base-terragrunt-plan.yml

name: "Terragrunt plan base"

on:
  workflow_dispatch:
  pull_request:
    paths:
      - ".github/workflows/base-terragrunt-plan.yml"
      - "terragrunt/*/base/**"
      - "terragrunt/*/common/**"
      - "terragrunt/env/terragrunt.hcl"

env:
  AWS_REGION: ca-central-1
  CONFTEST_VERSION: 0.27.0
  TERRAFORM_VERSION: 1.1.9
  TERRAGRUNT_VERSION: 0.36.7
  TF_INPUT: false

permissions:
  id-token: write
  contents: read
  pull-requests: write
  actions: write
  checks: write
  statuses: write

jobs:
  terragrunt-plan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Setup Terraform tools
        uses: cds-snc/terraform-tools-setup@v1

      - uses: cds-snc/paths-filter@b316143212d841aed668b7b29240c719d603a9b9 # v2.10.4
        id: filter
        with:
          filters: |
            base:
              - 'terragrunt/aws/base/**'
              - 'terragrunt/env/base/**'
            common:
              - '.github/workflows/base-terragrunt-plan.yml'
              - 'terragrunt/env/common/**'
              - 'terragrunt/env/terragrunt.hcl'

      - name: configure aws credentials using OIDC
        uses: aws-actions/configure-aws-credentials@master
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/security-tools-plan
          role-session-name: TFPlan
          aws-region: ${{ env.AWS_REGION }}

      - name: Terragrunt plan base
        if: ${{ steps.filter.outputs.base == 'true' || steps.filter.outputs.common == 'true' }}
        uses: cds-snc/terraform-plan@4719878d72d1b0078e0bce2e7571e854e79903b8 # v3.2.2
        with:
          directory: "terragrunt/env/base"
          comment-delete: "true"
          comment-title: "base"
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          terragrunt: "true"