api-rds-plan.yml

name: api-rds plan terraform

on:
  pull_request:
    paths:
      - .github/workflows/api-rds-plan.yml
      - terraform/services/api-rds/**
  workflow_dispatch: # Allow manual trigger

jobs:
  check-terraform-fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./actions/setup-tfenv-terraform
      - run: terraform fmt -check -diff -recursive terraform/services/api-rds

  terraform-plan:
    needs: check-terraform-fmt
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./terraform/services/api-rds
    strategy:
      fail-fast: false
      matrix:
        app: [ab2d]
        env: [dev, test]
    steps:
      - uses: actions/checkout@v4
      - uses: ./actions/setup-tfenv-terraform
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ matrix.app == 'ab2d' && secrets[format('{0}_{1}_ACCOUNT', matrix.app, matrix.env)] || secrets.BCDA_ACCOUNT }}:role/delegatedadmin/developer/${{ matrix.app }}-${{ matrix.env }}-github-actions
          aws-region: ${{ vars.AWS_REGION }}
      - run: terraform init -backend-config=../../backends/${{ matrix.app }}-${{ matrix.env }}.s3.tfbackend
      - uses: cmsgov/ab2d-bcda-dpc-platform/actions/aws-params-env-action@main
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
        with:
          params: |
            TF_VAR_jenkins_security_group_id=/jenkins/security-group
      - run: terraform plan
        env:
          TF_VAR_app: ${{ matrix.app }}
          TF_VAR_env: ${{ matrix.env }}