tfaction を段階的に導入した

.github/workflows/terragrunt_plan.yml

name: Terragrunt Plan

on:
  pull_request:
    branches:
    - master
    - staging
    paths:
    - "terragrunt/**"
  
  push:
    branches:
    - master
    paths:
    - "terragrunt/**"

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      targets: ${{ steps.list-targets.outputs.targets }}
    permissions:
      contents: read
      pull-requests: write 
    steps:
    - uses: actions/checkout@v4
    
    - uses: actions/cache@v4
      env:
        tfaction_version: v1.16.1 
      with:
        path: ~/.local/share/aquaproj-aqua
        
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-for-tfaction-${{env.tfaction_version}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-
    
    - uses: aquaproj/aqua-[email protected]
      with:
        aqua_version: v2.51.1 
    
    - name: Install terragrunt
      uses: jaxxstorm/action-install-gh-[email protected]
      with:
        repo: gruntwork-io/terragrunt
        tag: v0.81.0 
        cache: enable
        rename-to: terragrunt
        chmod: 0755
        extension-matching: disable
    
    - uses: hashicorp/setup-[email protected]
      with:
        terraform_version: "1.12.2" 
        terraform_wrapper: false 
    
    - uses: suzuki-shunsuke/tfaction/list-[email protected]
      id: list-targets
      with:
        github_token: ${{ github.token }}

  terragrunt-plan:
    name: "terragrunt-plan for ${{ matrix.target.target }}"
    runs-on: ubuntu-latest
    needs: setup
    
    if: github.event_name == 'pull_request' && join(fromJSON(needs.setup.outputs.targets), '') != ''
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJSON(needs.setup.outputs.targets) }}
    permissions:
      id-token: write
      contents: write
      pull-requests: write
      issues: write
    env:
      TFACTION_TARGET: ${{ matrix.target.target }}
      TFACTION_JOB_TYPE: terraform
    steps:
    - uses: actions/checkout@v4
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-[email protected]
      with:
        role-to-assume: ${{ secrets.TERRAGRUNT_AWS_IAM_ROLE_ARN }}
        aws-region: ${{ vars.AWS_REGION }}
    
    - uses: actions/cache@v4
      env:
        tfaction_version: v1.16.1 
      with:
        path: ~/.local/share/aquaproj-aqua
        
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-for-tfaction-${{env.tfaction_version}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-
    
    - uses: aquaproj/aqua-[email protected]
      with:
        aqua_version: v2.51.1 
    - name: Install terragrunt
      uses: jaxxstorm/action-install-gh-[email protected]
      with:
        repo: gruntwork-io/terragrunt
        tag: v0.81.0 
        cache: enable
        rename-to: terragrunt
        chmod: 0755
        extension-matching: disable
    - uses: hashicorp/setup-[email protected]
      with:
        terraform_version: "1.12.2" 
        terraform_wrapper: false 
    - uses: suzuki-shunsuke/tfaction/[email protected]
      env:
        TG_TF_FORWARD_STDOUT: "true"
    - uses: suzuki-shunsuke/tfaction/[email protected]
      env:
        TG_TF_FORWARD_STDOUT: "true"

tfaction-root.yaml

plan_workflow_name: Terragrunt Plan



update_local_path_module_caller:
  enabled: true

terraform_command: terragrunt

target_groups:
- working_directory: terragrunt/xxxx
  target: xxxx

tfcmt.yaml

terraform:
  plan:
    disable_label: true
templates:
  
  plan_title: "## {{if eq .ExitCode 1}}:x: {{end}}terragrunt plan result{{if .Vars.target}} ({{.Vars.target}}){{end}}"

.github/workflows/terragrunt_plan.yml

name: Terragrunt Plan

on:
  pull_request:
    branches:
    - master
    - production
    paths:
    - "terragrunt/**"
  
  push:
    branches:
    - master
    paths:
    - "terragrunt/**"

jobs:
  setup:
    uses: ./.github/workflows/terragrunt_setup.yml
    secrets: inherit
    with:
      
      target_envs: |-
        ${{
          github.base_ref == 'master' && 'production staging review' ||
          github.base_ref == 'production' && 'production' ||
        }}

  terragrunt-plan:
    name: "terragrunt-plan for ${{ matrix.target.target }}"
    runs-on: ubuntu-latest
    needs: setup
    
    
    if: github.event_name == 'pull_request' && join(fromJSON(needs.setup.outputs.targets), '') != ''
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJSON(needs.setup.outputs.targets) }}
    permissions:
      id-token: write
      contents: read
    env:
      TFACTION_TARGET: ${{ matrix.target.target }}
      TFACTION_JOB_TYPE: terraform
    steps:
    
