name: Validate Terraform

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write

# Requires these repository secrets:
#   AGE_SECRET_KEY     — age private key for SOPS decryption

jobs:
  plan:
    name: tofu plan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@v2
        with:
          tofu_version: 1.9.0

      - name: Install SOPS
        run: |
          wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
          sudo dpkg -i /tmp/sops.deb

      - name: Decrypt secrets
        env:
          SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
        run: |
          find . -name '*.enc.yml' -o -name '*.enc.yaml' | while read f; do
            out="${f/.enc/}"
            sops -d "$f" > "$out"
            echo "Decrypted: $f -> $out"
          done

      - name: Set backend credentials
        working-directory: terraform/
        run: |
          echo "AWS_ACCESS_KEY_ID=$(yq '.backblaze_keyID' secrets.yaml)" >> "$GITHUB_ENV"
          echo "AWS_SECRET_ACCESS_KEY=$(yq '.backblaze_applicationKey' secrets.yaml)" >> "$GITHUB_ENV"

      - name: tofu init
        working-directory: terraform/
        run: tofu init

      - name: tofu validate
        working-directory: terraform/
        run: tofu validate

      - name: tofu plan
        id: plan
        working-directory: terraform/
        continue-on-error: true
        run: |
          set -o pipefail
          tofu plan -no-color 2>&1 | tee plan_output.txt

      - name: Post plan as PR comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const raw = fs.readFileSync('terraform/plan_output.txt', 'utf8');
            const truncated = raw.length > 65000
              ? raw.slice(0, 65000) + '\n\n...(output truncated)'
              : raw;
            const outcome = '${{ steps.plan.outcome }}';
            const header = outcome === 'failure' ? '## Terraform Plan — FAILED' : '## Terraform Plan';
            const body = `${header}\n\`\`\`\n${truncated}\n\`\`\``;

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.body.startsWith('## Terraform Plan'));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Fail if plan failed
        if: steps.plan.outcome == 'failure'
        run: exit 1