digger-plan.yaml

name: Digger Pull Request Workflow

on:
  pull_request:
    branches:
      - main
      - master
    types: [ closed, opened, synchronize, reopened ]
  issue_comment:
    types: [created]
    if: contains(github.event.comment.body, 'digger')
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    # Permissions for OIDC with AWS
    permissions:    
      contents: write      # required to merge PRs
      id-token: write      # required for workload-identity-federation
      pull-requests: write # required to post PR comments
      statuses: write      # required to validate combined PR status

    steps:
      - name: checkout
        uses: actions/checkout@v4
      - name: digger run
        uses: diggerhq/digger@v0.4.13
        with:
          #########
          # Setup #
          #########
          setup-terragrunt: true
          terragrunt-version: 0.54.12
          # terraform-version: v1.5.5
          # opentofu-version: v1.6.0-alpha3
          setup-checkov: true
          checkov-version: 2.3.360

          ################
          # AWS Settings #
          ################
          setup-aws: true
          aws-role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/${{ secrets.ROLE_NAME }}
          aws-region: ${{ secrets.AWS_REGION }}

          ###################
          # Digger Settings #
          ###################
          disable-locking: true
          digger-filename: digger.yaml
          digger-hostname: 'https://cloud.digger.dev'
          digger-organisation: 'digger'
          digger-token: ${{ secrets.DIGGER_TOKEN }}
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

          ##### To use different accounts for digger locks and arget infrastructure
          # 1st pair used to provisions the infrastructure
          # 2nd pair used for locking
          # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          # DIGGER_ACCESS_KEY_ID: ${{ secrets.DIGGER_ACCESS_KEY_ID }}
          # DIGGER_SECRET_ACCESS_KEY: ${{ secrets.DIGGER_SECRET_ACCESS_KEY }}