jim80net/add-terraform-plan-to-prs.yml

## add-terraform-plan-to-prs.yml
name: Add Terraform Plan to Pull Requests

on:
  pull_request:

env:
  # See page below about disabling Hashicorp Upgrade and Security Checks
  # https://www.terraform.io/docs/commands/index.html#upgrade-and-security-bulletin-checks
  CHECKPOINT_DISABLE: true

jobs:
  terraform-plan:
    strategy:
      fail-fast: false
      max-parallel: 64
      matrix:
        # To refresh, use ruby -e 'puts Dir.glob("**/main.tf").reject {|x| x.include?("module")}.sort.map {|s| %Q[            "#{s.gsub("/main.tf", "\",")}]};'
        directory:
          [
            "path/to/root/module",
            "path/to/other/module"
          ]
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ matrix.directory }}
    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
    permissions:
      actions: read # read artifacts
      id-token: write # get oidc token
      contents: read # read artifacts
      pull-requests: write # for listing and writing comments
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Set outputs
        id: vars
        uses: actions/github-script@v4
        env:
          WORKING_DIRECTORY: ${{ matrix.directory }}
        with:
          script: |
            const { WORKING_DIRECTORY } = process.env
            core.setOutput('directory_slug', WORKING_DIRECTORY.replace(/[^a-zA-Z0-9]/g, '-'))

      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: us-east-1
          role-to-assume: arn:aws:iam::12345:role/my-federated-gha-role


      - name: Install tfenv
        working-directory: "${{ github.workspace }}"
        run: |
          mkdir -p $HOME/.tfenv
          cd $HOME/.tfenv
          # download
          wget https://github.com/tfutils/tfenv/archive/v2.2.2.tar.gz
          # verify that it's legit
          echo "ac7f74d8a0151e36a539ceae1460b320ec7b98b360dbd7799dc7cdbdf8c06ded  v2.2.2.tar.gz" | sha256sum --check --strict
          # install
          tar -zxvf v2.2.2.tar.gz
          echo "$(pwd)/tfenv-2.2.2/bin" >> $GITHUB_PATH

      - name: set terraform version
        run: tfenv use || tfenv install && tfenv use

      - name: terraform init
        run: terraform init --upgrade

      - name: terraform validate
        run: terraform validate

      - name: terraform plan
        run: |
          terraform plan -no-color  -out tf.plan -lock=false| \
            egrep -v 'Refreshing state|no actions|already matches the changes detected above|refresh-only|actions to undo or respond|Refreshing|refreshed|ignore_changes|did not detect any differences|As a result, no|actions need to be performed|persisted|Unless you have made equivalent changes' | \
            tee -a plan_output.txt

      - name: Upload plan to S3
        run: |
          aws s3 cp tf.plan s3://my-gha-support-bucket/github-actions/plans/${{ github.sha }}-${{ matrix.directory }}/tf.plan

      - name: Are my changes from git or drift
        id: drift
        if: always()
        run: |
          git fetch --depth 1 origin master
          tf_change_count=$(git diff origin/master --dirstat=files,0 | grep -c ${{ matrix.directory }} || :)
          if [[ $tf_change_count -lt 1 ]]; then
            echo "::set-output name=drift::true"
          else
            echo "::set-output name=drift::false"
          fi

      - name: report on pr
        uses: actions/github-script@v5
        if: always()
        with:
          script: |
            const fs = require('fs');

            const myDirectory = '${{ matrix.directory }}';
            const isDrift = ${{ steps.drift.outputs.drift }};

            function readFile(filename) {
              try {
                return fs.readFileSync(`${myDirectory}/${filename}`, 'utf8');
              } catch {
                return 'ERROR reading plan output. See the run for more details'
              }
            }

            // If this is drift, then we need to find the comment that is the drift comment
            const identifier = (isDrift) ? 'isDrift' : myDirectory;
            function ismyPreviousComment(comment) {
              return comment.body.includes(`<div id="${identifier}"`) && comment.user.login == 'github-actions[bot]';
            }

            // Get all the previous comments
            const previousComments = await github.rest.issues.listComments({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
            })
            core.info(`Found ${previousComments.data.length} comments`);

