sandbox.yml

name: Sandbox

on:
  workflow_dispatch:
  pull_request:
    types:
      - opened
      - synchronize
    paths-ignore:
      - "**.md"

# For reusable workflows, the permissions setting for id-token should be set to write at the
# caller workflow level or in the specific job that calls the reusable workflow.

permissions:
  id-token: write

jobs:
  main:
    name: "Main"
    uses: osinfra-io/github-terraform-gcp-called-workflows/.github/workflows/plan-and-apply.yml@v0.2.5
    if: github.actor != 'dependabot[bot]'
    with:
      checkout_ref: ${{ github.ref }}
      environment: sandbox
      github_environment: "Sandbox: Main"
      service_account: plt-lz-backend-github@ptl-lz-terraform-tf91-sb.iam.gserviceaccount.com
      terraform_plan_args: -var-file=tfvars/sandbox.tfvars
      terraform_state_bucket: plt-lz-backend-2c8b-sb
      terraform_version: ${{ vars.TERRAFORM_VERSION }}
      terraform_workspace: main-sandbox
      workload_identity_provider: projects/746490462722/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
    secrets:
      gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
      infracost_api_key: ${{ secrets.INFRACOST_API_KEY }}
      terraform_plan_secret_args: >-
        -var=datadog_api_key=${{ secrets.DATADOG_API_KEY }}
        -var=datadog_app_key=${{ secrets.DATADOG_APP_KEY }}