pr_push_auth.yaml

---
name: Trigger on pull_request (plan) and push (apply) events with Terraform, AWS authentication and caching.

on:
  pull_request:
  push:
    branches: [main]

jobs:
  tf:
    runs-on: ubuntu-latest

    permissions:
      actions: read        # Required to identify workflow run.
      checks: write        # Required to add status summary.
      contents: read       # Required to checkout repository.
      id-token: write      # Required to authenticate via OIDC.
      pull-requests: write # Required to add comment and label.

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Authenticate AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_ROLE }}

      - name: Create cache
        run: |
          mkdir --parents $HOME/.terraform.d/plugin-cache
          echo "TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache" >> $GITHUB_ENV

      - name: Cache TF
        uses: actions/cache@v4
        with:
          path: ~/.terraform.d/plugin-cache
          key: cache-tf-${{ runner.os }}-${{ hashFiles('path/to/directory/.terraform.lock.hcl') }}

      - name: Setup TF
        uses: hashicorp/setup-terraform@v3

      - name: Provision TF
        uses: op5dev/tf-via-pr@v13
        with:
          working-directory: path/to/directory
          command: ${{ github.event_name == 'push' && 'apply' || 'plan' }}
          arg-lock: ${{ github.event_name == 'push' }}
          plan-encrypt: ${{ secrets.PASSPHRASE }}
          validate: true
          format: true