run-terraform.yml

name: Run Terraform

on:
  workflow_call:
    inputs:
      service_account:
        description: "The GCP service account connected to the identity pool that will be used by Terraform for authentication to GCP."
        required: true
        type: string
      auth_project_number:
        description: "The GCP Project Number used for authentication. A 12-digit number used as a unique identifier for the project. Used to find workload identity pool."
        required: true
        type: string
      runner:
        description: "The GitHub runner to use when running the deploy. This can for example be `atkv1-dev`"
        required: true
        type: string
      workload_identity_provider_override:
        description: "The ID of the provider to use for authentication. Only used for overriding the default workload identity provider based on project number. It should be in the format of `projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/providers/{{workload_identity_pool_provider_id}}`"
        required: false
        type: string
      deploy_on:
        description: "Which branch will be the only branch allowed to deploy. This defaults to the main branch so that other branches only run check and plan. Defaults to `refs/heads/main`"
        required: false
        type: string
      working_directory:
        description: "The directory in which to run terraform, i.e. where the Terraform files are placed. The path is relative to the root of the repository"
        required: false
        type: string
        default: "."
      project_id:
        description: 'The GCP Project ID to use as the "active project" when running Terraform. When deploying to Kubernetes, this must match the project in which the Kubernetes cluster is registered'
        required: false
        type: string
      environment:
        description: "The GitHub environment to use when deploying. See [using environments for deployment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment) for more info on this"
        required: false
        type: string
      kubernetes_cluster:
        description: "An optional kubernetes cluster to authenticate to. Note that the project_id must match where the cluster is registered"
        required: false
        type: string
      terraform_workspace:
        description: "When provided will set a workspace as the active workspace when planning and deploying"
        required: false
        type: string
      terraform_option_1:
        description: "An additional terraform option to be passed to plan and apply. For example `-var-file=dev.tfvars` and `-var=<variableName>=<variableValue>`"
        required: false
        type: string
      terraform_option_2:
        description: "An additional terraform option to be passed to plan and apply. For example `-var-file=dev.tfvars` and `-var=<variableName>=<variableValue>`"
        required: false
        type: string
      terraform_option_3:
        description: "An additional terraform option to be passed to plan and apply. For example `-var-file=dev.tfvars` and `-var=<variableName>=<variableValue>`"
        required: false
        type: string
      terraform_init_option_1:
        description: "An additional config to be passed to terraform init. For example `-backend-config=dev.gcs.tfbackend`"
        required: false
        type: string
      terraform_init_option_2:
        description: "An additional config to be passed to terraform init. For example `-backend-config=dev.gcs.tfbackend`"
        required: false
        type: string
      terraform_init_option_3:
        description: "An additional config to be passed to terraform init. For example `-backend-config=dev.gcs.tfbackend`"
        required: false
        type: string
      add_comment_on_pr:
        description: "Setting this to `false` disables the creation of comments with info of the Terraform run on Pull Requests. When `true` the `pull-request` permission is required to be set to `write`. Defaults to `true`"
        required: false
        type: boolean
        default: true
      destroy:
        description: "An optional boolean which runs terraform destroy when set to true. Defaluts to false"
        required: false
        type: boolean
        default: false
      unlock:
        description: "An optional string which runs terraform force-unlock on the provided `LOCK_ID`, if set."
        required: false
        type: string
        default: ""
      use_platform_modules:
        description: "An optional boolean which enables the octo sts identity for the terraform-modules repo. Defaults to false"
        required: false
        type: boolean
        default: false
      checkout_submodules:
        description: "An optional boolean which enables checking out submodules. Defaults to false"
        required: false
        type: boolean
        default: false
      output_file_path:
        description: "An optional path to a file that will be uploaded as an artifact after the terraform run"
        required: false
        type: string
        default: ""
    secrets:
      arm_client_id:
        description: Azure Service Principal Client ID
        required: false
      arm_client_secret:
        description: Azure Service Principal Client Secret
        required: false
      arm_tenant_id:
        description: Azure AD Tenant ID
        required: false

