action.yaml

name: TF Test
description: |
  Reusable GitHub Action to test Terraform/OpenTofu modules.
  AWS role ARN can be provided either:
  1. As an input parameter (aws_role_arn) - takes precedence
  2. As an environment variable (TF_TEST_AWS_ROLE_ARN).
     The use case for this is setting it in the GitHub organization's environment variable.
     See the README for more details.
author: hello@masterpoint.io
inputs:
  tf_type:
    required: true
    description: Type of terraform to use (tofu or terraform)
  aws_role_arn:
    required: false
    description: AWS role ARN to assume for testing (takes precedence over TF_TEST_AWS_ROLE_ARN env var)
  aws_region:
    required: false
    default: us-east-1
    description: AWS region to use
  github_token:
    required: true
    description: GitHub token for checkout
  working_directory:
    required: false
    default: .
    description: |
      Directory to run the tests from, relative to the repository root.
      Defaults to the repository root, which is what single-module repos want.
      Monorepos should set this to the directory of the module under test.
  role_session_name:
    required: false
    default: GitHubActions-TF-Test
    description: AWS role session name for OIDC authentication

runs:
  using: composite
  steps:
    - name: Checkout
      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      with:
        token: ${{ inputs.github_token }}
        # In pull_request_target, use the base repo's synthetic merge ref to avoid cross-repo clones
        # and to prevent running fork code with elevated credentials. Otherwise, fall back to sha.
        ref: ${{ (github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.number)) || github.event.pull_request.head.sha || github.sha }}
        # Always clone from the base repository to avoid permission issues with forks
        repository: ${{ github.repository }}
        # Do not persist credentials into the repo's local config (reduces risk of token exfiltration)
        persist-credentials: false
        # Faster, smaller checkout
        fetch-depth: 1

    - name: Aqua Cache
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
      if: ${{ !github.event.act }}
      with:
        path: ~/.local/share/aquaproj-aqua
        key: v1-aqua-installer-${{runner.os}}-${{runner.arch}}-${{hashFiles('aqua.yaml')}}
        restore-keys: |
          v1-aqua-installer-${{runner.os}}-${{runner.arch}}-

    - name: Install Aqua
      uses: aquaproj/aqua-installer@96a9bc20066c5bf5e275b41019cfc165b25f4e2e # v4.0.5
      with:
        aqua_version: v2.63.0

    - name: Aqua Install
      shell: bash
      run: aqua install --tags ${{ inputs.tf_type }}

    - name: Configure AWS Credentials
      if: ${{ inputs.aws_role_arn != '' || env.TF_TEST_AWS_ROLE_ARN != '' }}
      uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
      with:
        role-to-assume: ${{ inputs.aws_role_arn || env.TF_TEST_AWS_ROLE_ARN }}
        role-session-name: ${{ inputs.role_session_name }}
        aws-region: ${{ inputs.aws_region }}

    - name: Run TF Test
      shell: bash
      working-directory: ${{ inputs.working_directory }}
      run: |
        ${{ inputs.tf_type }} init
        ${{ inputs.tf_type }} test