organisation-security-plan.yml

name: terraform plan (organisation-security)

on:
  pull_request:
    paths:
      - 'organisation-security/terraform/**'
      - 'modules/**'
      - '.github/workflows/organisation-security-plan.yml'
      - '.github/workflows/organisation-security-apply.yml'
  workflow_dispatch:

jobs:
  plan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    defaults:
      run:
        working-directory: ./organisation-security/terraform
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: arn:aws:iam::${{secrets.AWS_SECURITY_ACCOUNT_ID}}:role/github-actions-plan
          role-session-name: GitHubActions
          aws-region: eu-west-2
      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          terraform_version: 1.5.2
      - run: terraform fmt -check
        continue-on-error: true
      - run: terraform init
      - run: terraform validate -no-color
      - run: terraform plan -no-color