pr_self_hosted.yaml

---
name: Trigger on pull_request (plan or apply) and labeled (manual) events on self-hosted Terraform and OpenTofu.

on:
  pull_request:
    types: [opened, synchronize, closed, labeled]

jobs:
  tf:
    # Run on usual PR events and when labeled with 'tf-plan'.
    if: ${{ contains(fromJSON('["opened", "synchronize", "closed"]'), github.event.action) || contains(github.event.pull_request.labels.*.name, 'tf-plan') }}
    runs-on: self-hosted

    permissions:
      actions: read        # Required to identify workflow run.
      checks: write        # Required to add status summary.
      contents: read       # Required to checkout repository.
      pull-requests: write # Required to add comment and label.

    env:
      tool: terraform

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Terraform
        if: env.tool == 'terraform'
        uses: hashicorp/setup-terraform@v3

      - name: Setup OpenTofu
        if: env.tool == 'tofu'
        uses: opentofu/setup-opentofu@v1

      - name: Provision TF
        uses: op5dev/tf-via-pr@v13
        with:
          working-directory: path/to/directory
          command: ${{ github.event.pull_request.merged && 'apply' || 'plan' }}
          arg-lock: ${{ github.event.pull_request.merged }}
          plan-encrypt: ${{ secrets.PASSPHRASE }}
          validate: true
          format: true
          tool: ${{ env.tool }}

      - name: Remove label
        if: ${{ contains(github.event.pull_request.labels.*.name, 'tf-plan') }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.number }}
        run: gh api /repos/{owner}/{repo}/issues/${PR_NUMBER}/labels/tf-plan --method DELETE