check_terraform.yaml

name: Check Terraform infrastructure
on:
  pull_request:
    paths:
      - terraform/subscriptions/**

permissions:
  id-token: write
  contents: read

jobs:
  terrform:
    name: Check infrastructure consistency
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - name: "dev"
            folderName: "dev"
            subscription: "s941"
          - name: "playground"
            folderName: "playground"
            subscription: "s941"
          - name: "platform"
            folderName: "prod"
            subscription: "s940"
          - name: "c2"
            folderName: "c2"
            subscription: "s940"
    environment: ${{matrix.target.name }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4 #Clone Repo

      - name: 'Az login'
        uses: azure/login@v2
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

      - name: Get GitHub Public IP
        id: github_public_ip
        run: echo "ipv4=$(curl 'https://ifconfig.me/ip')" >> $GITHUB_OUTPUT

      - name: Add GitHub IP to StorageAccount
        id: update_firewall
        run: |
          az storage account network-rule add \
            --resource-group "${{ matrix.target.subscription }}-tfstate" \
            --account-name "${{ matrix.target.subscription }}radixinfra" \
            --ip-address ${{ steps.github_public_ip.outputs.ipv4 }} >/dev/null

      - name: Lets sleep for 30 seconds for FW rule to complete
        run: sleep 30s

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 'latest'

      - name: Check Terraform in ${{ matrix.target.name}}
        working-directory: terraform/subscriptions/scripts
        shell: bash
        env:
          ARM_USE_OIDC: true
          ARM_USE_AZUREAD: true
          ARM_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
          SUBSCRIPTION: ${{ matrix.target.subscription}}
          ENVIRONMENT: ${{matrix.target.folderName}}
        run: ./terraform.sh

      - name: Revoke GitHub IP on StorageAccount
        if: ${{ steps.update_firewall.outcome == 'success' && !cancelled()}} # Always run this step even if previous step failed
        run: |
          az storage account network-rule remove \
            --resource-group "${{ matrix.target.subscription }}-tfstate" \
            --account-name "${{ matrix.target.subscription }}radixinfra" \
            --ip-address ${{ steps.github_public_ip.outputs.ipv4 }} >/dev/null