            // Find my comment
            let myPreviousComment;
            // ES5 doesn't support Array.prototype.find()
            for (const comment of previousComments.data) {
              if (ismyPreviousComment(comment)) {
                myPreviousComment = comment;
              }
            }

            // My plan output
            const planOutput = readFile('plan_output.txt'); // the plan output

            // Build the summary line
            const planLineRe = /Plan: (\d+) to add, (\d+) to change, (\d+) to destroy/g;
            const search = [...planOutput.matchAll(planLineRe)];
            const theFirstResult = search[0];
            const theNewPlanOneLiner = (theFirstResult) ? theFirstResult[0] : false;
            const resourcesAreBeingDeleted = (theFirstResult) ? parseInt(theFirstResult[3]) > 0 : false;
            const summaryColor = (resourcesAreBeingDeleted) ? 'red' : 'black';
            const summaryText = (theNewPlanOneLiner)
              ? `<p style="color:${summaryColor};">${theNewPlanOneLiner}</p>`
              : '<p style="color:SeaGreen;">No changes. Infrastructure up to date</p>';

            // Build the call to action
            const actionText =
              'curl -X POST -H "Authorization: Token $GITHUB_TOKEN" ' +
              'https://api.github.com/repos/SlideShareCorp/terraform/actions/workflows/11869138/dispatches ' +
              `-d \'{"ref": "master", "inputs": {"sha": "${context.sha}", "directory": "${myDirectory}", "issue": "${context.issue.number}"}}\'`

            // Build the section
            const mySection = `<div id="${myDirectory}">
            <h2><code>${myDirectory}</code></h2>
            <summary>${summaryText}</summary>
            <details>

            \`\`\`
            ${planOutput}
            \`\`\`

            </details>

            In order to execute this plan, run the following:
            \`\`\`
            ${actionText}
            \`\`\`
            </div><!-- closing ${myDirectory} -->`;


            function trimBody(body) {
              if (body.length > 65536) {
                // remove the Details if the body is too long
                const re = new RegExp('<details>.*</details>', 'gms');
                return body.replace(re, "Details have been removed to meet max character limits for comments. Please run in your terminal.");
              } else {
                return body;
              }
            }

            const mySectionRegex = new RegExp(`<div id="${myDirectory}">.*</div><!-- closing ${myDirectory} -->`, 'gms');
            const mySectionAlreadyInmyPreviousComment = (myPreviousComment) ? mySectionRegex.test(myPreviousComment.body) : false;

            function addMySectionToDrift() {
              let body = myPreviousComment.body;
              if (mySectionAlreadyInmyPreviousComment) {
                body = body.replace(mySectionRegex, mySection);
              } else {
                const lastLine = new RegExp('</div>$');
                body = body.replace(lastLine, mySection + '</div>');
              }
              return body;
            }

            // MAIN
            if (theNewPlanOneLiner) {
              core.info(`Found a plan with changes: ${theNewPlanOneLiner}`);
              if (myPreviousComment) {
                core.info('Updating my previous comment.');
                const body = (isDrift) ? addMySectionToDrift() : mySection;
                github.rest.issues.updateComment({
                  comment_id: myPreviousComment.id,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  body: body,
                })
              } else {
                core.info('Creating a new comment.');
                const body = (isDrift)
                  ? '<div id="isDrift"><h1>Drift Detection</h1>' + mySection + '</div>'
                  : mySection;
                github.rest.issues.createComment({
                  issue_number: context.issue.number,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  body: trimBody(body),
                })
              }
            }

## apply-terraform-workflow-dispatch.yml
name: Apply Terraform

on:
  workflow_dispatch:
    inputs:
      directory:
        description: "terraform directory to trigger"
        required: true
        default: ""
      sha:
        description: "git sha of the generated plan"
        required: true
        default: ""
      issue:
        description: "The issue that will be updated with the results of the run"
        required: false
        default: ""
env:
  # See page below about disabling Hashicorp Upgrade and Security Checks
  # https://www.terraform.io/docs/commands/index.html#upgrade-and-security-bulletin-checks
  CHECKPOINT_DISABLE: true

jobs:
  terraform-apply:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.TERRAFORM_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.TERRAFORM_AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Download plan
        run: |
          aws s3 cp s3://my-terraform-bucket/github-actions/plans/${{ github.event.inputs.sha }}-${{ github.event.inputs.directory }}/tf.plan ${{ github.event.inputs.directory }}/tf.plan

