pull-request-validation.yml

name: Pull Request Validation

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main

permissions:
  id-token: write # This is required for Az CLI Login
  contents: read # This is required for actions/checkout

jobs:
  dependency-review:
    runs-on: ubuntu-latest

    steps:
    - name: "Checkout Repository"
      uses: actions/checkout@v4

    - name: "Dependency Review"
      uses: actions/dependency-review-action@v4

  terraform-plan-and-apply-dev:
    environment: Development
    runs-on: ubuntu-latest

    concurrency: # This is required to prevent multiple GitHub Actions invocations against stateful resources. e.g. Terraform state file / Database / Deployed Apps
      group: ${{ github.repository }}-dev

    steps:
    - uses: actions/checkout@v4

    - uses: frasermolyneux/actions/terraform-plan-and-apply@main
      with:
        terraform-folder: "terraform"
        terraform-var-file: "tfvars/dev.tfvars"
        terraform-backend-file: "backends/dev.backend.hcl"
        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

  terraform-plan-prd:
    if: github.actor != 'dependabot[bot]' # dependabot context has no permissions to prod so skip this check
    environment: Production
    runs-on: ubuntu-latest

    concurrency: # This is required to prevent multiple GitHub Actions invocations against stateful resources. e.g. Terraform state file / Database / Deployed Apps
      group: ${{ github.repository }}-prd

    steps:
    - uses: actions/checkout@v4

    - uses: frasermolyneux/actions/terraform-plan@main
      with:
        terraform-folder: "terraform"
        terraform-var-file: "tfvars/prd.tfvars"
        terraform-backend-file: "backends/prd.backend.hcl"
        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}