Adding PR Merge and Apply jobs, artifact handling.

.gitea/workflows/cloudflare-auto-pr-tofu-pipeline.yml

@@ -59,7 +59,7 @@ jobs:
           notification_message: "PR Check done 🎟️"
 
   plan-approval:
-    name: OpenTofu Plan
+    name: OpenTofu Plan and Approval
     needs: check-and-create-pr
     runs-on: ubuntu-latest
     env:
@@ -71,7 +71,7 @@ jobs:
       VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
     outputs:
       tofu-cloudflare-plan: ${{ steps.tofu_plan.outputs.plan-output }}
-
+      approval_status: ${{ steps.tf-plan-approval.outputs.approval_status }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -144,6 +144,14 @@ jobs:
           chdir: cloudflare
           out: cloudflare.tfplan
 
+      - run: pwd
+
+      - name: Upload Tofu Plan as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: cloudflare-tfplan
+          path: cloudflare.tfplan
+
       - name: Strip ANSI codes
         id: plain-tofu-plan
         uses: marcransome/remove-ansi-colors@v1.7.56
@@ -190,34 +198,91 @@ jobs:
             ```
             </details>
 
-      - run: echo ${{ steps.tf-plan-approval.outputs.approval_status }}
+  pr-merge:
+    name: PR Merge
+    needs: [check-and-create-pr, plan-approval]
+    env:
+      pr_index: ${{ needs.check-and-create-pr.outputs.pr_number }}
+    if: github.ref != 'refs/heads/main' && ${{ needs.plan-approval.outputs.approval_status == 'approved' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-  # apply:
+      - name: Install tea
-  #   name: Apply Tofu Plan
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
-  #   needs: plan-approval
+        with:
-  #   runs-on: ubuntu-latest
+          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
-  #   if: ${{ needs.plan-approval.result == 'success' }}
+          name: tea
-  #   env:
+          version: ${{ env.TEA_VERSION }}
-  #     VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+
-  #   steps:
+      - name: PR Merge
-  #     - name: Checkout
+        id: pr_merge
-  #       uses: actions/checkout@v4
+        run: |
-  #
+          tea login add \
-  #     - name: Setup OpenTofu
+            --name gitea-rinoa \
-  #       uses: opentofu/setup-opentofu@v1.0.6
+            --url "${{ secrets.TREZ_GITEA_URL }}" \
-  #       with:
+            --user gitea-sonarqube-bot \
-  #         version: ${{ env.OPENTOFU_VERSION }}
+            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
-  #         tofu_wrapper: true
+            --token ${{ secrets.BOT_GITEA_TOKEN }}
-  #
+
-  #     - name: Export env from Vault
+          tea login default gitea-rinoa
-  #       run: |
+
-  #         set -a
+          echo "Merging PR..."
-  #         source cloudflare/.env
+
-  #         set +a
+          tea pr m \
-  #
+            --repo ${{ github.repository }} \
-  #     - name: Run Tofu Apply
+            --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" \
-  #       uses: dnogu/tofu-apply@v1
+            --message "Merged by ${{ github.actor }}" ${pr_index}
-  #       with:
+
-  #         working-directory: .
+          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
-  #         chdir: cloudflare
+
-  #         plan: cloudflare.tfplan
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Merge Successful"
+          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."
+
+  apply:
+    name: Apply Tofu Plan
+    needs: [plan-approval,pr-merge]
+    runs-on: ubuntu-latest
+    if: ${{ needs.plan-approval.outputs.approval_status == 'approved' }}
+    env:
+      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download Tofu Plan
+        uses: actions/download-artifact@v3
+        with:
+          name: cloudflare-tfplan
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@v1.0.6
+        with:
+          version: ${{ env.OPENTOFU_VERSION }}
+          tofu_wrapper: true
+
+      - name: Export env vars from Vault .env
+        id: env-vault-vars
+        run: |
+          sed -i 's/[\"'\'']//g' cloudflare/.env
+          set -a
+          source cloudflare/.env
+          set +a
+          while IFS='=' read -r key value; do
+            if [[ -n "$key" ]]; then
+              echo "$key=$value" >> $GITHUB_ENV
+            fi
+          done < cloudflare/.env
+
+      # - name: Run Tofu Apply
+      #   uses: dnogu/tofu-apply@v1
+      #   with:
+      #     working-directory: .
+      #     chdir: cloudflare
+      #     plan: cloudflare.tfplan