action.yml

name: "Terraform check action"
description: "Check terraform code"
author: "HENNGE"
branding:
  icon: check-square
  color: white
inputs:
  directory:
    description: "One or more directories separated by space in which to run the checks"
    required: true
  terraform_version:
    description: "Terraform version to run the check against. Set to 'system' to use the system terraform."
    default: "latest"
  terraform_binary:
    description: "Terraform binary to use. Defaults to 'terraform'. Can be set to 'tofu' to use opentofu."
    default: "terraform"
  plan_args:
    description: "Optional: Additional arguments to pass to terraform plan. This should be passed as json array."
  post_comment:
    description: "Post check result to PR comment if set as true. Set to 'update' to update the existing comment on subsequent runs, after posting the initial comment."
  hide_refresh:
    description: "Hide state refresh output from report"
  github_token:
    description: "Github token to post PR comment"
  issue_number:
    description: "Post comment to a specific issue or PR instead of the current one"
outputs:
  returncode:
    description: "Terraform check return code"
    value: ${{ steps.check.outputs.returncode }}
  result:
    description: "Terraform check result"
    value: ${{ steps.result.outputs.result }}
  report:
    description: "Terraform check detailed report"
    value: ${{ steps.result.outputs.report }}
runs:
  using: "composite"
  steps:
    - uses: actions/setup-python@v5
      with:
        python-version: "3.12"

    - id: set-binary
      env:
        TERRAFORM_BINARY: ${{ inputs.terraform_binary }}
      run: |
        # sanitise input
        if [[ "$TERRAFORM_BINARY" == "tofu" ]] ; then
          printf 'TF=%s\n' "tofu" >> "$GITHUB_ENV"
        elif [[ "$TERRAFORM_BINARY" == "terraform" ]] ; then
          printf 'TF=%s\n' "terraform" >> "$GITHUB_ENV"
        else
          1>&2 printf 'Unsupported terraform binary %s\n' "$TERRAFORM_BINARY"
          exit 1
        fi
      shell: bash

    - name: Setup tenv
      if: ${{ inputs.terraform_version != 'system' }}
      run: |
        platform=
        case "$(uname)" in
          Darwin) platform="Darwin";;
           Linux) platform="Linux";;
               *) 1>&2 printf 'Runner unsupported: %s\n' "$(uname)" && exit 1 ;;
        esac

        arch="$(uname -m)"
        if [[ "$arch" = "arm64" ]] || [[ "$arch" = "aarch64" ]]; then
          arch="aarch64"
        elif [[ "$arch" = "x86_64" ]] ; then
          :
        else
          1>&2 printf 'Runner unsupported: %s (%s)\n' "$(uname)" "$arch"
          exit 1
        fi

        mkdir tenv
        (
          cd tenv
          wget "https://github.com/tofuutils/tenv/releases/download/$TENV_VERSION/tenv_""$TENV_VERSION""_""$platform""_""$arch.tar.gz"
          tar -xf tenv*.tar.gz
          rm tenv*tar.gz

          find . -executable -type f -print0 | xargs -0 -I xx sudo install -o root -g root -Dm755 xx /usr/local/bin/xx
        )
        rm -rf tenv
      shell: bash
      env:
        # renovate: datasource=github-releases depName=tofuutils/tenv
        TENV_VERSION: 'v4.1.0'

    - run: |
        python -m venv venv
        venv/bin/pip install jinja2
      shell: bash

    - id: check
      env:
        PLAN_ARGS: ${{ inputs.plan_args }}
        TENV_AUTO_INSTALL: true
      run: |
        set +e
        read -r -a directories <<< "${{ inputs.directory }}"
        read -r -a versions <<< "${{ inputs.terraform_version }}"
        readarray -t plan_args < <(printf '%s\n' "$PLAN_ARGS" | jq -r '.[] | if . == null then "" else . end')

        if [ "${{ inputs.hide_refresh }}" = "true" ]; then
          hide=-hide-refresh
        fi

        len=${#directories[@]}

        returncode=0
        for (( i=0; i<len; i++)); do
          # Append three dashes between reports
          if [ "$i" -gt 0 ]; then
            printf "\n\n---\n\n" >> report.md
          fi

          if [ "${versions[$i]}" = "system" ] ; then
            echo "Using system provided $TF"
            "$TF" --version
          elif [ -z "${versions[$i]}" ] ; then
            : # using whatever we setup previously
          else
            # Change version
            tenv "$TF" install "${versions[$i]}"
            tenv "$TF" use "${versions[$i]}"
          fi

          if [ -z "${plan_args[$i]}" ] ; then
            venv/bin/python "${{ github.action_path }}/tfcheck.py" "${directories[$i]}" -report report.md $hide | tee >(tail -1 >> result.txt)
          else
            printf "Passing these args to plan: %s\n" "${plan_args[$i]}"
            venv/bin/python "${{ github.action_path }}/tfcheck.py" "${directories[$i]}" -report report.md -plan-args "${plan_args[$i]}" $hide | tee >(tail -1 >> result.txt)
          fi
          ret=${PIPESTATUS[0]}

          if [ "$ret" -eq 1 ]; then
            echo "::error ::$(tail -1 result.txt)"
          elif [ "$ret" -eq 2 ]; then
            echo "::warning ::$(tail -1 result.txt)"
          fi

          # Set exitcode to 1 if any check failed
          # Set exitcode to 2 if any check contains plan change
          if [ "$returncode" -eq 0 ]; then
            returncode=$ret
          elif [ "$returncode" -eq 2 ]; then
            if [ "$ret" -eq 1 ]; then
              returncode=1
            else
              returncode=2
            fi
          fi
        done

        echo "returncode=$returncode" >> $GITHUB_OUTPUT
      shell: bash

    - id: result
      run: |
        echo "$(cat report.md)" >> $GITHUB_STEP_SUMMARY

        venv/bin/python "${{ github.action_path }}/report_postprocess.py" report.md

        delimiter="$(openssl rand -hex 8)"

        echo "result<<$delimiter" >> $GITHUB_OUTPUT
        echo "$(cat result.txt)" >> $GITHUB_OUTPUT
        echo "$delimiter" >> $GITHUB_OUTPUT

        echo "report<<$delimiter" >> $GITHUB_OUTPUT
        echo "$(cat report.md)" >> $GITHUB_OUTPUT
        echo "$delimiter" >> $GITHUB_OUTPUT
      shell: bash

    - uses: actions/github-script@v7
      if: ${{ inputs.post_comment == 'true' || inputs.post_comment == 'update' || ( inputs.post_comment == 'nonzero' && steps.check.outputs.returncode != 0 ) }}
      with:
        github-token: ${{ inputs.github_token }}
        script: |
          const fs = require('fs')
          const body = fs.readFileSync("report.md", "utf8")

          const issue_number = Number('${{ inputs.issue_number }}') || context.issue.number

          let botComment = null;
          if ('${{ inputs.post_comment }}' == 'update') {
            const { data: comments } = await github.rest.issues.listComments({
              issue_number,
              owner: context.repo.owner,
              repo: context.repo.repo,
            });

            directories = '${{ inputs.directory }}'.split(' ')
            botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && directories.every(dir => comment.body.includes(`Terraform check on ${dir}`)) 
            });
          }

          if (botComment) {
            github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: botComment.id,
              body: body
            });
          } else {
            github.rest.issues.createComment({
              issue_number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: body
            });
          }

    - run: |
        if [[ ${{ steps.check.outputs.returncode }} -eq 1 ]]; then
          exit 1
        fi
      shell: bash