "CLUSTER_ID=$(cat CLUSTERID.md)" >> $GITHUB_OUTPUT
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Setup Kubeconfig
        id: kubeconfig
        run: |
          curl -X GET "https://kaas.cloudpunks.io/api/v2/projects/${{ secrets.KAAS_PROJECT_ID }}/clusters/${{ steps.env_var.outputs.CLUSTER_ID }}/kubeconfig" \
          -H  "accept: application/octet-stream" -H "Authorization: Bearer ${{ secrets.SA_DEV_INTERN }}" > .kubeconfig
          chmod go-r .kubeconfig
          export KUBECONFIG=.kubeconfig

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}