general.yml

---
name: general

"on":
  workflow_dispatch:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout source
        id: source
        uses: actions/checkout@v4

      - name: Setup terraform
        id: terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform format
        id: fmt
        run: bin/terraform fmt -no-color -check

      - name: Terraform init
        id: init
        env:
          CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
          CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bin/terraform init -upgrade -no-color -input=false

      - name: Terraform validate
        id: validate
        env:
          CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
          CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bin/terraform validate -no-color
        continue-on-error: true

      - name: Terraform plan
        id: plan
        env:
          CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
          CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bin/terraform plan -no-color -input=false
        continue-on-error: true

      - name: Terraform status
        id: status
        if: steps.validate.outcome == 'failure' || steps.plan.outcome == 'failure'
        run: exit 1

      - name: Terraform apply
        id: apply
        env:
          CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
          CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
          AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
        run: bin/terraform apply -no-color -input=false -auto-approve

...