plan.yml

name: "Plan org changes and list them in a PR"
on:
  pull_request:
    branches:
      - main
    paths:
      - 'terraform/production/*.tfvars'

jobs:
  plan-changes:
    name: "Org changes plan"
    runs-on: ubuntu-latest

    permissions:
      pull-requests: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: terraform plan
        # v1.43.0
        # Use the commit hash for security hardening
        # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
        uses: dflook/terraform-plan@d9df4f6c2484e709ba7ffaa16c98a6906f4760cd
        env:
          TERRAFORM_ACTIONS_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          add_github_comment: true
          path: "terraform"
          variables: |
            github_token = "${{ secrets.TERRAFORM_MANAGEMENT_GITHUB_TOKEN }}"
          var_file: |
            terraform/production/org.tfvars
            terraform/production/repositories.tfvars