terraform¶

# Infrastructure code: check formatting and validate each stack that changed.
#
# A stack is a directory under stacks/. Its step is given that stack and the
# shared modules, so a stack nobody touched keeps its earlier result.

TF = "hashicorp/terraform:1.9"

def ci(ctx):
    steps = [step("fmt", image = TF, run = "terraform fmt -check -recursive", inputs = ["**/*.tf"])]

    stacks = []
    for f in ctx.changed_files:
        parts = f.split("/")
        if parts[0] == "stacks" and len(parts) > 2 and parts[1] not in stacks:
            stacks.append(parts[1])

    for stack in sorted(stacks):
        steps.append(step(
            "validate " + stack,
            image = TF,
            run = "cd stacks/{} && terraform init -backend=false -input=false && terraform validate".format(stack),
            inputs = ["stacks/" + stack, "modules"],
            caches = {"terraform-plugins": "/root/.terraform.d/plugin-cache"},
            env = {"TF_PLUGIN_CACHE_DIR": "/root/.terraform.d/plugin-cache"},
        ))
    return steps

# Generated by `starci compile` from terraform.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - The script decides by which files a commit changed. A workflow file
#    cannot, so it does what the script does when nothing is known about the
#    changes, on every run.
#  - Passes are remembered in this repository's Actions cache, which GitHub
#    scopes by branch and evicts when old. starci's own store has neither
#    limit.

name: CI

on:
  push:
    branches: ['**']
    tags: ['**']
  pull_request:
  workflow_dispatch:

jobs:
  fmt:
    name: "fmt"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /**/*.tf
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-fmt-3c3845d037a10c2d-${{ hashFiles('**/*.tf') }}
      - name: "fmt"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            terraform fmt -check -recursive
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            hashicorp/terraform:1.9 sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

# Generated by `starci compile --target circleci` from terraform.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - The script reads ctx.changed_files, so its plan depends on the commit.
#    This file is the plan for a commit about which nothing is known, and is
#    the same for every push: steps the script would add or drop for a
#    particular branch or set of changed files are not represented.
#  - Passes are remembered in this project's CircleCI cache, which expires.
#    starci's own store does not.

version: 2.1

jobs:
  fmt:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Keep only this step's inputs"
          command: |
            git sparse-checkout set --no-cone '/**/*.tf'
      - run:
          name: "Identify the inputs"
          command: |
            git ls-files -s -- ':(top,glob)**/*.tf' > /tmp/starci-inputs
      - restore_cache:
          name: Has this already passed with these inputs?
          keys:
            - starci-passed-fmt-3c3845d037a10c2d-{{ checksum "/tmp/starci-inputs" }}
      - run:
          name: "Stop here if it has"
          command: |
            if [ -e ~/starci-passed/at ]; then
              echo "Passed before with the same inputs, on $(cat ~/starci-passed/at). Nothing to do."
              circleci-agent step halt
            fi
      - run:
          name: "fmt"
          environment:
            STARCI_RUN: |-
              terraform fmt -check -recursive
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              hashicorp/terraform:1.9 sh -c "$STARCI_RUN"
      - run:
          name: "Remember this pass"
          command: |
            mkdir -p ~/starci-passed && date > ~/starci-passed/at
      - save_cache:
          key: starci-passed-fmt-3c3845d037a10c2d-{{ checksum "/tmp/starci-inputs" }}
          paths:
            - ~/starci-passed

workflows:
  ci:
    jobs:
      - fmt