tar-valon-terraform/.gitea/workflows/cloudflare-auto-pr-tofu-pipeline.yml

name: Auto-PR Check/Creation and TF/OpenTofu Plan

on:
  workflow_dispatch:
  push:
    branches-ignore:
      - "main"
      - "renovate/**"
    paths:
      - "cloudflare/**"

env:
  OPENTOFU_VERSION: "1.10.6"
  HC_VAULT_VERSION: "1.20.4"
  TEA_VERSION: "0.10.1"

jobs:
  check-and-create-pr:
    name: Check and Create PR
    outputs:
      pr_number: ${{ steps.pr-check-create.outputs.pr_number }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setting Vault Token
        run: echo "VAULT_TOKEN=${{ secrets.VAULT_GITEA_TOKEN }}" >> $GITHUB_ENV

      - name: Gotify Notification - Start
        uses: eikendev/gotify-action@master
        with:
          gotify_api_base: ${{ secrets.RUNNER_GOTIFY_URL }}
          gotify_app_token: ${{ secrets.RUNNER_GOTIFY_TOKEN }}
          notification_title: "GITEA: PR Check @ Rinoa"
          notification_message: "Checking for existing PR... 🔍"

      - name: PR Check/Creation
        id: pr-check-create
        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
        with:
          url: ${{ secrets.TREZ_GITEA_URL }}
          token: ${{ secrets.BOT_GITEA_TOKEN }}
          pr-label: "docker-compose,manual"
          assignee: ${{ github.actor }}

      - name: Gotify Notification - Done
        uses: eikendev/gotify-action@master
        with:
          gotify_api_base: ${{ secrets.RUNNER_GOTIFY_URL }}
          gotify_app_token: ${{ secrets.RUNNER_GOTIFY_TOKEN }}
          notification_title: "GITEA: PR Check @ Rinoa"
          notification_message: "PR Check done 🎟️"

  plan-approval:
    name: OpenTofu Plan
    needs: check-and-create-pr
    runs-on: ubuntu-latest
    env:
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
    outputs:
      tofu-cloudflare-plan: ${{ steps.tofu_plan.outputs.plan-output }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Clear Tofu cache
        run: |
          rm cloudflare/.terraform.lock.hcl
          cat > cloudflare/.tofurc <<'EOF'
          provider_installation {
            network_mirror {
              url = "https://registry.terraform.io/"
            }
            direct {}
          }
          EOF

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1.0.6
        with:
          version: ${{ env.OPENTOFU_VERSION }}
          tofu_wrapper: false

      - name: Generate .env from Hashicorp Vault
        uses: https://git.trez.wtf/Trez/hc-vault-env@main
        with:
          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
          HC_VAULT_AUTH: token
          HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
          HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
          ENV_FILE_NAME: cloudflare/.env

      - name: Export env vars from Vault .env
        id: env-vault-vars
        run: |
          sed -i 's/[\"'\'']//g' cloudflare/.env
          set -a
          source cloudflare/.env
          set +a
          while IFS='=' read -r key value; do
            if [[ -n "$key" ]]; then
              echo "$key=$value" >> $GITHUB_ENV
            fi
          done < cloudflare/.env
          repo_name=$(echo "${{ github.repository }}" | awk -F"/" '{print $2}')
          echo "repo_name=$repo_name" >> "$GITHUB_OUTPUT"

      - name: Run tofu init
        id: tofu-init
        uses: dnogu/tofu-init@v1
        with:
          working-directory: .
          chdir: cloudflare
          upgrade: true
          backend: true
          get: true
          reconfigure: true

      - name: Tofu Plan
        id: tofu-plan
        continue-on-error: true
        uses: dnogu/tofu-plan@v1
        with:
          working-directory: .
          chdir: cloudflare
          out: cloudflare.tfplan

      - name: Convert Plan to JSON
        run: |
          cd cloudflare
          tofu show cloudflare.tfplan > cloudflare_tf.txt
          tofu show -json cloudflare.tfplan > cloudflare_tf.json
          echo -e "Gitea: ${{ gitea.event_path }}\nGithub: ${{ github.event_path }}"
          cat "${{ gitea.event_path }}"
          cat /var/run/act/workflow/event.json

      # - name: Tofu Report
      #   uses: ahmadnassri/action-terraform-report@v4.1.14
      #   with:
      #     # tell the action the plan outputs
      #     terraform-text: ${{ github.workspace }}/terraform.text
      #     terraform-json: ${{ github.workspace }}/terraform.json
      #     remove-stale-reports: true

      # - name: Build Markdown PR comment from plan file
      #   run: |
      #     mkdir -p tmp
      #     {
      #       echo "## 🧩 OpenTofu Plan — Cloudflare"
      #       echo "**Branch:** \`${{ github.ref_name }}\`"
      #       echo "**Exit Code:** \`${{ steps.tofu_plan.outputs.exitcode }}\`"
      #       echo "**Working Directory:** \`cloudflare\`"
      #       echo ""
      #       echo "<details><summary>🪶 Click to expand full plan output</summary>"
      #       echo ""
      #       echo '```hcl'
      #       tofu show cloudflare/cloudflare.tfplan         # <-- read file directly, ACT-safe
      #       echo '```'
      #       echo ""
      #       echo "</details>"
      #       echo ""
      #       echo "*(This plan was automatically generated by the workflow.)*"
      #     } > tmp/tofu-plan.md
      #     echo "Markdown PR comment built: tmp/tofu-plan.md"

      # - name: Load markdown plan into env var (safe for large output)
      #   id: load-plan-md
      #   run: |
      #     # Ensure file exists and isn't absurdly large
      #     if [ ! -f tmp/tofu-plan.md ]; then
      #       echo "❌ Missing tmp/tofu-plan.md"
      #       exit 1
      #     fi

      #     # Collapse newlines for environment storage
      #     plan_md=$(awk '{printf "%s\\n", $0}' tmp/tofu-plan.md)
      #     echo "COMMENT_TEMPLATE<<EOF" >> $GITHUB_ENV
      #     echo -e "$plan_md" >> $GITHUB_ENV
      #     echo "EOF" >> $GITHUB_ENV

      # - name: Comment full Tofu Plan on PR (Gitea safe)
      #   uses: https://git.trez.wtf/Trez.One/git-auto-comment@main
      #   with:
      #     platform: gitea
      #     api_url: https://git.trez.wtf/api/v1
      #     token: ${{ secrets.BOT_GITEA_TOKEN }}
      #     pr_index: ${{ needs.check-and-create-pr.outputs.pr_number }}
      #     repo_owner: ${{ github.repository_owner }}
      #     repo_name: ${{ steps.env-vault-vars.outputs.repo_name }}
      #     comment_template: ${{ env.COMMENT_TEMPLATE }}

      # - name: Wait for manual approval
      #   uses: trstringer/manual-approval@v1
      #   with:
      #     secret: ${{ secrets.BOT_GITEA_TOKEN }}
      #     approvers: WTF
      #     minimum-approvals: 1
      #     issue-title: "Tofu Plan for ${{ needs.check-and-create-pr.outputs.pr_number }}"
      #     issue-body: "Please approve or deny the deployment of the below Tofu plan"
      #     issue-body-file-path: cloudflare/cloudflare.tfplan
      #     exclude-workflow-initiator-as-approver: false
      #     fail-on-denial: true

  # apply:
  #   name: Apply Tofu Plan
  #   needs: plan-approval
  #   runs-on: ubuntu-latest
  #   if: ${{ needs.plan-approval.result == 'success' }}
  #   env:
  #     VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
  #   steps:
  #     - name: Checkout
  #       uses: actions/checkout@v4
  #
  #     - name: Setup OpenTofu
  #       uses: opentofu/setup-opentofu@v1.0.6
  #       with:
  #         version: ${{ env.OPENTOFU_VERSION }}
  #         tofu_wrapper: true
  #
  #     - name: Export env from Vault
  #       run: |
  #         set -a
  #         source cloudflare/.env
  #         set +a
  #
  #     - name: Run Tofu Apply
  #       uses: dnogu/tofu-apply@v1
  #       with:
  #         working-directory: .
  #         chdir: cloudflare
  #         plan: cloudflare.tfplan