awesome-terraform-pipeline.yml

name: Awesome Terraform Workflow

on: 
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  AWS_DEFAULT_REGION: ${{ secrets.aws_default_region }}
  AWS_ACCESS_KEY_ID: ${{ secrets.aws_access_key_id }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.aws_secret_access_key }}

jobs:
  tf-fmt-check:
    runs-on: ubuntu-16.04
    strategy:
      matrix:
        tf_working_dir: [terraform/local, terraform/dev, terraform/production]
    outputs:
      fmt: ${{ steps.fmt.outcome }} 
    steps:
      - uses: hashicorp/setup-terraform@v1
        name: Setup Terraform
        with:
          terraform_version: 0.13.5
      - uses: actions/checkout@v2
        name: Checkout source code
      - name: Terraform fmt
        id: fmt
        run: terraform fmt --recursive -check
        working-directory: ${{ matrix.tf_working_dir }}
  tf-validate:
    runs-on: ubuntu-16.04
    strategy:
      matrix:
        tf_working_dir: [terraform/local, terraform/dev, terraform/production]
    outputs:
      validate: ${{ steps.validate.outcome }}
    steps:
      - uses: hashicorp/setup-terraform@v1
        name: Setup Terraform
        with:
          terraform_version: 0.13.5
      - uses: actions/checkout@v2
        name: Checkout source code
      - name: Terraform Init
        id: init
        run: terraform init
        working-directory: ${{ matrix.tf_working_dir }}
      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color
        working-directory: ${{ matrix.tf_working_dir }}
  tf-lint:
    runs-on: ubuntu-16.04
    strategy:
      matrix:
        tf_working_dir: [terraform/local, terraform/dev, terraform/production]
    steps:
      - uses: hashicorp/setup-terraform@v1
        name: Setup Terraform
        with:
          terraform_version: 0.13.5
      - uses: actions/checkout@v2
        name: Checkout source code
      - name: Terraform Init
        id: init
        run: terraform init
        working-directory: ${{ matrix.tf_working_dir }}
      - name: tflint
        uses: reviewdog/action-tflint@v1
        with:
          github_token: ${{ secrets.github_token }}
          flags: "-c ../.tflint.hcl"
          working_directory: ${{ matrix.tf_working_dir }}
          fail_on_error: "true"
          filter_mode: "nofilter"
  checkov:
    runs-on: ubuntu-16.04
    strategy:
      matrix:
        tf_working_dir: [terraform/local, terraform/dev, terraform/production]
    steps:
      - name: Checkout source code
        uses: actions/checkout@v2
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ${{ matrix.tf_working_dir }}
          quiet: true 
          framework: terraform 
  tf-plan:
    runs-on: ubuntu-16.04
    strategy:
      matrix:
        tf_working_dir: [terraform/local, terraform/dev, terraform/production]
    needs: [tf-fmt-check, tf-validate, tf-lint, checkov]
    steps:
      - uses: hashicorp/setup-terraform@v1
        name: Setup Terraform
        with:
          terraform_version: 0.13.5
      - name: Checkout source code
        uses: actions/checkout@v2
      - name: Terraform Init
        id: init
        run: terraform init
        working-directory: ${{ matrix.tf_working_dir }}
      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color -out=tfplan
        working-directory: ${{ matrix.tf_working_dir }}
        continue-on-error: ${{ matrix.tf_working_dir }} == 'terraform/production'
      - name: Publish terraform plan
        id: publish-plan
        uses: actions/github-script@0.9.0
        if: github.event_name == 'pull_request' && matrix.tf_working_dir == 'terraform/production'
        env:
          PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### Terraform Format and Style 🖌\`${{ needs.tf-fmt-check.outputs.fmt }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Validation 🤖\`${{ needs.tf-validate.outputs.validate }}\`
            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
            
            <details><summary>Show Plan</summary>
            
            \`\`\`${process.env.PLAN}\`\`\`
            
            </details>
            
            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ matrix.tf_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
              
            github.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })
      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1
  localstack-test:
    runs-on: ubuntu-16.04
    needs: [tf-plan]
    services:
      localstack:
        image: localstack/localstack:latest
        env:
          SERVICES: ec2,cloudformation,iam,sts,ssm,s3,cloudwatch,cloudwatch-logs,lambda,dynamodb,apigateway
          DEFAULT_REGION: eu-west-1
          AWS_ACCESS_KEY_ID: mock_access_key
          AWS_SECRET_ACCESS_KEY: mock_access_key
        ports:
          - 4566:4566
          - 4571:4571
    steps:
      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.15
      - uses: hashicorp/setup-terraform@v1
        name: Setup Terraform
        with:
          terraform_version: 0.13.5
      - name: Checkout source code
        uses: actions/checkout@v2
      - name: Run tests
        working-directory: terraform/tests/local
        run: go test -v -timeout 30m
  dev-test:
    runs-on: ubuntu-16.04
    needs: [tf-plan]
    steps:
      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.15
      - uses: hashicorp/setup-terraform@v1
        name: Setup Terraform
        with:
          terraform_version: 0.13.5
      - name: Checkout source code
        uses: actions/checkout@v2
      - name: Run tests
        working-directory: terraform/tests/dev
        run: go test -v -timeout 30m
  infracost:
    runs-on: ubuntu-16.04
    if: github.event_name == 'pull_request'
    needs: [tf-fmt-check, tf-validate, tf-lint, checkov]
    steps:
    - name: Checkout source code
      uses: actions/checkout@v2
    - name: Run infracost diff
      uses: infracost/infracost-gh-action@master
      env:
        INFRACOST_API_KEY: ${{ secrets.INFRACOST_API_KEY }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        tfdir: terraform/production
        entrypoint: /scripts/ci/diff.sh
        percentage_threshold: 1
  docs:
    runs-on: ubuntu-16.04
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [tf-plan]
    steps:
    - name: Checkout source code
      uses: actions/checkout@v2
      with:
        ref: main
    - name: Generate TF Docs
      uses: Dirrk/terraform-docs@v1
      with:
        tf_docs_working_dir: terraform/modules/s3,terraform/modules/iam,terraform/modules/aws-backend-state,terraform/modules/ec2-cluster,terraform/modules/vpc
        tf_docs_output_file: README.md
        tf_docs_output_method: inject
        tf_docs_git_push: 'true'
  apply:
    runs-on: ubuntu-16.04
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [tf-plan, dev-test, localstack-test]
    steps:
    - uses: hashicorp/setup-terraform@v1
      name: Setup Terraform
      with:
        terraform_version: 0.13.5  
    - name: Checkout source code
      uses: actions/checkout@v2
      with:
        ref: main
    - name: Terraform Init
      run: terraform init
      working-directory: terraform/production
    - name: Terraform Apply
      run: terraform apply -auto-approve
      working-directory: terraform/production