Terraform in CI/CD

name: Terraform Monitoring
on:
  push:
    branches: [main]
    paths: ['terraform/monitoring/**']
  pull_request:
    paths: ['terraform/monitoring/**']

jobs:
  terraform:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: terraform/monitoring
    env:
      DEVHELM_API_TOKEN: ${{ secrets.DEVHELM_API_TOKEN }}

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9

      - name: Init
        run: terraform init

      - name: Plan
        run: terraform plan -out=tfplan
        if: github.event_name == 'pull_request'

      - name: Apply
        run: terraform apply -auto-approve
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'

stages:
  - plan
  - apply

variables:
  TF_DIR: terraform/monitoring
  DEVHELM_API_TOKEN: $DEVHELM_API_TOKEN

plan:
  stage: plan
  image: hashicorp/terraform:1.9
  script:
    - cd $TF_DIR
    - terraform init
    - terraform plan -out=tfplan
  artifacts:
    paths: [terraform/monitoring/tfplan]

apply:
  stage: apply
  image: hashicorp/terraform:1.9
  script:
    - cd $TF_DIR
    - terraform init
    - terraform apply -auto-approve tfplan
  when: manual
  only: [main]

terraform {
  backend "s3" {
    bucket = "mycompany-terraform-state"
    key    = "devhelm/monitoring.tfstate"
    region = "us-east-1"
  }
}

provider "devhelm" {
  # Reads from DEVHELM_API_TOKEN env var automatically
}

variable "slack_webhook_url" {
  type      = string
  sensitive = true
}

      - name: Plan
        id: plan
        run: terraform plan -no-color -out=tfplan

      - uses: borchero/terraform-plan-comment@v2
        with:
          token: ${{ github.token }}
          planfile: terraform/monitoring/tfplan