env:
  WORKLOAD_IDENTITY_PROVIDER_OVERRIDE: ${{ inputs.workload_identity_provider_override }}
  AUTH_PROJECT_NUMBER: ${{ inputs.auth_project_number }}
  SERVICE_ACCOUNT: ${{ inputs.service_account }}
  DEPLOY_ON: ${{ inputs.deploy_on }}
  WORKING_DIRECTORY: ${{ inputs.working_directory }}
  PROJECT_ID: ${{ inputs.project_id }}
  ENVIRONMENT: ${{ inputs.environment }}
  KUBERNETES_CLUSTER: ${{ inputs.kubernetes_cluster }}
  TF_TMP_WORKSPACE: ${{ inputs.terraform_workspace }}
  DESTROY: ${{ inputs.destroy }}
  UNLOCK: ${{ inputs.unlock }}
  TF_INIT_OPTION_1: ${{ inputs.terraform_init_option_1 }}
  TF_INIT_OPTION_2: ${{ inputs.terraform_init_option_2 }}
  TF_INIT_OPTION_3: ${{ inputs.terraform_init_option_3 }}
  TF_OPTION_1: ${{ inputs.terraform_option_1 }}
  TF_OPTION_2: ${{ inputs.terraform_option_2 }}
  TF_OPTION_3: ${{ inputs.terraform_option_3 }}
  REGISTRY: ghcr.io
  ARM_CLIENT_ID: ${{ secrets.arm_client_id }}
  ARM_CLIENT_SECRET: ${{ secrets.arm_client_secret }}
  ARM_TENANT_ID: ${{ secrets.arm_tenant_id }}
  NEED_TAILSCALE: false

jobs:
  setup-env:
    runs-on: ubuntu-latest
    outputs:
      workload_identity_provider: ${{ steps.set-output.outputs.WORKLOAD_IDENTITY_PROVIDER }}
    steps:
      - name: Set vars
        id: set-output
        run: |
          PRODUCT_NAME=$(echo $SERVICE_ACCOUNT | sed 's/-deploy.*//')
          DEFAULT_WORKLOAD_IDENTITY="projects/$AUTH_PROJECT_NUMBER/locations/global/workloadIdentityPools/$PRODUCT_NAME-deploy-pool/providers/github-provider"
          OVERRIDE=$WORKLOAD_IDENTITY_PROVIDER_OVERRIDE
          PROVIDER=${OVERRIDE:-$DEFAULT_WORKLOAD_IDENTITY}
          echo "WORKLOAD_IDENTITY_PROVIDER=$PROVIDER" >> $GITHUB_OUTPUT

  terraform_plan:
    needs: [setup-env]
    name: Terraform Plan
    runs-on: ${{ inputs.runner }}

    # Disallow parallel jobs for same env to allow aquiring state lock instead of crashing
    concurrency: ${{ inputs.environment }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIRECTORY }}
    outputs:
      plan_exitcode: ${{ steps.plan.outputs.exitcode }}

    env:
      # makes some minor adjustments to Terraforms output to de-emphasize specific commands to run
      TF_IN_AUTOMATION: true
      WORKLOAD_IDENTITY_PROVIDER: ${{ needs.setup-env.outputs.workload_identity_provider }}

    steps:
      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
        id: octo-sts
        if: ${{ inputs.use_platform_modules == true || inputs.checkout_submodules == true}}
        with:
          scope: kartverket
          identity: kartverket_repos

      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout_submodules == true && 'recursive' || 'false' }}
          token: ${{ inputs.checkout_submodules == true && steps.octo-sts.outputs.token || github.token }}

      - name: hack for github internal repo access
        if: ${{ inputs.use_platform_modules == true }}
        run: git config --global url."https://x-access-token:${{ steps.octo-sts.outputs.token }}@github.com".insteadOf ssh://git@github.com

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3.1.2
        with:
          terraform_version: ${{ inputs.use_platform_modules == true && '1.6.6' || 'latest' }}

      - name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT }}
          project_id: ${{ env.PROJECT_ID }}

      # Install the Gcloud suite in order to install gke-gcloud-auth-plugin plugin
      - name: Set up Cloud SDK
        if: env.KUBERNETES_CLUSTER != ''
        uses: google-github-actions/setup-gcloud@v2

      - name: Authenticate with Kubernetes
        if: env.KUBERNETES_CLUSTER != ''
        run: |
          gcloud components install gke-gcloud-auth-plugin
          gcloud container hub memberships get-credentials $KUBERNETES_CLUSTER --verbosity debug --location global

      # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
      - name: Terraform Pre-Init
        if: env.TF_TMP_WORKSPACE != ''
        run: |
          terraform init -input=false \
            ${TF_INIT_OPTION_1:+"$TF_INIT_OPTION_1"} \
            ${TF_INIT_OPTION_2:+"$TF_INIT_OPTION_2"} \
            ${TF_INIT_OPTION_3:+"$TF_INIT_OPTION_3"}

