name: Terraform CI

on:
  pull_request:
    branches: [dev, staging, main]
    paths:
      - "terraform/**"
      - "scripts/check-terraform-import-plan.py"
      - "scripts/test-terraform-import-plan-check.py"
      - ".github/workflows/ci-terraform.yaml"
  push:
    branches: [dev, staging, main]
    paths:
      - "terraform/**"
      - "scripts/check-terraform-import-plan.py"
      - "scripts/test-terraform-import-plan-check.py"
      - ".github/workflows/ci-terraform.yaml"

permissions:
  contents: read

jobs:
  terraform:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        dir:
          - terraform
          - terraform/bootstrap
          - terraform/live/dev
          - terraform/live/staging
    defaults:
      run:
        working-directory: ${{ matrix.dir }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.9.8"

      - name: Terraform fmt
        run: terraform fmt -check -recursive

      - name: Terraform init
        run: terraform init -backend=false

      - name: Terraform validate
        run: terraform validate