publish-terraform.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Publish Terraform"

on:
  workflow_dispatch:
  push:
    branches: ["main"]
    paths: ["terraform/**"]

jobs:
  publish-terraform:
    name: Publish Terraform
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Get Secrets
        uses: bitwarden/sm-action@v2
        with:
          access_token: ${{ secrets.BW_ACCESS_TOKEN }}
          secrets: |
            e062dcb9-8cd7-471e-b9be-b10100497102 > BOT_APP_ID
            5856238d-3fae-4a0f-9847-b1010049f697 > BOT_APP_PRIVATE_KEY

      - name: Generate Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: "${{ env.BOT_APP_ID }}"
          private-key: "${{ env.BOT_APP_PRIVATE_KEY }}"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: "${{ steps.app-token.outputs.token }}"

      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Setup Workflow Tools
        shell: bash
        run: brew install fluxcd/tap/flux

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: Lowercase repository owner
        shell: bash
        run: |
          echo "LOWERCASE_REPO_OWNER=${GITHUB_REPOSITORY_OWNER,,}" >> "${GITHUB_ENV}"

      - name: Generate Tag
        id: generate-tag
        shell: bash
        run: |
          echo "tag=ghcr.io/${LOWERCASE_REPO_OWNER}/manifests/terraform:$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"

      - name: Publish OCI Artifact
        shell: bash
        run: |
          flux push artifact oci://${{ steps.generate-tag.outputs.tag }} \
              --path="./terraform" \
              --source="$(git config --get remote.origin.url)" \
              --revision="$(git branch --show-current)/$(git rev-parse HEAD)"

      - name: Tag OCI Artifact
        shell: bash
        run: |
          flux tag artifact \
              oci://${{ steps.generate-tag.outputs.tag }} \
              --tag main