      - name: Select/Create Terraform Workspace
        if: env.TF_TMP_WORKSPACE != ''
        run: |
          echo "TF_WORKSPACE=$TF_TMP_WORKSPACE" >> $GITHUB_ENV
          terraform workspace select $TF_TMP_WORKSPACE || terraform workspace new $TF_TMP_WORKSPACE

      # Initialize again in case a new workspace was selected
      - name: Terraform Init
        id: init
        run: |
          terraform init -input=false \
            ${TF_INIT_OPTION_1:+"$TF_INIT_OPTION_1"} \
            ${TF_INIT_OPTION_2:+"$TF_INIT_OPTION_2"} \
            ${TF_INIT_OPTION_3:+"$TF_INIT_OPTION_3"}

      # Run terraform force-unlock if 'unlock' is set to true
      - name: Terraform Unlock
        if: env.UNLOCK != ''
        id: unlock
        run: |
          terraform force-unlock -force $UNLOCK

      - name: Terraform Validate
        id: validate
        run: |
          echo 'Run validate' | tee $GITHUB_STEP_SUMMARY
          terraform validate -no-color | tee -a output.txt
          cat output.txt | sed '/^::/d' >> $GITHUB_STEP_SUMMARY

      # Checks that all Terraform configuration files adhere to a canonical format
      - name: Terraform Format
        id: format

        run: |
          echo 'Run format check' | tee -a $GITHUB_STEP_SUMMARY
          terraform fmt -check -recursive -no-color || { echo '
          FAILURE! The above files are not properly formatted.
          Run `terraform fmt` in $WORKING_DIRECTORY, commit the changed files and push to fix the issue' | tee -a $GITHUB_STEP_SUMMARY ; exit 1; }

      - name: Check for PostgreSQL Provider
        id: check_postgresql
        run: |
          PROVIDER_CHECK=$(terraform providers | grep cyrilgdn/postgresql) || true
          if [ -n "$PROVIDER_CHECK" ]; then
            echo "PostgreSQL provider found."
            echo "NEED_TAILSCALE=true" >> $GITHUB_ENV
          else
            echo "PostgreSQL provider not found."
            echo "NEED_TAILSCALE=false" >> $GITHUB_ENV
          fi

      - name: Tailscale
        if: env.NEED_TAILSCALE == 'true'
        uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_CLOUDSQL_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_CLOUDSQL_OAUTH_SECRET }}
          tags: tag:cloudsql-user

      - name: Terraform Plan
        id: plan
        run: |
          # 1. Run and send stdout to build log as usual
          if [ "$DESTROY" == "true" ] 
          then
            terraform plan -destroy -input=false -no-color -detailed-exitcode -out=plan-$ENVIRONMENT.tfplan \
              ${TF_OPTION_1:+"$TF_OPTION_1"} \
              ${TF_OPTION_2:+"$TF_OPTION_2"} \
              ${TF_OPTION_3:+"$TF_OPTION_3"} \
              | tee output.txt
          else
            terraform plan -input=false -no-color -detailed-exitcode -out=plan-$ENVIRONMENT.tfplan \
              ${TF_OPTION_1:+"$TF_OPTION_1"} \
              ${TF_OPTION_2:+"$TF_OPTION_2"} \
              ${TF_OPTION_3:+"$TF_OPTION_3"} \
              | tee output.txt
          fi  

          # 2. Remove some github commands and fluff
          # This removes any line containing "Reading...", "Read complete after", and "Refreshing state...", which are terraform lines spewed out during state reading
          STDOUT="$(grep -v -E '(.*Reading\.\.\..*)|(.*Read complete after.*)|(.*Refreshing state\.\.\..*)' output.txt)"
          
          # Insert cleaned output back into output.txt
          echo "$STDOUT" > output.txt

          # 3. Write to step summary
          cat >> $GITHUB_STEP_SUMMARY <<EOF
          \`\`\`
          ${STDOUT}
          \`\`\`
          EOF

          # 4. Serialize into single-line string for transfer using outputs that only support single line
          STDOUT="${STDOUT//'%'/'%25'}"
          STDOUT="${STDOUT//$'\n'/'%0A'}"
          STDOUT="${STDOUT//$'\r'/'%0D'}"

