templates.terraform.pull_requests.lint.yaml

name: IaaS - Terraform CI (for pull requests) - Lint

on:
  workflow_call:
    inputs:
      terraform_workdir:
        description: Working directory where Terraform files are
        required: false
        default: "."
        type: string
      terraform_version:
        description: Terraform version that should we use (latest by default)
        required: false
        type: string

jobs:
  # Terraform validate checks if your TF files are in a canonical format and without HCL issues
  terraform_validate:
    name: Terraform files validation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          terraform_version: ${{ inputs.terraform_version }}
      - name: Pre-hook Terraform workflow
        id: pre
        run: |
          # Setup `workdir` suffix used to give more information during execution
          if [[ '${{ inputs.terraform_workdir }}' == '.' ]]; then
            echo "workdir=" >> "${GITHUB_OUTPUT}"
          else
            echo "workdir=(${{ inputs.terraform_workdir }})" >> "${GITHUB_OUTPUT}"
          fi

      # --- `terraform fmt`
      - name: Check if all Terraform configuration files are in a canonical format ${{ steps.pre.outputs.workdir }}
        id: fmt
        run: terraform fmt -check -recursive -diff -no-color
        working-directory: ${{ inputs.terraform_workdir }}
      - uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
        if: failure() && steps.fmt.outcome == 'failure'
        with:
          recreate: true
          header: tf::${{ steps.pre.outputs.workdir }}
          message: |
            # Terraform CI/CD ${{ steps.pre.outputs.workdir }}

            - [ ] :paintbrush: Check if all Terraform configuration files are in a canonical format

            ### 🚫 Failure reason
            ```terraform
            ${{ steps.fmt.outputs.stdout }}
            ```
            <br/>

            > _Report based on commit ${{ github.sha }} (authored by **@${{ github.actor }}**).  See [`actions#${{ github.run_id }}`](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details._

      # --- `terraform init`
      - name: Initialize Terraform working directory ${{ steps.pre.outputs.workdir }}
        id: init
        env:
          TF_IN_AUTOMATION: yes
        run: terraform init -no-color -backend=false
        working-directory: ${{ inputs.terraform_workdir }}
      - uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
        if: failure() && steps.init.outcome == 'failure'
        with:
          recreate: true
          header: tf::${{ steps.pre.outputs.workdir }}
          message: |
            # Terraform CI/CD ${{ steps.pre.outputs.workdir }}

            - [x] :paintbrush: Check if all Terraform configuration files are in a canonical format
            - [ ] :hammer_and_wrench: Validate the configuration files

            ### 🚫 Failure reason
            ```
            ${{ steps.init.outputs.stderr }}
            ```
            <br/>

            > _Report based on commit ${{ github.sha }} (authored by **@${{ github.actor }}**).  See [`actions#${{ github.run_id }}`](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details._

      # --- `terraform validate`
      - name: Validate the configuration files ${{ steps.pre.outputs.workdir }}
        id: validate
        env:
          TF_IN_AUTOMATION: yes
        run: terraform validate -no-color
        working-directory: ${{ inputs.terraform_workdir }}
      - uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
        if: failure() && steps.validate.outcome == 'failure'
        with:
          recreate: true
          header: tf::${{ steps.pre.outputs.workdir }}
          message: |
            # Terraform CI/CD ${{ steps.pre.outputs.workdir }}

            - [x] :paintbrush: Check if all Terraform configuration files are in a canonical format
            - [ ] :hammer_and_wrench: Validate the configuration files

            ### 🚫 Failure reason
            ```
            ${{ steps.validate.outputs.stderr }}
            ```
            <br/>

            > _Report based on commit ${{ github.sha }} (authored by **@${{ github.actor }}**).  See [`actions#${{ github.run_id }}`](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details._
      - uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
        if: success()
        with:
          recreate: true
          header: tf::${{ steps.pre.outputs.workdir }}
          message: |
            # Terraform CI/CD ${{ steps.pre.outputs.workdir }}

            - [x] :paintbrush: Check if all Terraform configuration files are in a canonical format
            - [x] :hammer_and_wrench: Validate the configuration files

            > _Report based on commit ${{ github.sha }} (authored by **@${{ github.actor }}**).  See [`actions#${{ github.run_id }}`](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details._