deploy.yml

name: deploy

on:
  push:
    branches:
      - main

permissions:
  contents: read

env:
  WORKING_DIR: "terraform/"

jobs:
  deployment-check:
    runs-on: ubuntu-latest
    outputs: # set outputs for use in downstream jobs
      continue: ${{ steps.deployment-check.outputs.continue }}
      sha: ${{ steps.deployment-check.outputs.sha }}

    steps:
      # https://github.com/github/branch-deploy/blob/d3c24bd92505e623615b75ffdfac5ed5259adbdb/docs/merge-commit-strategy.md
      - name: deployment check
        uses: github/branch-deploy@v10
        id: deployment-check
        with:
          merge_deploy_mode: "true"
          environment: production

  deploy:
    if: ${{ needs.deployment-check.outputs.continue == 'true' && github.event_name == 'push' }}
    needs: deployment-check
    environment: production
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ env.WORKING_DIR }}

    steps:
      - name: checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.deployment-check.outputs.sha }}

      - uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # pin@v2.0.3
        with:
          terraform_version: 1.1.7
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform init
        run: terraform init

      - name: Terraform apply
        env:
          TF_VAR_CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
        run: terraform apply -auto-approve