      - name: Install tfenv
        working-directory: "${{ github.workspace }}"
        run: |
          mkdir -p $HOME/.tfenv
          cd $HOME/.tfenv
          # download
          wget https://github.com/tfutils/tfenv/archive/v2.2.2.tar.gz
          # verify that it's legit
          echo "ac7f74d8a0151e36a539ceae1460b320ec7b98b360dbd7799dc7cdbdf8c06ded  v2.2.2.tar.gz" | sha256sum --check --strict
          # install
          tar -zxvf v2.2.2.tar.gz
          echo "$(pwd)/tfenv-2.2.2/bin" >> $GITHUB_PATH

      - name: Terraform Apply
        env:
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        id: apply
        run: |
          cd ${{ github.event.inputs.directory }} && \
            (tfenv use || tfenv install && tfenv use) && \
            terraform init && \
            terraform apply -no-color tf.plan 2>&1 | tee -a apply.out

      - name: report
        uses: actions/github-script@v4
        if: "${{ github.event.inputs.issue }}"
        with:
          script: |
            const fs = require('fs');
            const applyData = fs.readFileSync(`${context.payload.inputs.directory}/apply.out`, 'utf8');
            const changes = `<summary>Changes Applied.</summary>
            <details>

            \`\`\`
            ${applyData}
            \`\`\`

            </details>`;

            const mySection = `<div id="${ context.payload.inputs.directory }">
              <h2><code>${ context.payload.inputs.directory }</code></h2>
              ${changes}
              </div><!-- closing ${ context.payload.inputs.directory } -->`;

            github.issues.createComment({
              issue_number: context.payload.inputs.issue,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: mySection,
            });
	name: Add Terraform Plan to Pull Requests

	on:
	pull_request:

	env:
	# See page below about disabling Hashicorp Upgrade and Security Checks
	# https://www.terraform.io/docs/commands/index.html#upgrade-and-security-bulletin-checks
	CHECKPOINT_DISABLE: true

	jobs:
	terraform-plan:
	strategy:
	fail-fast: false
	max-parallel: 64
	matrix:
	# To refresh, use ruby -e 'puts Dir.glob("**/main.tf").reject {\|x\| x.include?("module")}.sort.map {\|s\| %Q[ "#{s.gsub("/main.tf", "\",")}]};'
	directory:
	[
	"path/to/root/module",
	"path/to/other/module"
	]
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: ${{ matrix.directory }}
	# These permissions are needed to interact with GitHub's OIDC Token endpoint.
	permissions:
	actions: read # read artifacts
	id-token: write # get oidc token
	contents: read # read artifacts
	pull-requests: write # for listing and writing comments
	steps:
	- name: Checkout
	uses: actions/checkout@v2
	- name: Set outputs
	id: vars
	uses: actions/github-script@v4
	env:
	WORKING_DIRECTORY: ${{ matrix.directory }}
	with:
	script: \|
	const { WORKING_DIRECTORY } = process.env
	core.setOutput('directory_slug', WORKING_DIRECTORY.replace(/[^a-zA-Z0-9]/g, '-'))

	- name: Configure AWS
	uses: aws-actions/configure-aws-credentials@v1
	with:
	aws-region: us-east-1
	role-to-assume: arn:aws:iam::12345:role/my-federated-gha-role


	- name: Install tfenv
	working-directory: "${{ github.workspace }}"
	run: \|
	mkdir -p $HOME/.tfenv
	cd $HOME/.tfenv
	# download
	wget https://github.com/tfutils/tfenv/archive/v2.2.2.tar.gz
	# verify that it's legit
	echo "ac7f74d8a0151e36a539ceae1460b320ec7b98b360dbd7799dc7cdbdf8c06ded v2.2.2.tar.gz" \| sha256sum --check --strict
	# install
	tar -zxvf v2.2.2.tar.gz
	echo "$(pwd)/tfenv-2.2.2/bin" >> $GITHUB_PATH