          # 5. Write output 
          echo "stdout=$STDOUT" >> $GITHUB_OUTPUT

      - name: Upload Plan Artifact
        uses: actions/upload-artifact@v4
        with:
          name: plan-${{ env.ENVIRONMENT }}.tfplan
          path: ${{ env.WORKING_DIRECTORY }}/plan-${{ env.ENVIRONMENT }}.tfplan
          retention-days: 5

      - name: Update Pull Request
        uses: actions/github-script@v7
        if: (always() && inputs.add_comment_on_pr == true && github.event_name == 'pull_request')
        env:
          # Passing via env vars to sanitize untrusted inputs
          VALIDATE_OUTPUT: ${{ steps.validate.outputs.stdout }}
          VALIDATE_OUTCOME: ${{ steps.validate.outcome }}
          FORMAT_OUTCOME: ${{ steps.format.outcome}}
          INIT_OUTCOME: ${{ steps.init.outcome }}
          PLAN_EXITCODE: ${{ steps.plan.outputs.exitcode }}
          PLAN_OUTCOME: ${{ steps.plan.outcome }}
          PLAN_FILE: ${{ env.WORKING_DIRECTORY }}/output.txt

        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const run_url = process.env.GITHUB_SERVER_URL + '/' + process.env.GITHUB_REPOSITORY + '/actions/runs/' + process.env.GITHUB_RUN_ID;
            const run_link = '<a href="' + run_url + '">Actions</a>.'
            const fs = require('fs')
            const plan_file = fs.readFileSync(process.env.PLAN_FILE, 'utf8')
            const plan = plan_file.length > 65000 ? plan_file.toString().substring(0, 65000) + '...' : plan_file
            const truncated_message = plan_file.length > 65000 ? "Output is too long and was truncated. You can read full Plan in " + run_link + "<br /><br />" : ""
            const { data: comments } = await github.rest.issues.listComments({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo
            });

            const {
              ENVIRONMENT,
              PLAN_EXITCODE,
              DEPLOY_ON,
              VALIDATE_OUTPUT,
              FORMAT_OUTCOME,
              INIT_OUTCOME,
              VALIDATE_OUTCOME,
              PLAN_OUTCOME,
              WORKING_DIRECTORY,
            } = process.env;

            /* Body is in the format of
            * <!-- @run-terraform -->
            * <!-- @run-terraform:start:jobid -->
            * Output of job with id jobid
            * <!-- @run-terraform:end:jobid -->
            */
            const bodyStartMarker = '<!-- @run-terraform -->';
            const comment = comments.find(({ body }) => body.startsWith(bodyStartMarker));
            const id = comment?.id;
            let commentBody = comment?.body ?? bodyStartMarker;
            const bodyHasJobInfo = commentBody.includes(`<!-- @run-terraform:start:${ENVIRONMENT} -->`);

            const exitcode = PLAN_EXITCODE;
            const action = {
              0: 'No changes detected. Will not run Terraform apply job',
              1: 'An error occured! Will not run Terraform apply job',
              2: `Changes detected. Will run Terraform apply job on merge to ${DEPLOY_ON}`
            }[exitcode] ?? 'Terraform gave an unknown exit code, I don\'t know what happens next!';

            const jobBody = `<!-- @run-terraform:start:${ENVIRONMENT} -->
            ## Results for ${ENVIRONMENT} ${exitcode === '2' ? '– ❗ `CHANGED` ❗' : ''}
            #### Terraform Format and Style 🖌 \`${FORMAT_OUTCOME}\`
            #### Terraform Initialization ⚙️ \`${INIT_OUTCOME}\`
            #### Terraform Validation 🤖 \`${VALIDATE_OUTCOME}\`
            <details><summary>Validation Output</summary>

            \`\`\`\n
            ${VALIDATE_OUTPUT}
            \`\`\`

            </details>

            #### Terraform Plan 📖 \`${PLAN_OUTCOME}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${plan}
            \`\`\`

            </details>
            ${truncated_message}

            #### Next action 🚀
            ${action}

            *Pusher: @${{ github.actor }}, Working Directory: \`${WORKING_DIRECTORY}\`, Commit: ${{ github.sha }}, Generated at: \`${new Date().toLocaleString('nb')}\`*
            <!-- @run-terraform:end:${ENVIRONMENT} -->`;

            if (bodyHasJobInfo) {
              commentBody = commentBody.replace(
                new RegExp(`<!-- @run-terraform:start:${ENVIRONMENT} -->.*<!-- @run-terraform:end:${ENVIRONMENT} -->`, 's'),
                jobBody,
              );
            } else {
              commentBody += '\n' + jobBody;
            }

            commentBody = commentBody
              .replaceAll("%0A", "\n")
              .replaceAll("%0D", "\n");

            if (id) {
              github.rest.issues.updateComment({
                comment_id: id,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: commentBody
              })
            } else {
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: commentBody
              })
            }

  run_terraform:
    needs: [setup-env, terraform_plan]
    if: ((github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') || (github.ref == inputs.deploy_on || github.ref_name == inputs.deploy_on)) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (needs.terraform_plan.outputs.plan_exitcode == '2' || inputs.destroy == true)
    name: Terraform Apply or Destroy
    runs-on: ${{ inputs.runner }}
    environment: ${{ inputs.environment }}

