GitHub Workflows for `GITHUB_TOKEN` supported actions

terraform-ci.yaml

---
name: Terraform CI

on:
  workflow_call:
    # No inputs are required, as all information about the event will be pulled
    # in from the context of the event itself

jobs:
  terraform-checks:
    name: Lint & Validate Terraform
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.ref }}

      - name: And so on...

terraform-trigger-label.yaml

---
name: Label

on:
  pull_request:
    types:
      - labeled
    branches:
      - main

jobs:
  remove-force-ci-label:
    name: Remove Label
    runs-on: ubuntu-latest
    if: ${{ github.event.label.name == 'force-ci-run' }}
    steps:
      - name: Remove the force-ci-run Label
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.issues.removeLabel({
              issue_number: context.payload.pull_request.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: ['force-ci-run']
            })

  terraform-ci:
    # This job name should match the name of call called Workflow in order
    # for the name to successfully match any required status checks within
    # the branch protections
    name: Terraform CI
    if: ${{ github.event.label.name == 'force-ci-run' }}
    uses: ./.github/workflows/terraform-ci.yaml
    secrets: inherit

terraform-trigger-pr.yaml

---
name: Pull Request

on:
  pull_request:
    branches:
      - main

jobs:
  terraform-ci:
    # This job name should match the name of call called Workflow in order
    # for the name to successfully match any required status checks within
    # the branch protections
    name: Terraform CI
    uses: ./.github/workflows/terraform-ci.yaml
    secrets: inherit