publish-terraform.yaml

---
  name: Publish Terraform

  on:
    workflow_dispatch:
    push:
      branches: ["main"]
      paths: ["terraform/**"]

  env:
    TERRAFORM_DIR: ./terraform

  jobs:
    publish-terraform:
      name: Publish Terraform
      runs-on: ubuntu-latest
      permissions:
        contents: read
        packages: write
      steps:
        - name: Generate Token
          uses: actions/create-github-app-token@78e5f2ddc08efcb88fbbee6cfa3fed770ba550c3 # v1.9.1
          id: app-token
          with:
            app-id: "${{ secrets.BOT_APP_ID }}"
            private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

        - name: Setup Path
          run: echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH

        - name: Setup Workflow Tools
          run: brew update && brew install fluxcd/tap/flux

        - name: Checkout
          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
          with:
            token: "${{ steps.app-token.outputs.token }}"

        - name: Login to GitHub Container Registry
          uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
          with:
            registry: ghcr.io
            username: "${{ github.actor }}"
            password: "${{ secrets.GITHUB_TOKEN }}"
            # https://github.com/orgs/community/discussions/24636
            # username: "${{ secrets.BOT_APP_ID }}"
            # password: "${{ steps.app-token.outputs.token }}"

        - name: Generate Tag
          id: generate-tag
          shell: bash
          run: echo "tag=ghcr.io/${{ github.repository_owner }}/manifests/terraform:$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"

        - name: Publish OCI Artifacts
          shell: bash
          run: |
            flux push artifact oci://${{ steps.generate-tag.outputs.tag }} \
                --path="${{ env.TERRAFORM_DIR }}" \
                --source="$(git config --get remote.origin.url)" \
                --revision="$(git branch --show-current)/$(git rev-parse HEAD)"

        - name: Tag OCI Artifact
          shell: bash
          run: flux tag artifact oci://${{ steps.generate-tag.outputs.tag }} --tag master