Split check into reusable and calling actions, cleanup others

.github/workflows/opentofu-check-schedule.yml → .github/workflows/opentofu-check.yml

@@ -2,7 +2,7 @@
 # Copyright The Linux Foundation and each contributor.
 # SPDX-License-Identifier: MIT
 
-name: "OpenTofu Check Schedule"
+name: "OpenTofu Check"
 
 on:
   workflow_call:
@@ -87,73 +87,17 @@ on:
       opentofu_http_credentials:
         description: 'Credentials that will be used for fetching modules sources'
         required: false
-  schedule:
-    # Runs at 9:00 AM PST every Tuesday
-    # Note: GitHub Actions uses UTC time
-    # 9:00 AM PST = 17:00 UTC (during standard time)
-    - cron: '0 17 * * 2'
 
 permissions:
   id-token: write
   contents: read
   pull-requests: write
 
 jobs:
-  opentofu_check_drift:
-    name: "OpenTofu Check - ${{ matrix.environment }}"
-    strategy:
-      matrix:
-        environment:
-          - dev
-          - prod
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'schedule' }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set Environment Variables
-        id: set-env
-        run: |
-            echo -e "${{ inputs.env }}" >> "$GITHUB_ENV"
-            for val in $(echo -e "${{ secrets.env_secret }}" | cut -d'=' -f2-); do echo ::add-mask::"$val" ; done
-            for val in $(echo -e "${{ secrets.opentofu_secret_variables }}" | cut -d'=' -f2-); do echo ::add-mask::"$val" ; done
-            echo -e "${{ secrets.env_secret }}" >> "$GITHUB_ENV"
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
-        with:
-          audience: sts.amazonaws.com
-          role-to-assume: arn:aws:iam::391835788720:role/terraform-deploy-oidc
-          aws-region: us-west-2
-
-      # This is used to fetch build time secrets from AWS Secrets Manager
-      - name: Read secrets from AWS Secrets Manager into environment variables
-        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10
-        if: ${{ vars.SECRETS_MANAGER_KEYS != '' }}
-        with:
-          secret-ids: ${{ vars.SECRETS_MANAGER_KEYS }}
-          name-transformation: none
-
-      - name: OpenTofu Check
-        uses: dflook/tofu-check@906f68064a99656755c320d74959150782d42757 # v1.49.0
-        with:
-          workspace: ${{ vars.OPENTOFU_WORKSPACE || matrix.environment }}
-          backend_config: ${{ vars.OPENTOFU_BACKEND_CONFIG || '' }}
-          var_file: ${{ vars.OPENTOFU_VAR_FILE || '' }}
-          path: ${{ vars.OPENTOFU_PATH || '.' }}
-          variables: |
-            ${{ vars.OPENTOFU_VARIABLES || '' }}
-            ${{ secrets.opentofu_secret_variables }}
-        env:
-          OPENTOFU_HTTP_CREDENTIALS: ${{ secrets.opentofu_http_credentials }}
-          OPENTOFU_VERSION: 1.10.3
-
   opentofu_check:
     runs-on: ubuntu-latest
     name: "OpenTofu Check - ${{ inputs.environment }}"
-    if: ${{ github.event_name == 'workflow_call' && inputs.trigger_check }}
+    if: ${{ inputs.trigger_check }}
 
     steps:
       - name: Checkout

.github/workflows/tofu-apply.yml

@@ -1,9 +1,8 @@
-name: "Terraform Apply"
+name: "Tofu Apply"
 
 on:
   push:
     branches:
-      - master
       - main
 
 permissions:

.github/workflows/tofu-check-schedule.yml

@@ -0,0 +1,37 @@
+---
+# Copyright The Linux Foundation and each contributor.
+# SPDX-License-Identifier: MIT
+
+name: "OpenTofu Check Schedule"
+
+on:
+  schedule:
+    # Runs at 9:00 AM PST every Tuesday
+    # Note: GitHub Actions uses UTC time
+    # 9:00 AM PST = 17:00 UTC (during standard time)
+    - cron: '0 17 * * 2'
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+
+jobs:
+  opentofu_check_drift:
+    name: "OpenTofu Check - ${{ matrix.environment }}"
+    strategy:
+      matrix:
+        environment:
+          - prod
+    uses: ./.github/workflows/opentofu-check.yml
+    with:
+      environment: ${{ matrix.environment }}
+      opentofu_workspace: ${{ matrix.environment }}
+      oidc_role_arn: 'arn:aws:iam::391835788720:role/terraform-deploy-oidc'
+      oidc_audience: 'sts.amazonaws.com'
+    secrets:
+      env_secret: |
+        GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+      opentofu_secret_variables: |
+        datadog_api_key = "${{ secrets.DD_API_KEY }}"
+        datadog_app_key = "${{ secrets.DD_APP_KEY }}"

.github/workflows/tofu-plan.yml

@@ -1,4 +1,4 @@
-name: "Terraform Plan"
+name: "Tofu Plan"
 
 on:
   - pull_request