terraform-analyzer/example/workflow.yml at main · Leapfrog-DevOps/terraform-analyzer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Terraform CI/CD with AI Analysis

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
    inputs:
      action:
        description: 'Terraform Action'
        required: true
        default: plan
        type: choice
        options:
          - apply
          - plan

permissions:
  id-token: write
  contents: write
  pull-requests: write
  actions: read

jobs:
  terraform:
    name: Terraform Plan & Apply
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.DEPLOYMENT_ROLE }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: '1.11.4'

      - name: Terraform Init
        id: init
        run: |
          cd terraform
          terraform init 2>&1 | tee ../terraform.log
        continue-on-error: true

      - name: Terraform Plan
        id: plan
        if: github.event_name == 'pull_request' || github.event.inputs.action == 'plan'
        run: |
          cd terraform
          terraform plan -out=tfplan -detailed-exitcode 2>&1 | tee ../plan_output.txt
          PLAN_EXIT_CODE=${PIPESTATUS[0]}
          cat ../plan_output.txt >> ../terraform.log
          echo "--- END OF PLAN ---" >> ../terraform.log

          terraform show -no-color tfplan > ../plan_readable.txt || true
          terraform show -json tfplan > tfplan.json

          grep -E '^  # |Plan: |No changes.' ../plan_output.txt | nl > ../plan_summary.txt
        continue-on-error: true

      - name: Terraform Apply
        id: apply
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'apply'
        run: |
          cd terraform
          terraform apply -auto-approve 2>&1 | tee -a ../terraform.log
        continue-on-error: true

      - name: Analyze Terraform Errors with AI
        if: steps.init.outcome == 'failure' || steps.plan.outcome == 'failure' || steps.apply.outcome == 'failure'
        uses: Leapfrog-DevOps/terraform-analyzer@v0.6
        with:
          mode: 'analyze'
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          terraform-directory: './terraform'
          auto-fix: 'true'
          branch-name: 'ai-terraform-fixes'

      - name: Analyze Terraform Costs
        if: steps.plan.outcome == 'success'
        uses: Leapfrog-DevOps/terraform-analyzer@v0.6
        with:
          mode: 'cost'
          infracost-api-key: ${{ secrets.INFRACOST_API_KEY }}
          terraform-directory: './terraform'
          infracost-branch: 'cost-tracking'


      - name: Fail workflow if Terraform failed
        if: steps.init.outcome == 'failure' || steps.plan.outcome == 'failure' || steps.apply.outcome == 'failure'
        run: |
          echo "Terraform failed. Check the AI analysis results above."
          exit 1