pull_request_target.yaml

name: Test pull_request_target event

on:
  - pull_request_target  # zizmor: ignore[dangerous-triggers]

permissions: {}

jobs:
  apply:
    runs-on: ubuntu-24.04
    name: Apply approved changes on pull_request_target
    if: github.repository == 'dflook/terraform-github-actions' && github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      pull-requests: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Create test module
        run: |
          mkdir -p test-module
          cat > test-module/main.tf << 'EOF'
          resource "random_string" "my_string" {
            length = 11
          }

          output "output_string" {
            value = "the_string"
          }
          EOF

      - name: Plan
        uses: dflook/terraform-plan@7878bff63e2099cdc9be9a6f33cbbbf687f8f0fe # v2.2.3
        with:
          label: pull_request_target
          path: test-module

      - name: Apply
        uses: dflook/terraform-apply@5489b988934a50bf1489d5b7c5253b46520a7dca # v2.2.3
        id: output
        with:
          label: pull_request_target
          path: test-module

      - name: Verify outputs
        env:
          OUTPUT_STRING: ${{ steps.output.outputs.output_string }}
        run: |
          if [[ "$OUTPUT_STRING" != "the_string" ]]; then
            echo "::error:: output s not set correctly"
            exit 1
          fi