chore: migrate tooling to Ruff, expand CI, add Makefile and IaC workf… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform Plan on PR | |
| on: | |
| pull_request: | |
| paths: | |
| - 'infra/**' | |
| - '.github/workflows/iac-plan.yml' | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| id-token: write # For OIDC auth to cloud providers | |
| env: | |
| TERRAFORM_VERSION: "1.7.0" | |
| TF_WORKING_DIR: "infra" | |
| jobs: | |
| plan: | |
| name: Terraform Plan | |
| runs-on: ubuntu-latest | |
| environment: staging | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: ${{ env.TERRAFORM_VERSION }} | |
| # ── Authenticate to your cloud provider ── | |
| # Uncomment the section for your provider: | |
| # AWS (OIDC - recommended) | |
| # - name: Configure AWS credentials | |
| # uses: aws-actions/configure-aws-credentials@v4 | |
| # with: | |
| # role-to-assume: ${{ secrets.AWS_ROLE_ARN }} | |
| # aws-region: us-east-1 | |
| # GCP (OIDC - recommended) | |
| # - name: Authenticate to GCP | |
| # uses: google-github-actions/auth@v2 | |
| # with: | |
| # workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY }} | |
| # service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} | |
| - name: Terraform Init | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: terraform init | |
| - name: Terraform Plan | |
| id: plan | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: | | |
| terraform plan -no-color -out=tfplan 2>&1 | tee plan-output.txt | |
| continue-on-error: true | |
| - name: Post plan to PR | |
| uses: actions/github-script@v7 | |
| if: github.event_name == 'pull_request' | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const plan = fs.readFileSync('${{ env.TF_WORKING_DIR }}/plan-output.txt', 'utf8'); | |
| const truncated = plan.length > 60000 | |
| ? plan.substring(0, 60000) + '\n\n... (truncated)' | |
| : plan; | |
| const body = `## Terraform Plan Output | |
| \`\`\`hcl | |
| ${truncated} | |
| \`\`\` | |
| **Plan exit code:** \`${{ steps.plan.outcome }}\` | |
| > Review the plan carefully before approving.`; | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); | |
| - name: Fail on plan error | |
| if: steps.plan.outcome == 'failure' | |
| run: exit 1 |