terraform.yml

name: "Terraform"
on:
  pull_request:
    branches: [main]
    paths:
      - ".review_apps/**"
  merge_group:
    types: [checks_requested]
jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Determine Terraform version
        id: terraform-version
        run: |
          xargs printf "TF_VERSION=%s" < .review_apps/.terraform-version >> "$GITHUB_OUTPUT"

      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
        with:
          terraform_version:  ${{steps.terraform-version.outputs.TF_VERSION}}

      - name: Check Terraform style
        id: tf_fmt
        working-directory: ".review_apps/"
        run: |
          terraform fmt -write=false -diff=true -list=true -recursive -check

      - name: Lint Terraform
        run: |
          pip install -r .review_apps/requirements.txt
          checkov -d .review_apps/ --framework terraform --quiet

      - name: Validate Terraform syntax
        working-directory: ".review_apps/"
        run: |
          terraform init -backend=false || exit
          terraform validate