	- name: set terraform version
	run: tfenv use \|\| tfenv install && tfenv use

	- name: terraform init
	run: terraform init --upgrade

	- name: terraform validate
	run: terraform validate

	- name: terraform plan
	run: \|
	terraform plan -no-color -out tf.plan -lock=false\| \
	egrep -v 'Refreshing state\|no actions\|already matches the changes detected above\|refresh-only\|actions to undo or respond\|Refreshing\|refreshed\|ignore_changes\|did not detect any differences\|As a result, no\|actions need to be performed\|persisted\|Unless you have made equivalent changes' \| \
	tee -a plan_output.txt

	- name: Upload plan to S3
	run: \|
	aws s3 cp tf.plan s3://my-gha-support-bucket/github-actions/plans/${{ github.sha }}-${{ matrix.directory }}/tf.plan

	- name: Are my changes from git or drift
	id: drift
	if: always()
	run: \|
	git fetch --depth 1 origin master
	tf_change_count=$(git diff origin/master --dirstat=files,0 \| grep -c ${{ matrix.directory }} \|\| :)
	if [[ $tf_change_count -lt 1 ]]; then
	echo "::set-output name=drift::true"
	else
	echo "::set-output name=drift::false"
	fi

	- name: report on pr
	uses: actions/github-script@v5
	if: always()
	with:
	script: \|
	const fs = require('fs');

	const myDirectory = '${{ matrix.directory }}';
	const isDrift = ${{ steps.drift.outputs.drift }};

	function readFile(filename) {
	try {
	return fs.readFileSync(`${myDirectory}/${filename}`, 'utf8');
	} catch {
	return 'ERROR reading plan output. See the run for more details'
	}
	}

	// If this is drift, then we need to find the comment that is the drift comment
	const identifier = (isDrift) ? 'isDrift' : myDirectory;
	function ismyPreviousComment(comment) {
	return comment.body.includes(`<div id="${identifier}"`) && comment.user.login == 'github-actions[bot]';
	}

	// Get all the previous comments
	const previousComments = await github.rest.issues.listComments({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	})
	core.info(`Found ${previousComments.data.length} comments`);

	// Find my comment
	let myPreviousComment;
	// ES5 doesn't support Array.prototype.find()
	for (const comment of previousComments.data) {
	if (ismyPreviousComment(comment)) {
	myPreviousComment = comment;
	}
	}

	// My plan output
	const planOutput = readFile('plan_output.txt'); // the plan output

	// Build the summary line
	const planLineRe = /Plan: (\d+) to add, (\d+) to change, (\d+) to destroy/g;
	const search = [...planOutput.matchAll(planLineRe)];
	const theFirstResult = search[0];
	const theNewPlanOneLiner = (theFirstResult) ? theFirstResult[0] : false;
	const resourcesAreBeingDeleted = (theFirstResult) ? parseInt(theFirstResult[3]) > 0 : false;
	const summaryColor = (resourcesAreBeingDeleted) ? 'red' : 'black';
	const summaryText = (theNewPlanOneLiner)
	? `<p style="color:${summaryColor};">${theNewPlanOneLiner}</p>`
	: '<p style="color:SeaGreen;">No changes. Infrastructure up to date</p>';

	// Build the call to action
	const actionText =
	'curl -X POST -H "Authorization: Token $GITHUB_TOKEN" ' +
	'https://api.github.com/repos/SlideShareCorp/terraform/actions/workflows/11869138/dispatches ' +
	`-d \'{"ref": "master", "inputs": {"sha": "${context.sha}", "directory": "${myDirectory}", "issue": "${context.issue.number}"}}\'`

	// Build the section
	const mySection = `<div id="${myDirectory}">
	<h2><code>${myDirectory}</code></h2>
	<summary>${summaryText}</summary>
	<details>

