test-binary-plan.yaml

name: Test terraform-plan using binary plan

on:
  - pull_request

permissions:
  contents: read

jobs:
  missing_plan_path:
    runs-on: ubuntu-24.04
    name: Missing plan
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Apply
        uses: ./terraform-apply
        id: apply
        continue-on-error: true
        with:
          path: tests/workflows/test-binary-plan
          plan_path: hello.tfplan
          auto_approve: true

      - name: Verify outputs
        env:
          OUTCOME: ${{ steps.apply.outcome }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

  apply:
    runs-on: ubuntu-24.04
    name: Apply approved changes
    permissions:
      contents: read
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan
        uses: ./terraform-plan
        id: plan
        with:
          label: test-binary-plan apply
          path: tests/workflows/test-binary-plan

      - name: Apply
        uses: ./terraform-apply
        id: first-apply
        with:
          label: test-binary-plan apply
          path: tests/workflows/test-binary-plan
          plan_path: ${{ steps.plan.outputs.plan_path }}

  auto_approve:
    runs-on: ubuntu-24.04
    name: Apply auto approved changes
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan
        uses: ./terraform-plan
        id: plan
        with:
          label: test-binary-plan auto_approve
          path: tests/workflows/test-binary-plan
          add_github_comment: false

      - name: Apply
        uses: ./terraform-apply
        with:
          label: test-binary-plan auto_approve
          path: tests/workflows/test-binary-plan
          plan_path: ${{ steps.plan.outputs.plan_path }}
          auto_approve: true

  plan_changed:
    runs-on: ubuntu-24.04
    name: Apply should fail if the approved plan has changed
    permissions:
      contents: read
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Plan
        uses: ./terraform-plan
        id: plan
        with:
          label: test-binary-plan plan_changed
          path: tests/workflows/test-binary-plan

      - name: Plan
        uses: ./terraform-plan
        with:
          label: test-binary-plan plan_changed
          path: tests/workflows/test-binary-plan

      - name: Apply
        uses: ./terraform-apply
        continue-on-error: true
        id: apply
        with:
          label: test-binary-plan plan_changed
          path: tests/workflows/test-binary-plan
          plan_path: ${{ steps.plan.outputs.plan_path }}

      - name: Verify outputs
        env:
          OUTCOME: ${{ steps.apply.outcome }}
          FAILURE_REASON: ${{ steps.apply.outputs.failure-reason }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "plan-changed" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi