tar-valon-terraform/.gitea/workflows/auto-pr-tofu-plan.yml

name: Auto-PR Check/Creation and TF/OpenTofu Plan

on:
  workflow_dispatch:
  push:
    branches-ignore:
      - "main"
      - "renovate/**"
env:
  OPENTOFU_VERSION: "1.10.6"
  HC_VAULT_VERSION: "1.20.4"
  TEA_VERSION: "0.10.1"

jobs:
  check-and-create-pr:
    name: Check and Create PR
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          fetch-depth: 1

      - name: Setting Vault Token
        run: |
          echo "VAULT_TOKEN=${{ secrets.VAULT_GITEA_TOKEN }}" >> $GITHUB_ENV

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
          notification_title: "GITEA: PR Check @ Rinoa"
          notification_message: "Checking for existing PR... 🔍"

      - name: PR Check/Creation
        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
        with:
          url: ${{ secrets.TREZ_GITEA_URL }}
          token: ${{ secrets.BOT_GITEA_TOKEN }}
          pr-label: docker-compose,manual
          assignee: ${{ github.actor }}

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
          notification_title: "GITEA: PR Check @ Rinoa"
          notification_message: "PR Check done 🎟️"

  plan:
    name: Terraform/OpenTofu Plan
    needs: check-and-create-pr
    runs-on: ubuntu-latest
    env:
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup OpenTofu / Terraform
        uses: opentofu/setup-opentofu@v1.0.6
        with:
          version: ${{ env.OPENTOFU_VERSION }}
          tofu_wrapper: true

      - name: Install Tea
        id: install-tea-pr-index
        env:
          TEA_VERSION: ${{ env.TEA_VERSION }}
          TEA_DL_URL: "https://dl.gitea.com/tea/${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64"
        shell: bash
        run: |
          set -euo pipefail
              cd /tmp

              wget -q "${TEA_DL_URL}"
              wget -q "${TEA_DL_URL}.sha256"

              # Read only the hash (strip whitespace)
              sha_value=$(cat "tea-${TEA_VERSION}-linux-amd64.sha256" | tr -d '[:space:]')

              # Verify using sha256sum
              echo "${sha_value}  tea-${TEA_VERSION}-linux-amd64" | sha256sum -c -

              mv "tea-${TEA_VERSION}-linux-amd64" /usr/bin/tea
              chmod +x /usr/bin/tea

              pr_number=$(tea pr ls --repo "${{ gitea.repository }}" \
                --state open \
                --fields index,state,head \
                --output simple \
                | awk '{print $1}')

              echo "${pr_number}"
              echo "pr_number=${pr_number}" >> "$GITHUB_OUTPUT"


      - name: Generate .env from Hashicorp Vault
        uses: https://git.trez.wtf/Trez/hc-vault-env@main
        with:
          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
          HC_VAULT_AUTH: token
          HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
          HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
          ENV_FILE_NAME: cloudflare/.env

      - name: Export env vars from Vault .env
        run: |
          echo "🧩 Cleaning and loading cloudflare/.env into GitHub Actions environment..."

          # 1️⃣ Strip any single or double quotes from the file to avoid invalid URIs or extra quoting
          sed -i 's/[\"'\'']//g' cloudflare/.env

          echo "✅ Cleaned .env content:"
          cat cloudflare/.env

          # 2️⃣ Load all vars into current shell
          set -a
          source cloudflare/.env
          set +a

          # 3️⃣ Export to GitHub Actions environment
          while IFS='=' read -r key value; do
            if [[ -n "$key" ]]; then
              echo "$key=$value" >> $GITHUB_ENV
            fi
          done < cloudflare/.env

          echo "🌍 Exported environment variables:"
          grep -E 'AWS_|VAULT_' cloudflare/.env || true

      - name: Run tofu init
        uses: dnogu/tofu-init@v1
        with:
          working-directory: .
          chdir: cloudflare

      - name: Tofu Plan
        id: tofu_plan
        continue-on-error: true
        uses: dnogu/tofu-plan@v1
        with:
          working-directory: .
          chdir: cloudflare
          # destroy:
          # refresh-only:
          # refresh:
          # replace:
          # target:
          # target-file:
          # exclude:
          # exclude-file:
          # var:
          # var-file:
          # out:
          # compact-warnings:
          # detailed-exitcode:
          # generate-config-out: .
          # input: true
          # json:
          # lock:
          # lock-timeout:
          # no-color:
          # concise:
          # parallelism:
          # state:
          # show-sensitive:
          # display-plan:

      - name: PR Comment
        uses: https://git.trez.wtf/Trez.One/git-auto-comment@main
        with:
          platform: gitea
          token: ${BOT_GITEA_TOKEN}
          pr_index: $${{ steps.install-tea-pr-index.outputs.pr_number }}
          comment_template: |
            ${{ steps.tofu_plan.outputs.plan-output }}
            ____________________________________
            ${{ steps.tofu_plan.outputs.exitcode }}

      # - name: Tofu Plan Comment
      #   id: tofu_plan
      #   uses: alexnorell/tofu-pr-commenter@v2.0.0
      #   with:
      #     commenter_type: plan
      #     commenter_input: ${{ steps.tofu_plan.outputs.plan-output }}
      #     commenter_exitcode: ${{ steps.tofu_plan.outputs.exitcode }}