    - uses: actions/create-github-app-[email protected]
      id: tfaction-app-token
      with:
        app-id: ${{ vars.INFRA_TFACTION_GITHUB_APP_ID }}
        private-key: ${{ secrets.INFRA_TFACTION_GITHUB_APP_PRIVATE_KEY }}
        permission-issues: write 
        permission-pull-requests: write 
        permission-contents: write 
    - id: export-target
      name: Export target service and env from matrix.target.target
      env:
        target: ${{ matrix.target.target }}
      run: |
        # $target: production/account
        # $env: production
        # $service: account
        env=$(echo "$target" | cut -d "https://zenn.dev/" -f 1)
        service=$(echo "$target" | cut -d "https://zenn.dev/" -f 2)

        echo "env: $env"
        echo "service: $service"

        echo "env=$env" >> "$GITHUB_OUTPUT"
        echo "service=$service" >> "$GITHUB_OUTPUT"
    - uses: actions/checkout@v4
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-[email protected]
      with:
        role-to-assume: ${{ secrets.TERRAGRUNT_AWS_IAM_ROLE_ARN }}
        aws-region: ${{ vars.AWS_REGION }}
    
    - uses: actions/cache@v4
      env:
        tfaction_version: v1.16.1 
      with:
        path: ~/.local/share/aquaproj-aqua
        
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-for-tfaction-${{env.tfaction_version}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-
    
    - uses: aquaproj/aqua-[email protected]
      with:
        aqua_version: v2.51.1 
    - name: Install terragrunt
      uses: jaxxstorm/action-install-gh-[email protected]
      with:
        repo: gruntwork-io/terragrunt
        tag: v0.81.0 
        cache: enable
        rename-to: terragrunt
        chmod: 0755
        extension-matching: disable
    - uses: hashicorp/setup-[email protected]
      with:
        terraform_version: "1.12.2" 
        terraform_wrapper: false 
    - uses: terraform-linters/setup-[email protected]
      with:
        tflint_version: v0.50.3 
    - uses: shmokmt/actions-setup-github-[email protected]
      with:
        version: v6.3.2 
    - name: Hide old PR comments
      run: github-comment exec -k hide -- github-comment hide -k tfcmt
      env:
        GITHUB_TOKEN: ${{ steps.tfaction-app-token.outputs.token }}
        GH_COMMENT_VAR_tfaction_target: ${{ env.TFACTION_TARGET }}
    
    - uses: suzuki-shunsuke/tfaction/[email protected]
      with:
        github_token: ${{ steps.tfaction-app-token.outputs.token }}
      env:
        TG_TF_FORWARD_STDOUT: "true"
    
    - uses: suzuki-shunsuke/tfaction/[email protected]
      with:
        github_token: ${{ steps.tfaction-app-token.outputs.token }}
      env:
        GITHUB_TOKEN: ${{ steps.tfaction-app-token.outputs.token }} 
        TFLINT_CONFIG_FILE: "${{ github.workspace }}/.tflint.hcl"
        TG_TF_FORWARD_STDOUT: "true"
    - uses: suzuki-shunsuke/tfaction/[email protected]
      with:
        github_token: ${{ steps.tfaction-app-token.outputs.token }}
      env:
        GITHUB_TOKEN: ${{ steps.tfaction-app-token.outputs.token }} 
        TG_TF_FORWARD_STDOUT: "true"

  
  test-module:
    name: "test-module for ${{ matrix.module }}"
    runs-on: ubuntu-latest
    needs: setup
    
    
    if: github.event_name == 'pull_request' && join(fromJSON(needs.setup.outputs.modules), '') != ''
    strategy:
      fail-fast: false
      matrix:
        module: ${{ fromJSON(needs.setup.outputs.modules) }}
    permissions:
      id-token: write
      contents: read
    env:
      TFACTION_TARGET: ${{ matrix.module }}
      TFACTION_JOB_TYPE: terraform
    steps:
    
    - uses: actions/create-github-app-[email protected]
      id: tfaction-app-token
      with:
        app-id: ${{ vars.INFRA_TFACTION_GITHUB_APP_ID }}
        private-key: ${{ secrets.INFRA_TFACTION_GITHUB_APP_PRIVATE_KEY }}
        permission-pull-requests: write 
        permission-contents: write 
    - uses: actions/checkout@v4
    
    - uses: actions/cache@v4
      env:
        tfaction_version: v1.16.1 
      with:
        path: ~/.local/share/aquaproj-aqua
        
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-for-tfaction-${{env.tfaction_version}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-
    
