add tofu auto-deployment workflows #19

	name: Create OpenTofu plan

	on: [pull_request]

	permissions:
	contents: read
	pull-requests: write

	jobs:
	plan:
	runs-on: ubuntu-latest
	name: Create a plan for the changes introduced
	env:
	GITHUB_TOKEN: ${{ secrets.TF_GITHUB_TOKEN }}

	NOMAD_ADDR: ${{ vars.NOMAD_ADDR }}
	NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}

	AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

	# dflook/tofu-* actions run inside a debian:bullseye container,
	# so we cannot use another action to prep the environment
	TERRAFORM_PRE_RUN: \|
	# install nix
	curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix \| sh -s -- install linux --no-confirm --init none
	. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
	ln -s $(which nix) /bin/nix
	chown -R root:root /github

	steps:
	- name: create nix folder
	run: mkdir -p /nix

	- name: maximize disk space for nix building
	uses: easimon/maximize-build-space@v10
	with:
	root-reserve-mb: 16384 # 16 GiB
	swap-size-mb: 1024
	build-mount-path: /nix
	remove-dotnet: "true"
	remove-android: "true"
	remove-haskell: "true"
	remove-codeql: "true"
	remove-docker-images: "true"

	- name: checkout
	uses: actions/checkout@v4

	- name: add ssh key
	uses: webfactory/[email protected]
	with:
	ssh-private-key: ${{ secrets.TF_SSH_PRIVATE_KEY }}

	- name: tofu plan
	uses: dflook/[email protected]
	with:
	label: dsekt-infra
	variables: \|
	hcloud_token = "${{ secrets.TF_HCLOUD_TOKEN }}"
	cloudflare_api_token = "${{ secrets.TF_CLOUDFLARE_TOKEN }}"
	ssh_user = "${{ vars.TF_SSH_USER }}"

Provide feedback