ci.yaml

---
name: CI

on: pull_request

jobs:
  fmt-validate:
    runs-on: ubuntu-22.04
    permissions:
      contents: read

    strategy:
      matrix:
        projects:
          - ''
          - 'examples/simple-repo/'
          - 'examples/json-files/'
          - 'examples/additional-claims/'
          - 'examples/github-enterprise/'
          - 'test'
      fail-fast: false

    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3.0.0

      - name: Terraform Format
        id: fmt
        run: terraform fmt -check
        working-directory: "./${{ matrix.projects }}"

      - name: Terraform Init
        id: init
        run: terraform init -input=false
        working-directory: "./${{ matrix.projects }}"

      - name: Terraform Validate
        id: validate
        run: terraform validate
        working-directory: "./${{ matrix.projects }}"

  pre-commit:
    # Note that changing architectures will cause terraform_providers_lock to fail
    runs-on: ubuntu-22.04
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3.0.0

      - name: Install Brew Packages
        # Need Bash 5 for terraform fmt in pre-commit hook
        # Nead realpath command for terraform_fmt which we get via coreutils
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          brew install actionlint bash coreutils terraform-docs tfsec pre-commit

      - name: Run Pre-Commit
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          pre-commit --version
          pre-commit run --all-files