    - uses: aquaproj/aqua-[email protected]
      with:
        aqua_version: v2.51.1 
    - name: Install terragrunt
      uses: jaxxstorm/action-install-gh-[email protected]
      with:
        repo: gruntwork-io/terragrunt
        tag: v0.81.0 
        cache: enable
        rename-to: terragrunt
        chmod: 0755
        extension-matching: disable
    - uses: hashicorp/setup-[email protected]
      with:
        terraform_version: "1.12.2" 
        terraform_wrapper: false 
    - uses: terraform-linters/setup-[email protected]
      with:
        tflint_version: v0.50.3 
    
    - uses: suzuki-shunsuke/tfaction/[email protected]
    - uses: ./.github/actions/test-module
      with:
        github_token: ${{ steps.tfaction-app-token.outputs.token }}
      env:
        TFLINT_CONFIG_FILE: "${{ github.workspace }}/.tflint.hcl"

  
  
  terragrunt-plan-status-check:
    runs-on: ubuntu-latest
    needs: [terragrunt-plan, test-module]
    if: failure()
    steps:
    - run: exit 1

.github/workflows/terragrunt_apply.yml

name: Terragrunt Apply

on:
  push:
    branches:
    - master
    - staging
    paths:
    - "terragrunt/**"

jobs:
  setup:
    uses: ./.github/workflows/terragrunt_setup.yml
    secrets: inherit
    with:
      target_envs: |-
        ${{
          github.ref_name == 'master' && 'production' ||
          github.ref_name == 'staging' && 'staging'
        }}

  terragrunt-apply:
    name: "terragrunt-apply for ${{ matrix.target.target }}"
    runs-on: ubuntu-latest
    needs: setup
    
    if: join(fromJSON(needs.setup.outputs.targets), '') != ''
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJSON(needs.setup.outputs.targets) }}
    permissions:
      id-token: write
      contents: read
    env:
      TFACTION_IS_APPLY: "true"
      TFACTION_TARGET: ${{ matrix.target.target }}
      TFACTION_JOB_TYPE: terraform
    steps:
    
    - uses: actions/create-github-app-[email protected]
      id: tfaction-app-token
      with:
        app-id: ${{ vars.INFRA_TFACTION_GITHUB_APP_ID }}
        private-key: ${{ secrets.INFRA_TFACTION_GITHUB_APP_PRIVATE_KEY }}
        permission-actions: read 
        permission-issues: write 
        permission-pull-requests: write 
        permission-contents: write 
    - id: export-target
      name: Export target service and env from matrix.target.target
      env:
        target: ${{ matrix.target.target }}
      run: |
        # $target: production/account
        # $env: production
        # $service: account
        env=$(echo "$target" | cut -d "https://zenn.dev/" -f 1)
        service=$(echo "$target" | cut -d "https://zenn.dev/" -f 2)

        echo "env: $env"
        echo "service: $service"

        echo "env=$env" >> "$GITHUB_OUTPUT"
        echo "service=$service" >> "$GITHUB_OUTPUT"
    - uses: actions/checkout@v4
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-[email protected]
      with:
        role-to-assume: ${{ secrets.TERRAGRUNT_AWS_IAM_ROLE_ARN }}
        aws-region: ${{ vars.AWS_REGION }}
    
    - uses: actions/cache@v4
      env:
        tfaction_version: v1.16.1 
      with:
        path: ~/.local/share/aquaproj-aqua
        
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-for-tfaction-${{env.tfaction_version}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-
    
    - uses: aquaproj/aqua-[email protected]
      with:
        aqua_version: v2.51.1 
    - name: Install terragrunt
      uses: jaxxstorm/action-install-gh-[email protected]
      with:
        repo: gruntwork-io/terragrunt
        tag: v0.81.0 
        cache: enable
        rename-to: terragrunt
        chmod: 0755
        extension-matching: disable
    - uses: hashicorp/setup-[email protected]
      with:
        terraform_version: "1.12.2" 
        terraform_wrapper: false 
    
    - uses: suzuki-shunsuke/tfaction/[email protected]
      with:
        github_token: ${{ steps.tfaction-app-token.outputs.token }}
      env:
        TG_TF_FORWARD_STDOUT: "true"
    - name: terragrunt apply
      id: apply
      uses: suzuki-shunsuke/tfaction/[email protected]
      with:
        github_token: ${{ steps.tfaction-app-token.outputs.token }}
      env:
        TG_TF_FORWARD_STDOUT: "true"
        TG_LOG_LEVEL: warn 
    - name: create failure message
      if: failure()
      id: slack_failure_message
      run: |
        message=$(cat 
        EOS
        )

