-
Notifications
You must be signed in to change notification settings - Fork 2
66 lines (54 loc) · 2.51 KB
/
terraform-wif.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: 'Terraform via WIF'
on:
push:
branches:
- master
pull_request:
jobs:
terraform:
name: 'Terraform'
runs-on: ubuntu-latest
environment: production
# Add "id-token" with the intended permissions.
permissions:
contents: 'read'
id-token: 'write'
# Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
defaults:
run:
shell: bash
working-directory: ./terraform-vet
steps:
# Checkout the repository to the GitHub Actions runner
- name: Checkout
uses: actions/checkout@v2
- id: 'auth'
name: 'Authenticate to Google Cloud'
uses: 'google-github-actions/auth@v0.3.1'
with:
# token_format: 'access_token'
create_credentials_file: true
workload_identity_provider: 'projects/${{ secrets.PROJECT_NUMBER }}/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
service_account: 'my-service-account@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com'
# Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
# Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
- name: Terraform Init
run: terraform init
# Checks that all Terraform configuration files adhere to a canonical format
- name: Terraform Format
run: terraform fmt -check
# Generates an execution plan for Terraform
- name: Terraform Plan
run: terraform plan -input=false -var "project_id=testproject" -var "location=US"
# # On push to main, build or change infrastructure according to Terraform configuration files
# # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud". See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks
# - name: Terraform Apply
# if: github.ref == 'refs/heads/main' && github.event_name == 'push'
# run: terraform apply -auto-approve
# working-directory: ./examples/terraform
# - name: Terraform Destroy
# if: github.ref == 'refs/heads/main' && github.event_name == 'push'
# run: terraform destroy -auto-approve
# working-directory: ./examples/terraform