From 349f967fc0d511df96ac04bbb4b2b746abcfa98d Mon Sep 17 00:00:00 2001
From: Damien Arnodo <damien@noreply.localhost>
Date: Mon, 8 Dec 2025 16:26:26 +0000
Subject: [PATCH] feat(ci): create dedicated PR workflow for Terraform

- Separate workflow for pull_request events only
- No Apply job visible in PR checks
- Simplified checkout using gitea.head_ref directly

Refs #3
---
 .gitea/workflows/terraform-pr.yml | 138 ++++++++++++++++++++++++++++++
 1 file changed, 138 insertions(+)
 create mode 100644 .gitea/workflows/terraform-pr.yml

diff --git a/.gitea/workflows/terraform-pr.yml b/.gitea/workflows/terraform-pr.yml
new file mode 100644
index 0000000..4de7c9c
--- /dev/null
+++ b/.gitea/workflows/terraform-pr.yml
@@ -0,0 +1,138 @@
+name: Terraform PR
+
+on:
+  pull_request:
+    branches:
+      - dev
+    paths:
+      - 'terraform/**'
+      - '.gitea/workflows/terraform-*.yml'
+
+env:
+  TF_WORKING_DIR: terraform/prod
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  TF_VAR_proxmox_url: ${{ secrets.PROXMOX_URL }}
+  TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }}
+  TF_VAR_tailscale_auth_key: ${{ secrets.TAILSCALE_AUTH_KEY }}
+  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: self-hosted
+    container:
+      image: gitea.arnodo.fr/damien/terraform-ci:latest
+    steps:
+      - name: Checkout
+        run: |
+          git clone --depth 1 --branch "${{ gitea.head_ref }}" https://${GIT_TOKEN}@gitea.arnodo.fr/${{ gitea.repository }}.git .
+
+      - name: Terraform Format Check
+        id: fmt
+        run: terraform fmt -check -recursive -diff
+        working-directory: ${{ env.TF_WORKING_DIR }}
+        continue-on-error: true
+
+      - name: TFLint
+        id: lint
+        run: tflint --recursive --format compact
+        working-directory: ${{ env.TF_WORKING_DIR }}
+        continue-on-error: true
+
+      - name: Terraform Init
+        id: init
+        run: terraform init -input=false
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Validate
+        id: validate
+        run: terraform validate -no-color
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Validation Summary
+        if: always()
+        run: |
+          echo "## Validation Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Format | ${{ steps.fmt.outcome == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| TFLint | ${{ steps.lint.outcome == 'success' && '✅' || '⚠️' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Init | ${{ steps.init.outcome == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Validate | ${{ steps.validate.outcome == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
+
+      - name: Check Validation Status
+        if: steps.fmt.outcome == 'failure' || steps.init.outcome == 'failure' || steps.validate.outcome == 'failure'
+        run: exit 1
+
+  plan:
+    name: Plan
+    runs-on: self-hosted
+    container:
+      image: gitea.arnodo.fr/damien/terraform-ci:latest
+    needs: validate
+    steps:
+      - name: Checkout
+        run: |
+          git clone --depth 1 --branch "${{ gitea.head_ref }}" https://${GIT_TOKEN}@gitea.arnodo.fr/${{ gitea.repository }}.git .
+
+      - name: Terraform Init
+        run: terraform init -input=false
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Plan
+        id: plan
+        run: |
+          set +e
+          terraform plan -input=false -no-color -detailed-exitcode -out=tfplan 2>&1 | tee plan_output.txt
+          EXITCODE=$?
+          echo "exitcode=${EXITCODE}" >> $GITHUB_OUTPUT
+          if [ $EXITCODE -eq 1 ]; then
+            exit 1
+          fi
+          exit 0
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Plan Summary
+        if: always()
+        run: |
+          echo "## Terraform Plan" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Exit code:** \`${{ steps.plan.outputs.exitcode }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- \`0\` = No changes" >> $GITHUB_STEP_SUMMARY
+          echo "- \`2\` = Changes detected" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          cat plan_output.txt >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Comment PR with Plan
+        if: always()
+        run: |
+          PLAN_OUTPUT=$(cat plan_output.txt | head -c 60000)
+          COMMENT_BODY=$(cat <<EOF
+          ## 🔍 Terraform Plan
+          
+          **Exit code:** \`${{ steps.plan.outputs.exitcode }}\`
+          - \`0\` = No changes
+          - \`2\` = Changes detected
+          
+          <details>
+          <summary>Click to expand plan output</summary>
+          
+          \`\`\`hcl
+          ${PLAN_OUTPUT}
+          \`\`\`
+          
+          </details>
+          EOF
+          )
+          
+          curl -s -X POST \
+            -H "Authorization: token ${GIT_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')" \
+            "https://gitea.arnodo.fr/api/v1/repos/${{ gitea.repository }}/issues/${{ gitea.event.pull_request.number }}/comments"
+        working-directory: ${{ env.TF_WORKING_DIR }}