iac-homelab/.gitea/workflows/terraform-deploy.yml

name: Terraform Deploy

on:
  push:
    branches:
      - dev
    paths:
      - "terraform/**"
      - ".gitea/workflows/terraform-*.yml"

env:
  TF_WORKING_DIR: terraform/prod
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  TF_VAR_proxmox_url: ${{ secrets.PROXMOX_URL }}
  TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }}
  TF_VAR_proxmox_ssh_private_key: ${{ secrets.PROXMOX_SSH_PRIVATE_KEY }}
  TF_VAR_admin_ssh_public_key: ${{ secrets.ADMIN_SSH_PUBLIC_KEY }}
  TF_VAR_tailscale_auth_key: ${{ secrets.TAILSCALE_AUTH_KEY }}
  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}

jobs:
  validate:
    name: Validate
    runs-on: self-hosted
    container:
      image: gitea.arnodo.fr/damien/terraform-ci:latest
    steps:
      - name: Checkout
        run: |
          git clone --depth 1 --branch "${{ gitea.ref_name }}" https://${GIT_TOKEN}@gitea.arnodo.fr/${{ gitea.repository }}.git .

      - name: Terraform Format Check
        id: fmt
        run: terraform fmt -check -recursive -diff
        working-directory: ${{ env.TF_WORKING_DIR }}
        continue-on-error: true

      - name: TFLint
        id: lint
        run: tflint --recursive --format compact
        working-directory: ${{ env.TF_WORKING_DIR }}
        continue-on-error: true

      - name: Terraform Init
        id: init
        run: terraform init -input=false
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Validation Summary
        if: always()
        run: |
          echo "## Validation Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Format | ${{ steps.fmt.outcome == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| TFLint | ${{ steps.lint.outcome == 'success' && '✅' || '⚠️' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Init | ${{ steps.init.outcome == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Validate | ${{ steps.validate.outcome == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY

      - name: Check Validation Status
        if: steps.fmt.outcome == 'failure' || steps.init.outcome == 'failure' || steps.validate.outcome == 'failure'
        run: exit 1

  plan:
    name: Plan
    runs-on: self-hosted
    container:
      image: gitea.arnodo.fr/damien/terraform-ci:latest
    needs: validate
    outputs:
      has_changes: ${{ steps.plan.outputs.has_changes }}
    steps:
      - name: Checkout
        run: |
          git clone --depth 1 --branch "${{ gitea.ref_name }}" https://${GIT_TOKEN}@gitea.arnodo.fr/${{ gitea.repository }}.git .

      - name: Terraform Init
        run: terraform init -input=false
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Plan
        id: plan
        run: |
          set +e
          terraform plan -input=false -no-color -detailed-exitcode -out=tfplan > plan_output.txt 2>&1
          EXITCODE=$?
          cat plan_output.txt

          # Determine if there are changes
          if [ $EXITCODE -eq 2 ]; then
            echo "has_changes=true" >> $GITHUB_OUTPUT
          else
            echo "has_changes=false" >> $GITHUB_OUTPUT
          fi

          # Exit 1 is error, 0 and 2 are OK
          if [ $EXITCODE -eq 1 ]; then
            exit 1
          fi
          exit 0
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Plan Summary
        if: always()
        run: |
          echo "## Terraform Plan" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Has changes:** \`${{ steps.plan.outputs.has_changes }}\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          cat plan_output.txt >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
        working-directory: ${{ env.TF_WORKING_DIR }}

  apply:
    name: Apply
    runs-on: self-hosted
    container:
      image: gitea.arnodo.fr/damien/terraform-ci:latest
    needs: plan
    if: needs.plan.outputs.has_changes == 'true'
    steps:
      - name: Checkout
        run: |
          git clone --depth 1 --branch "${{ gitea.ref_name }}" https://${GIT_TOKEN}@gitea.arnodo.fr/${{ gitea.repository }}.git .

      - name: Terraform Init
        run: terraform init -input=false
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Apply
        run: |
          terraform plan -input=false -out=tfplan
          terraform apply -input=false -auto-approve tfplan
        working-directory: ${{ env.TF_WORKING_DIR }}

      - name: Apply Summary
        if: always()
        run: |
          echo "## ✅ Terraform Apply Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Infrastructure has been updated successfully." >> $GITHUB_STEP_SUMMARY