terraform-infra-set-up.yaml

name: "Create Infrastrucutre via Terraform"
on:
  workflow_call:
    inputs:
      terraform-dir:
        type: string
        required: true
        description: The directory which contains terraform configuration used to create infrastrucutre.
      terraform-plan-name:
        type: string
        required: false
        default: terraform.tfplan
        description: The terraform plan name used to create artifact and in apply job.
      terraform-version:
        type: string
        required: false
        default: 1.5.4
        description: The terraform version used for the github action.
      runner:
        type: string
        required: false
        default: ubuntu-latest
        description: The Github action runner OS , on which the action runs.
      cache-hash-file:
        type: string
        required: false
        default: '/providers.tf'
        description: The file used to create common hash cache naming.

env:
  ##? To disable local development, not create SSH rule from the host.
  TF_VAR_ENABLE_LOCAL_DEVELOPMENT: false
  TERRAFORM_PLAN_NAME: "{{ inputs.terraform-plan-name }}"
  ##? https://developer.hashicorp.com/terraform/cli/config/environment-variables
  TF_PLUGIN_CACHE_DIR: "${{ github.workspace }}/.terraform-plugin-cache"
  TF_IN_AUTOMATION: true
  TF_INPUT: false

  ## Azure Secrets
  ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
  ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
  ARM_SUBSCRIPTION_ID: ${{ vars.ARM_SUBSCRIPTION_ID }}

jobs:
  codeScanning:
    name: IaC Scanning with tfsec Stage
    runs-on: "${{ inputs.runner }}"
    steps:
      - name: checkout the repository
        uses: actions/checkout@v3

      - name: tfsec pull request commentor if found vulnerabilities
        if: ${{ github.event_name == 'pull_request' }}
        uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
        id: tfsec-pr-commenter
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          working_directory: "${{ github.workspace }}/${{ inputs.terraform-dir }}"

      - name: IaC Security Scanning with tfsec
        uses: aquasecurity/tfsec-action@v1.0.3
        id: tfsec
        with:
          working_directory: "${{ github.workspace }}/${{ inputs.terraform-dir }}"

  deploymentPLan:
    name: Terraform webservers deployment Plan Stage
    runs-on: ${{ inputs.runner }}
    needs: codeScanning
    outputs:
      exitCode: ${{ steps.plan.outputs.exitcode }}

    steps:
      - name: checkout the repository
        uses: actions/checkout@v3

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ inputs.terraform-version }}

      - uses: actions/cache@v3
        name: "Terraform cache"
        id: cache
        with:
          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
          key: ${{ runner.os }}-${{ inputs.terraform-dir }}-${{ hashFiles(format('{0}/{1}', inputs.terraform-dir , inputs.cache-hash-file)) }}

      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        name: Create TF_PLUGIN_CACHE_DIR
        shell: bash
        run: mkdir -p ${{ env.TF_PLUGIN_CACHE_DIR }}

      - name: Terraform init and plan
        shell: bash
        id: plan
        working-directory: "${{ github.workspace }}/${{ inputs.terraform-dir }}"
        run: |
          terraform init
          terraform validate
          terraform plan -out "${{ inputs.terraform-plan-name }}" -detailed-exitcode

      - name: Upload Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: "${{ inputs.terraform-plan-name }}"
          path: "${{ github.workspace }}/${{ inputs.terraform-dir }}/${{ inputs.terraform-plan-name }}"

  deploymentApply:
    if: ${{ !cancelled() && !failure() && needs.deploymentPLan.outputs.exitCode == 2 }}
    name: Terraform webservers deployment Apply Stage
    runs-on: ${{ inputs.runner }}
    needs: deploymentPLan
    steps:
      - name: checkout the repository
        uses: actions/checkout@v3

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ inputs.terraform-version }}

      - uses: actions/download-artifact@v3
        with:
          name: "${{ inputs.terraform-plan-name }}"
          path: "${{ github.workspace }}/${{ inputs.terraform-dir }}"

      - uses: actions/cache@v3
        name: "Terraform cache"
        id: cache
        with:
          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
          key: ${{ runner.os }}-${{ inputs.terraform-dir }}-${{ hashFiles(format('{0}/{1}', inputs.terraform-dir , inputs.cache-hash-file)) }}

      - name: "Terraform Apply"
        shell: bash
        working-directory: "${{ github.workspace }}/${{ inputs.terraform-dir }}"
        run: |
          terraform init
          terraform apply "${{ inputs.terraform-plan-name }}"