terraform-plan-04.yaml

---
name: terraform-plan-04-aws-wireguard-vpn

permissions:
  id-token: write      # for fetching the OIDC token
  contents: read       # for actions/checkout
  pull-requests: write # For dflook comments on PR

on:
  workflow_dispatch:
  pull_request:
    branches:
      - "master"
    paths:
      - "examples/04-aws-wireguard-vpn/**"
      - "modules/wireguard-ec2"
      - ".github/workflows/**04.yaml"

jobs:
  tf-plan:
    runs-on: ubuntu-latest
    name: 04-aws-wireguard-vpn - terraform plan
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
        with:
          role-to-assume: ${{ secrets.OIDC_ROLE_ARN }}
          role-session-name: GithubActionsTerraform
          aws-region: eu-west-1

      - name: Terraform plan
        uses: dflook/terraform-plan@ef228c1f24b8a8e3e9f96e0e98a7e7f0c5d27e12 # v1
        with:
          path: examples/04-aws-wireguard-vpn