	\`\`\`
	${planOutput}
	\`\`\`

	</details>

	In order to execute this plan, run the following:
	\`\`\`
	${actionText}
	\`\`\`
	</div><!-- closing ${myDirectory} -->`;


	function trimBody(body) {
	if (body.length > 65536) {
	// remove the Details if the body is too long
	const re = new RegExp('<details>.*</details>', 'gms');
	return body.replace(re, "Details have been removed to meet max character limits for comments. Please run in your terminal.");
	} else {
	return body;
	}
	}

	const mySectionRegex = new RegExp(`<div id="${myDirectory}">.*</div><!-- closing ${myDirectory} -->`, 'gms');
	const mySectionAlreadyInmyPreviousComment = (myPreviousComment) ? mySectionRegex.test(myPreviousComment.body) : false;

	function addMySectionToDrift() {
	let body = myPreviousComment.body;
	if (mySectionAlreadyInmyPreviousComment) {
	body = body.replace(mySectionRegex, mySection);
	} else {
	const lastLine = new RegExp('</div>$');
	body = body.replace(lastLine, mySection + '</div>');
	}
	return body;
	}

	// MAIN
	if (theNewPlanOneLiner) {
	core.info(`Found a plan with changes: ${theNewPlanOneLiner}`);
	if (myPreviousComment) {
	core.info('Updating my previous comment.');
	const body = (isDrift) ? addMySectionToDrift() : mySection;
	github.rest.issues.updateComment({
	comment_id: myPreviousComment.id,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: body,
	})
	} else {
	core.info('Creating a new comment.');
	const body = (isDrift)
	? '<div id="isDrift"><h1>Drift Detection</h1>' + mySection + '</div>'
	: mySection;
	github.rest.issues.createComment({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: trimBody(body),
	})
	}
	}
	name: Apply Terraform

	on:
	workflow_dispatch:
	inputs:
	directory:
	description: "terraform directory to trigger"
	required: true
	default: ""
	sha:
	description: "git sha of the generated plan"
	required: true
	default: ""
	issue:
	description: "The issue that will be updated with the results of the run"
	required: false
	default: ""
	env:
	# See page below about disabling Hashicorp Upgrade and Security Checks
	# https://www.terraform.io/docs/commands/index.html#upgrade-and-security-bulletin-checks
	CHECKPOINT_DISABLE: true

	jobs:
	terraform-apply:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@v2

	- name: Configure AWS
	uses: aws-actions/configure-aws-credentials@v1
	with:
	aws-access-key-id: ${{ secrets.TERRAFORM_AWS_ACCESS_KEY_ID }}
	aws-secret-access-key: ${{ secrets.TERRAFORM_AWS_SECRET_ACCESS_KEY }}
	aws-region: us-east-1

	- name: Download plan
	run: \|
	aws s3 cp s3://my-terraform-bucket/github-actions/plans/${{ github.event.inputs.sha }}-${{ github.event.inputs.directory }}/tf.plan ${{ github.event.inputs.directory }}/tf.plan

	- name: Install tfenv
	working-directory: "${{ github.workspace }}"
	run: \|
	mkdir -p $HOME/.tfenv
	cd $HOME/.tfenv
	# download
	wget https://github.com/tfutils/tfenv/archive/v2.2.2.tar.gz
	# verify that it's legit
	echo "ac7f74d8a0151e36a539ceae1460b320ec7b98b360dbd7799dc7cdbdf8c06ded v2.2.2.tar.gz" \| sha256sum --check --strict
	# install
	tar -zxvf v2.2.2.tar.gz
	echo "$(pwd)/tfenv-2.2.2/bin" >> $GITHUB_PATH

	- name: Terraform Apply
	env:
	SSH_AUTH_SOCK: /tmp/ssh_agent.sock
	id: apply
	run: \|
	cd ${{ github.event.inputs.directory }} && \
	(tfenv use \|\| tfenv install && tfenv use) && \
	terraform init && \
	terraform apply -no-color tf.plan 2>&1 \| tee -a apply.out

	- name: report
	uses: actions/github-script@v4
	if: "${{ github.event.inputs.issue }}"
	with:
	script: \|
	const fs = require('fs');
	const applyData = fs.readFileSync(`${context.payload.inputs.directory}/apply.out`, 'utf8');
	const changes = `<summary>Changes Applied.</summary>
	<details>

	\`\`\`
	${applyData}
	\`\`\`

	</details>`;

	const mySection = `<div id="${ context.payload.inputs.directory }">
	<h2><code>${ context.payload.inputs.directory }</code></h2>
	${changes}
	</div><!-- closing ${ context.payload.inputs.directory } -->`;

	github.issues.createComment({
	issue_number: context.payload.inputs.issue,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: mySection,
	});