reusable-validate.yaml

name: reusable/validate
on:
  workflow_call:
    secrets:
      appId:
        description: 'GitHub Application ID'
        required: false

      appPrivateKey:
        description: 'GitHub Application private key'
        required: false

    inputs:
      terraformVersion:
        description: 'Defines terraform version to use'
        required: true
        type: string

      moduleRootDirectory:
        description: 'Defines root module directory'
        required: true
        type: string
        
jobs:
  validate:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ inputs.moduleRootDirectory }}
    steps:
      - name: Terraform-SetupWithCloud
        uses: hashicorp/setup-terraform@v3.1.2
        with:
          terraform_version: ${{ inputs.terraformVersion }}

      - name: Checkout
        uses: actions/checkout@v4

      - name: Generate token
        env:
          APP_ID: ${{ secrets.appId }}
          PRIVATE_KEY: ${{ secrets.appPrivateKey }}
        if: ${{ env.APP_ID != null && env.PRIVATE_KEY != null }}
        id: generate_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.appId }}
          private_key: ${{ secrets.appPrivateKey }}
    
      - name: authenticate to git with app token
        env:
          APP_ID: ${{ secrets.appId }}
          PRIVATE_KEY: ${{ secrets.appPrivateKey }}
        if: ${{ env.APP_ID != null && env.PRIVATE_KEY != null }}
        run: |
          echo ${{ steps.generate_token.outputs.token }} | gh auth login --with-token
          gh auth setup-git

      - name: Format
        run: |
          terraform fmt -write=false -diff -check
          
      - name: Validate
        run: |
          terraform init --backend=false
          terraform validate