name: TFLint & Plan - ALI 

on:
  pull_request:
    paths:
      - '.github/workflows/ali-*'
      - 'ali/**'
      - 'modules/**'
      - 'scripts/**'
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

jobs:
  tflint-plan:
    name: ALI tflint + terraform plan
    runs-on: ubuntu-latest

    steps:
    - name: Checkout branch
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    - name: Install Terraform
      uses: opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716 # v1.0.5
      with:
        terraform_version: 1.5.7
        terraform_wrapper: false

    - uses: terraform-linters/setup-tflint@444635365d380c7363d1eaee4267317c2445717d # v2.0.1
      name: Setup TFLint
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}

    - name: Install virtualenv
      run: pip install virtualenv

    - name: Install AWS CLI
      uses: unfor19/install-aws-cli-action@e8b481e524a99f37fbd39fdc1dcb3341ab091367 # v1.0.7
      with:
        arch: amd64

    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
      with:
        role-to-assume: arn:aws:iam::${{ secrets.PY_FOUNDATION_AWS_ACC_ID }}:role/${{ secrets.PY_FOUNDATION_AWS_DEPLOY_ROLE }}
        aws-region: us-east-1

    - name: "Run TFLint runners"
      shell: bash
      working-directory: ali
      run: make tflint

    - name: Make plan
      shell: bash
      working-directory: ali
      run: make plan
      env:
        TERRAFORM_EXTRAS: -lock-timeout=15m