    # Disallow parallel jobs for same env to allow aquiring state lock instead of crashing
    concurrency: ${{ inputs.environment }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIRECTORY }}

    env:
      # makes some minor adjustments to Terraforms output to de-emphasize specific commands to run
      TF_IN_AUTOMATION: true
      TF_WORKSPACE: ${{ inputs.terraform_workspace }}
      WORKLOAD_IDENTITY_PROVIDER: ${{ needs.setup-env.outputs.WORKLOAD_IDENTITY_PROVIDER }}

    steps:
      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
        id: octo-sts
        if: ${{ inputs.use_platform_modules == true || inputs.checkout_submodules == true}}
        with:
          scope: kartverket
          identity: kartverket_repos
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout_submodules == true && 'recursive' || 'false' }}
          token: ${{ inputs.checkout_submodules == true && steps.octo-sts.outputs.token || github.token }}

      - name: hack for github internal repo access
        if: ${{ inputs.use_platform_modules == true }}
        run: git config --global url."https://x-access-token:${{ steps.octo-sts.outputs.token }}@github.com".insteadOf ssh://git@github.com

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3.1.2
        with:
          terraform_version: ${{ inputs.use_platform_modules == true && '1.6.6' || 'latest' }}

      - name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT }}
          project_id: ${{ env.PROJECT_ID }}

      - name: Set up Cloud SDK
        if: env.KUBERNETES_CLUSTER != ''
        uses: google-github-actions/setup-gcloud@v2

      - name: Authenticate with Kubernetes
        if: env.KUBERNETES_CLUSTER != ''
        run: |
          gcloud components install gke-gcloud-auth-plugin
          gcloud container hub memberships get-credentials $KUBERNETES_CLUSTER --verbosity debug --location global

      - name: Download Plan Artifact
        uses: actions/download-artifact@v4
        with:
          name: plan-${{ env.ENVIRONMENT }}.tfplan
          path: ${{ env.WORKING_DIRECTORY }}

      # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
      - name: Terraform Init
        run: |
          terraform init -input=false \
            ${TF_INIT_OPTION_1:+"$TF_INIT_OPTION_1"} \
            ${TF_INIT_OPTION_2:+"$TF_INIT_OPTION_2"} \
            ${TF_INIT_OPTION_3:+"$TF_INIT_OPTION_3"}

      - name: Check for PostgreSQL Provider
        id: check_postgresql
        run: |
          PROVIDER_CHECK=$(terraform providers | grep cyrilgdn/postgresql) || true
          if [ -n "$PROVIDER_CHECK" ]; then
            echo "PostgreSQL provider found."
            echo "NEED_TAILSCALE=true" >> $GITHUB_ENV
          else
            echo "PostgreSQL provider not found."
            echo "NEED_TAILSCALE=false" >> $GITHUB_ENV
          fi

      - name: Tailscale
        if: env.NEED_TAILSCALE == 'true'
        uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_CLOUDSQL_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_CLOUDSQL_OAUTH_SECRET }}
          tags: tag:cloudsql-user

      # Run terraform destroy on push to main if 'destroy' is set to true
      - name: Terraform Destroy
        if: env.DESTROY == 'true'
        id: destroy
        run: |
          terraform destroy -auto-approve \
            ${TF_OPTION_1:+"$TF_OPTION_1"} \
            ${TF_OPTION_2:+"$TF_OPTION_2"} \
            ${TF_OPTION_3:+"$TF_OPTION_3"}

      - name: Run Terraform
        if: env.DESTROY == 'false'
        run: terraform apply -input=false plan-$ENVIRONMENT.tfplan

      - name: Upload output artifact
        if: ${{ inputs.output_file_path != '' }}
        uses: actions/upload-artifact@v4
        with:
          name: output-file
          path: ${{ inputs.output_file_path }}