terraform_apply.yaml

name: Terraform Apply

on:
  workflow_call:
    inputs:
      tf_token_keeper_path:
        required: true
        type: string
      aws_access_key_id_keeper_path:
        required: true
        type: string
      aws_secret_access_key_keeper_path:
        required: true
        type: string
      terraform_keeper_key_keeper_path:
        type: string
        default: dSbGhN1_J1tqv-4dzrm8hw/field/password
      tf_dir:
        required: true
        type: string
        default: "."
      cli_opts:
        required: false
        type: string
        default: " "
    secrets:
      KSM_CONFIG:
        required: true

jobs:
  terraform_apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        name: Checkout source code
      - name: Retrieve secrets from Keeper
        id: ksecrets
        uses: Keeper-Security/ksm-action@37abbada28637b6478ba845e73d3f8b9676572fe # master
        with:
          keeper-secret-config: ${{ secrets.KSM_CONFIG }}
          secrets: |-
            ${{ inputs.tf_token_keeper_path }} > env:TF_TOKEN
            ${{ inputs.aws_access_key_id_keeper_path }} > env:AWS_ACCESS_KEY_ID
            ${{ inputs.aws_secret_access_key_keeper_path }} > env:AWS_SECRET_ACCESS_KEY
            ${{ inputs.terraform_keeper_key_keeper_path }} > env:TF_KEEPER_KEY
      - name: Setup Nodejs
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: lts/*
          check-latest: true
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
        with:
          cli_config_credentials_token: ${{ env.TF_TOKEN }}
      - name: Terraform Init
        run: |
          cd ${{ inputs.tf_dir }}
          terraform init
      - name: Terraform Apply
        run: |
          cd ${{ inputs.tf_dir }}
          terraform apply -auto-approve -lock-timeout=120s
        env:
          KEEPER_CREDENTIAL: ${{ env.TF_KEEPER_KEY }}