call_code_review.yaml

on:
  workflow_call:
    inputs:
      environment:
        type: string
        required: true
      tf_environment:
        type: string
        required: false
      dir:
        type: string
        required: true
      env_vars:
        type: string
        required: false
        description: List of environment variables to set up, given in env=value format.
      use_private_agent:
        description: Use a private agent to run the Terraform plan.
        type: boolean
        required: false
        default: false

env:
  ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
  ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
  ARM_USE_OIDC: true
  ARM_USE_AZUREAD: true
  ARM_STORAGE_USE_AZUREAD: true
  TERRAFORM_ENVIRONMENT: ${{ inputs.tf_environment || inputs.environment }}

jobs:
  tf_plan:
    name: 'Terraform Plan'
    runs-on: ${{ inputs.use_private_agent == true && 'self-hosted' || 'ubuntu-20.04' }}
    environment: ${{ inputs.environment }}-ci
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    env:
      ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    steps:

      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        name: Checkout

      - name: Set Environment Variables
        if: ${{ inputs.env_vars }}
        run: |
          for i in "${{ inputs.env_vars }}"
          do
            printf "%s\n" $i >> $GITHUB_ENV
          done

      - name: Azure Login
        uses: azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0
        with:
          client-id: ${{ env.ARM_CLIENT_ID }}
          tenant-id: ${{ env.ARM_TENANT_ID }}
          subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}

      - name: Set Terraform Version
        id: set-terraform-version
        run: |
          echo "terraform_version=$(cat .terraform-version)" >> $GITHUB_OUTPUT

      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        name: Setup Terraform
        with:
          terraform_version: ${{ steps.set-terraform-version.outputs.terraform_version }}

      - name: Terraform Init
        working-directory: ${{ inputs.dir }}
        run: |
          terraform init

      - name: Terraform Plan
        working-directory: ${{ inputs.dir }}
        run: |
          terraform plan -lock-timeout=3000s -no-color | grep -v "hidden-link:" | tee plan_output.txt
          OUTPUT=$(grep -Ev "Refreshing state|state lock|Reading|Read" plan_output.txt | tail -c 60000)
          echo "$OUTPUT" > plan_output_multiline.txt

      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        name: Post Plan on PR
        if: success() && github.event_name == 'pull_request'
        with:
          script: |
            const fs = require('fs');
            const output = fs.readFileSync('${{ inputs.dir }}/plan_output_multiline.txt', 'utf8');
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number
            })
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Plan')
            })
            const commentBody = `#### Terraform Plan ('${{ inputs.dir }}') 📖
            <details>
            <summary>Terraform Plan</summary>

            \`\`\`hcl
            ${output}
            \`\`\`

            </details>
            `;
            if (botComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: commentBody,
                comment_id: botComment.id
              })
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: commentBody,
                issue_number: context.issue.number
              })
            }