terraform.yaml

name: Terraform Deploy
on:
  push:
    branches:
      - master
    paths:
      - 'infra/**'
      - .github/workflows/terraform.yaml
permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout
jobs:
  plan-and-approve:
    runs-on: ubuntu-latest
    env:
      AWS_REGION: sa-east-1
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v3.0.1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ env.AWS_REGION }}
      - name: install terraform
        uses: hashicorp/setup-terraform@v2
      - name: checkout repository
        uses: actions/checkout@v3
        with:
          submodules: 'true'
      - name: terraform init
        run: terraform init
        working-directory: infra
      - name: terraform plan
        run: terraform plan
        working-directory: infra
  execute-plan:
    runs-on: ubuntu-latest
    needs: plan-and-approve
    environment: production # This is required for the approval step
    env:
      AWS_REGION: sa-east-1
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v3.0.1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ env.AWS_REGION }}
      - name: install terraform
        uses: hashicorp/setup-terraform@v2
      - name: checkout repository
        uses: actions/checkout@v3
        with:
          submodules: 'true'
      - name: terraform init
        run: terraform init
        working-directory: infra
      - name: terraform apply
        run: terraform apply -auto-approve
        working-directory: infra