chore: Only run CI checks when necessary (affected files changed)

.github/workflows/e2e-terratest.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches:
       - main
+    paths:
+      - '**.tf'
+      - '**.yml'
+      - '**.yaml'
+      - 'test/*'
   workflow_dispatch:
 
 concurrency: e2e-terratest

.github/workflows/plan-examples.yml

@@ -7,6 +7,10 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
 jobs:
   getExampleDirectories:
     name: Get example directories
@@ -42,7 +46,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        tf_working_dir: ${{ fromJson(needs.getExampleDirectories.outputs.directories) }}
+        directory: ${{ fromJson(needs.getExampleDirectories.outputs.directories) }}
 
     steps:
       - name: checkout-merge
@@ -55,8 +59,21 @@ jobs:
         if: "!contains(github.event_name, 'pull_request')"
         uses: actions/checkout@v3
 
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          # Need to check not only the example directory
+          # but also the supporting module(s) code
+          # for plans (not for pre-commit)
+          filters: |
+            src:
+              - '${{ matrix.directory }}/**/*.(tf|yml|yaml)'
+              - 'modules/**/*.(tf|yml|yaml)'
+              - '*.tf'
+
       - name: Configure AWS credentials from Test account
         uses: aws-actions/configure-aws-credentials@v1
+        if: steps.changes.outputs.src== 'true'
         with:
           role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}
           aws-region: us-west-2
@@ -65,15 +82,16 @@ jobs:
 
       - name: Terraform Job
         uses: hashicorp/setup-terraform@v2
+        if: steps.changes.outputs.src== 'true'
         with:
           terraform_version: 1.0.0
 
       - name: Terraform Init
-        id: init
+        if: steps.changes.outputs.src== 'true'
         run: terraform init -reconfigure
-        working-directory: ${{ matrix.tf_working_dir }}
+        working-directory: ${{ matrix.directory }}
 
       - name: Terraform Plan
-        id: plan
-        working-directory: ${{ matrix.tf_working_dir }}
+        if: steps.changes.outputs.src== 'true'
+        working-directory: ${{ matrix.directory }}
         run: terraform plan -no-color

.github/workflows/pre-commit.yaml

@@ -4,21 +4,28 @@ on:
   pull_request:
     branches:
       - main
+    paths:
+      - '**.tf'
+      - '**.yml'
+      - '**.yaml'
 
 env:
   TERRAFORM_DOCS_VERSION: v0.16.0
   TFSEC_VERSION: v1.22.0
   TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache
   TFLINT_VERSION: v0.38.1
 
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
 jobs:
   collectInputs:
     name: Collect workflow inputs
     runs-on: ubuntu-latest
     outputs:
       directories: ${{ steps.dirs.outputs.directories }}
     steps:
-      - run: aws --version
       - name: Checkout
         uses: actions/checkout@v3
 
@@ -37,34 +44,47 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          # We only need to check Terraform files for the current directory
+          # because the `preCommitMaxVersion` job will run the full,
+          # exhaustive checks (always)
+          filters: |
+            src:
+              - '${{ matrix.directory }}/*.tf'
+
       - name: Config Terraform plugin cache
+        if: steps.changes.outputs.src== 'true'
         run: mkdir --parents ${{ env.TERRAFORM_DOCS_VERSION }}
 
       - name: Cache Terraform
         uses: actions/cache@v3
+        if: steps.changes.outputs.src== 'true'
         with:
           path: ${{ env.TERRAFORM_DOCS_VERSION }}
           key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
           restore-keys: ${{ runner.os }}-terraform-
 
       - name: Terraform min/max versions
-        id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.7
+        if: steps.changes.outputs.src== 'true'
+        id: minMax
         with:
           directory: ${{ matrix.directory }}
 
       - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.directory !=  '.' }}
         uses: clowdhaus/terraform-composite-actions/pre-commit@v1.6.0
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory !=  '.' && steps.changes.outputs.src== 'true' }}
         with:
           terraform-version: ${{ steps.minMax.outputs.minVersion }}
           args: 'terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*'
 
       - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.directory ==  '.' }}
         uses: clowdhaus/terraform-composite-actions/pre-commit@v1.6.0
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory ==  '.' && steps.changes.outputs.src== 'true' }}
         with:
           terraform-version: ${{ steps.minMax.outputs.minVersion }}
           args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'
@@ -76,29 +96,38 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+
+      - uses: dorny/paths-filter@v2
+        id: changes
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
+          filters: |
+            src:
+              - '**/*.tf'
 
       - name: Config Terraform plugin cache
+        if: steps.changes.outputs.src== 'true'
         run: mkdir --parents ${{ env.TERRAFORM_DOCS_VERSION }}
 
       - name: Cache Terraform
         uses: actions/cache@v3
+        if: steps.changes.outputs.src== 'true'
         with:
           path: ${{ env.TF_PLUGIN_CACHE_DIR }}
           key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
           restore-keys: ${{ runner.os }}-terraform-
 
       - name: Install tfsec
+        if: steps.changes.outputs.src== 'true'
         run: curl -sSLo ./tfsec https://github.com/aquasecurity/tfsec/releases/download/${{ env.TFSEC_VERSION }}/tfsec-$(uname)-amd64 && chmod +x tfsec && sudo mv tfsec /usr/bin/
 
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.7
+        if: steps.changes.outputs.src== 'true'
 
       - name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }}
         uses: clowdhaus/terraform-composite-actions/pre-commit@v1.6.0
+        if: steps.changes.outputs.src== 'true'
         with:
           terraform-version: ${{ steps.minMax.outputs.maxVersion }}
           terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}