build-terraform-oci.yaml

---
name: "Publish Terraform as OCI"

on:
  workflow_dispatch:
  push:
    branches: ["main"]
    paths: ["terraform/**"]

jobs:
  changed-files:
    name: Generate Build Matrix
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Generate Token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        id: generate-token
        with:
          app_id: "${{ secrets.BOT_APP_ID }}"
          private_key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: "${{ steps.generate-token.outputs.token }}"
          fetch-depth: 0

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@bab30c2299617f6615ec02a68b9a40d10bd21366 # v45.0.5
        with:
          dir_names: true
          dir_names_max_depth: 2
          json: true
          files: |
            terraform/**
      - name: List all changed files
        run: |
          echo '${{ steps.changed-files.outputs.all_changed_files }}'
      - id: set-matrix
        run: echo "matrix={\"project\":${{ steps.changed-files.outputs.all_changed_files }}}" >> "${GITHUB_OUTPUT}"

  publish-terraform:
    name: Publish OCI
    runs-on: ubuntu-latest
    needs: [changed-files]
    strategy:
      matrix: ${{ fromJSON(needs.changed-files.outputs.matrix) }}
    steps:
      - name: Generate Token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        id: generate-token
        with:
          app_id: "${{ secrets.BOT_APP_ID }}"
          private_key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: "${{ steps.generate-token.outputs.token }}"

      - name: Set up Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Setup Tools
        run: |
          brew install fluxcd/tap/flux
      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish OCI
        run: |
          flux push artifact oci://ghcr.io/mchestr/terraform-$(basename ${{ matrix.project }})-oci:$(git rev-parse --short HEAD) \
              --path="./${{ matrix.project }}" \
              --source="$(git config --get remote.origin.url)" \
              --revision="$(git branch --show-current)/$(git rev-parse HEAD)"
      - name: Tag OCI
        run: |
          flux tag artifact oci://ghcr.io/mchestr/terraform-$(basename ${{ matrix.project }})-oci:$(git rev-parse --short HEAD) \
              --tag main