name: Common issues check

on: [pull_request]

env:
  # Prevent GH API rate-limit issue
  GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

jobs:
  pre-commit:
    runs-on: [self-hosted]
    container: python:3.12-slim@sha256:36d57d7f9948fefe7b6092cfe8567da368033e71ba281b11bb9eeffce3d45bc6
    steps:
    - name: Install container pre-requirements
      run: |
        apt update
        apt install -y \
            git \
            curl \
            unzip \
            jq \
            shellcheck \
            nodejs # Needed for Terraform installation
        curl -L https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 > /usr/bin/yq &&\
          chmod +x /usr/bin/yq
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.base_ref }}

    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - run: |
        git config --global --add safe.directory /__w/infrastructure/infrastructure
        git fetch --no-tags --prune --depth=1 origin +refs/heads/*:refs/remotes/origin/*

    - name: Get changed files
      id: file_changes
      run: |
        export DIFF=$(git diff --name-only origin/${{ github.base_ref }} ${{ github.sha }})
        echo "Diff between ${{ github.base_ref }} and ${{ github.sha }}"
        echo "files=$( echo "$DIFF" | xargs echo )" >> $GITHUB_OUTPUT

    - name: TFLint cache plugin dir
      uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
      with:
        path: ~/.tflint.d/plugins
        key: ubuntu-latest-tflint-${{ hashFiles('.tflint.hcl') }}

    - name: Setup TFLint
      uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
      with:
        github_token: "${{ secrets.GITHUB_TOKEN }}"

    - name: Init TFLint
      run: tflint --init

    - name: Setup Terraform docs
      env:
        # renovate: datasource=github-releases depName=terraform-docs lookupName=terraform-docs/terraform-docs
        TERRAFORM_DOCS_VERSION: '0.17.0'
      run: |
        curl -L https://github.com/terraform-docs/terraform-docs/releases/download/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz > terraform-docs.tgz \
          && tar -xzf terraform-docs.tgz terraform-docs && rm terraform-docs.tgz \
          && chmod +x terraform-docs && mv terraform-docs /usr/bin/

    - name: Setup tfupdate
      env:
        # renovate: datasource=github-releases depName=tfupdate lookupName=minamijoyo/tfupdate
        TFUPDATE_VERSION: '0.8.1'
      run: |
        curl -L https://github.com/minamijoyo/tfupdate/releases/download/v${TFUPDATE_VERSION}/tfupdate_${TFUPDATE_VERSION}_linux_amd64.tar.gz > tfupdate.tgz \
          && tar -xzf tfupdate.tgz tfupdate && rm tfupdate.tgz \
          && chmod +x tfupdate && mv tfupdate /usr/bin/

    - name: Install shfmt
      env:
        # renovate: datasource=github-releases depName=shfmt lookupName=mvdan/sh
        SHFMT_VERSION: '3.8.0'
      run: |
        curl -L https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64 > shfmt \
        && chmod +x shfmt && mv shfmt /usr/bin/

    - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
      with:
        terraform_version: 1.5.4

    - name: Setup OPA
      uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
      with:
        version: latest

    # Need to success pre-commit fix push
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        fetch-depth: 0
        ref: ${{ github.event.pull_request.head.ref }}
        # Need to trigger pre-commit workflow on autofix commit
        # Guide: https://web.archive.org/web/20210731173012/https://github.community/t/required-check-is-expected-after-automated-push/187545/
        ssh-key: "${{ secrets.GHA_AUTOFIX_COMMIT_KEY }}"

    - name: Execute pre-commit
      uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
      timeout-minutes: 30
      env:
        SKIP: no-commit-to-branch,manual-apply-warning
      with:
        extra_args: --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }}

      # Need to trigger pre-commit workflow on autofix commit.
    - name: Push fixes
      if: failure()
      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
      with:
        # Determines the way the action fills missing author name and email. Three options are available:
        # - github_actor -> UserName <[email protected]>
        # - user_info -> Your Display Name <[email protected]>
        # - github_actions -> github-actions <email associated with the github logo>
        # Default: github_actor
        default_author: github_actor
        # The message for the commit.
        # Default: 'Commit from GitHub Actions (name of the workflow)'
        message: '[pre-commit] Autofix violations'