        {
          echo 'message} >> "$GITHUB_OUTPUT"
    - name: create success message
      id: slack_success_message
      working-directory: ${{ matrix.target.working_directory }}
      env:
        TFPLAN_FILE_PATH: tfplan.binary
      run: |
        ls -al ./ # to debug
        TERRAGRUNT_CHANGES=$(terragrunt show -json "$TFPLAN_FILE_PATH" | jq '.applyable')

        if [ "$TERRAGRUNT_CHANGES" = 'false' ]; then
          message=$(cat *${{ github.actor }}* による *${{ github.ref_name }}* Mergeによって *${{ matrix.target.target }}* への terragrunt apply による差分はありませんでした
        EOS
          )
        else
          message=$(cat *${{ github.actor }}* による *${{ github.ref_name }}* Mergeによって *${{ matrix.target.target }}* への terragrunt apply が実行されました。
        正常に完了しました
        ://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|Workflow URL>
        EOS
          )
        fi

        {
          echo 'message} >> "$GITHUB_OUTPUT"
    - name: Send Slack notification
      if: always()
      uses: ./.github/actions/slack_custom_notification
      with:
        
        message: ${{ steps.slack_success_message.outputs.message }}${{ steps.slack_failure_message.outputs.message }}
        slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL_DEV_TEAM_INFRA }}

.github/workflows/terragrunt_setup.yml

name: Terragrunt Setup

on:
  workflow_call:
    inputs:
      target_envs:
        required: true
        type: string
        description: 'plan/apply 対象の env。スペース区切りで複数指定可能'
    outputs:
      targets:
        description: '変更があった Terragrunt ルートモジュール'
        value: ${{ jobs.setup.outputs.targets }}
      modules:
        description: '変更があった Terragrunt 共有モジュール'
        value: ${{ jobs.setup.outputs.modules }}

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      targets: ${{ steps.filtered-targets.outputs.targets }}
      modules: ${{ steps.list-targets.outputs.modules }}
    permissions:
      contents: read
      pull-requests: write 
    steps:
    - uses: actions/checkout@v4
    
    - uses: actions/cache@v4
      env:
        tfaction_version: v1.16.1 
      with:
        path: ~/.local/share/aquaproj-aqua
        
        key: v2-aqua-installer-${{runner.os}}-${{runner.arch}}-for-tfaction-${{env.tfaction_version}}
        restore-keys: |
          v2-aqua-installer-${{runner.os}}-${{runner.arch}}-
    
    - uses: aquaproj/aqua-[email protected]
      with:
        aqua_version: v2.51.1 
    
    - name: Install terragrunt
      uses: jaxxstorm/action-install-gh-[email protected]
      with:
        repo: gruntwork-io/terragrunt
        tag: v0.81.0 
        cache: enable
        rename-to: terragrunt
        chmod: 0755
        extension-matching: disable
    
    - uses: hashicorp/setup-[email protected]
      with:
        terraform_version: "1.12.2" 
        terraform_wrapper: false 
    
    - uses: suzuki-shunsuke/tfaction/list-[email protected]
      id: list-targets
      with:
        github_token: ${{ github.token }}
    
    - name: Exclude all but the target env
      id: filtered-targets
      env:
        targets: ${{ steps.list-targets.outputs.targets }}
        target_envs: ${{ inputs.target_envs }}
      run: |
        outputs="[]"

        for target_env in ${target_envs}; do
          
          
          filtered_targets=$(echo "$targets" | jq -c "map(select(
            (.working_directory | startswith(\"terragrunt/envs/$target_env\"))
          ))")

          echo "filtered_targets: $filtered_targets"

          
          outputs=$(jq -n -c --argjson a "$outputs" --argjson b "$filtered_targets" '$a + $b')
        done

        echo "outputs: $outputs"
        echo "targets=$outputs" >> "$GITHUB_OUTPUT"

tfaction-root.yaml

plan_workflow_name: Terragrunt Plan



update_local_path_module_caller:
  enabled: true






tflint:
  enabled: true
  fix: true


trivy:
  enabled: false

providers_lock_opts: -platform=linux_amd64 -platform=linux_arm64 -platform=darwin_arm64

target_groups:
target_groups:
- working_directory: terragrunt/envs/production/xxxx
  target: production/xxxx
  terraform_command: terragrunt
- working_directory: terragrunt/envs/staging/xxxx
  target: staging/xxxx
  terraform_command: terragrunt
- working_directory: terragrunt/envs/review/xxxx
  target: review/xxx
  terraform_command: terragrunt