validate.yml

name: Validate

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: validate-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  TOFU_VERSION: "1.12.5"
  TFLINT_VERSION: "v0.60.0"
  TF_PLUGIN_CACHE_DIR: /home/runner/.terraform.d/plugin-cache

jobs:
  changes:
    name: Accelerator change scope
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      accelerator: ${{ steps.scope.outputs.accelerator }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Detect native infrastructure changes
        id: scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
            echo "accelerator=true" >> "$GITHUB_OUTPUT"
          elif [[ ! "$BASE_SHA" =~ ^[a-f0-9]{40}$ ]] || ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
            echo "::notice::Comparison base unavailable; running all Accelerator checks."
            echo "accelerator=true" >> "$GITHUB_OUTPUT"
          else
            if git diff --quiet "$BASE_SHA" "$GITHUB_SHA" -- src mise.toml .tflint.hcl .pre-commit-config.yaml .github/workflows/validate.yml; then
              echo "accelerator=false" >> "$GITHUB_OUTPUT"
            else
              status=$?
              if [[ "$status" -ne 1 ]]; then
                echo "::error::Unable to determine Accelerator change scope."
                exit "$status"
              fi
              echo "accelerator=true" >> "$GITHUB_OUTPUT"
            fi
          fi

  format:
    name: Format
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.accelerator == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version: ${{ env.TOFU_VERSION }}

      - name: Check formatting
        run: tofu -chdir=src fmt -check -diff -recursive

  tflint:
    name: TFLint
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.accelerator == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@1cf010d3c7aef302051ccdb68c14c5dc2efa34ef # v6.3.1
        with:
          tflint_version: ${{ env.TFLINT_VERSION }}

      - name: Show version
        run: tflint --version

      - name: Init TFLint
        run: tflint --chdir=src --init

      - name: Run TFLint (blocking except unused declarations)
        run: tflint --chdir=src --recursive --format compact --minimum-failure-severity=warning --disable-rule=terraform_unused_declarations --disable-rule=terraform_required_providers

      - name: Run TFLint (unused declarations report only)
        continue-on-error: true
        run: tflint --chdir=src --recursive --format compact --only=terraform_unused_declarations

  validate:
    name: Validate
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.accelerator == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version: ${{ env.TOFU_VERSION }}

      - name: Cache provider plugins
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
          key: tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-${{ hashFiles('src/**/terraform.tf') }}
          restore-keys: |
            tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-

      - name: Initialize and validate Terraform configurations
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p "$TF_PLUGIN_CACHE_DIR"
          mapfile -t terraform_directories < <(
            find src -type f -name '*.tf' -not -path '*/.terraform/*' -printf '%h\n' | sort -u
          )

          for directory in "${terraform_directories[@]}"; do
            echo "Validating $directory"
            tofu -chdir="$directory" init -backend=false -input=false -no-color
            tofu -chdir="$directory" validate -no-color
          done

  test:
    name: Configuration Tests
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.accelerator == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version: ${{ env.TOFU_VERSION }}

      - name: Cache provider plugins
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
          key: tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-${{ hashFiles('src/**/terraform.tf') }}
          restore-keys: |
            tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-

      - name: Initialize test configuration
        run: |
          mkdir -p "$TF_PLUGIN_CACHE_DIR"
          tofu -chdir=src init -backend=false -input=false -no-color

      - name: Run configuration tests
        run: tofu -chdir=src test -no-color

      - name: Run independent Application configuration tests
        run: |
          tofu -chdir=src/application init -backend=false -input=false -no-color
          tofu -chdir=src/application test -no-color