terraform.yaml

name: Terraform CI/CD

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  workflow_dispatch:

env:
  TF_LOG: INFO

permissions:
  id-token: write
  issues: write
  pull-requests: write
  contents: read

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .

      - name: Checkout cnp-azuredevops-libraries
        uses: actions/checkout@v4
        with:
          repository: hmcts/cnp-azuredevops-libraries
          path: cnp-azuredevops-libraries
  
      - name: Setup Script
        run: |
          chmod +x cnp-azuredevops-libraries/scripts/tfenv-install-terraform.sh
  
      - name: Setup Terraform
        run: ./cnp-azuredevops-libraries/scripts/tfenv-install-terraform.sh
        shell: bash

      - name: Run Pre-commit
        uses: pre-commit/action@v3.0.0
        with:
          extra_args: terraform_fmt --all-files
        continue-on-error: true
  
      - name: Auto Commit Changes
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          file_pattern: components/*

  terraform:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .

      - name: Az CLI login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Terraform Init
        working-directory: components
        env:
          STORAGE_ACCOUNT: ${{ secrets.STORAGE_ACCOUNT }}
          CONTAINER_NAME: ${{ secrets.CONTAINER_NAME }}
          RESOURCE_GROUP_NAME: ${{ secrets.RESOURCE_GROUP_NAME }}
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: terraform init -backend-config="storage_account_name=$STORAGE_ACCOUNT" -backend-config="container_name=$CONTAINER_NAME" -backend-config="resource_group_name=$RESOURCE_GROUP_NAME" -reconfigure

      - name: Terraform Validate
        working-directory: components
        id: validate
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: terraform validate

      - name: Terraform Plan
        working-directory: components
        id: plan
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          GITHUB_TOKEN: ${{ secrets.OAUTH_TOKEN }}
        run: terraform plan -var="oauth_token=${{ secrets.OAUTH_TOKEN }}"

      - name: Terraform Apply
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        working-directory: components
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          GITHUB_TOKEN: ${{ secrets.OAUTH_TOKEN }}
        run: terraform apply -var="oauth_token=${{ secrets.OAUTH_TOKEN }}" -auto-approve