action.yaml

name: TF Test
description: |
  Reusable GitHub Action to test Terraform/OpenTofu modules.
  AWS role ARN can be provided either:
  1. As an input parameter (aws_role_arn) - takes precedence
  2. As an environment variable (TF_TEST_AWS_ROLE_ARN).
     The use case for this is setting it in the GitHub organization's environment variable.
     See the README for more details.
author: hello@masterpoint.io
inputs:
  tf_type:
    required: true
    description: Type of terraform to use (tofu or terraform)
  aws_role_arn:
    required: false
    description: AWS role ARN to assume for testing (takes precedence over TF_TEST_AWS_ROLE_ARN env var)
  aws_region:
    required: false
    default: us-east-1
    description: AWS region to use
  github_token:
    required: true
    description: GitHub token for checkout
  role_session_name:
    required: false
    default: GitHubActions-TF-Test
    description: AWS role session name for OIDC authentication

runs:
  using: composite
  steps:
    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        token: ${{ inputs.github_token }}
        # In pull_request_target, use the base repo's synthetic merge ref to avoid cross-repo clones
        # and to prevent running fork code with elevated credentials. Otherwise, fall back to sha.
        ref: ${{ (github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.number)) || github.event.pull_request.head.sha || github.sha }}
        # Always clone from the base repository to avoid permission issues with forks
        repository: ${{ github.repository }}
        # Do not persist credentials into the repo's local config (reduces risk of token exfiltration)
        persist-credentials: false
        # Faster, smaller checkout
        fetch-depth: 1

    - name: Aqua Cache
      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
      if: ${{ !github.event.act }}
      with:
        path: ~/.local/share/aquaproj-aqua
        key: v1-aqua-installer-${{runner.os}}-${{runner.arch}}-${{hashFiles('aqua.yaml')}}
        restore-keys: |
          v1-aqua-installer-${{runner.os}}-${{runner.arch}}-

    - name: Install Aqua
      uses: aquaproj/aqua-installer@11dd79b4e498d471a9385aa9fb7f62bb5f52a73c # v4.0.4
      with:
        aqua_version: v2.48.1

    - name: Aqua Install
      shell: bash
      run: aqua install --tags ${{ inputs.tf_type }}

    - name: Configure AWS Credentials
      if: ${{ inputs.aws_role_arn != '' || env.TF_TEST_AWS_ROLE_ARN != '' }}
      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
      with:
        role-to-assume: ${{ inputs.aws_role_arn || env.TF_TEST_AWS_ROLE_ARN }}
        role-session-name: ${{ inputs.role_session_name }}
        aws-region: ${{ inputs.aws_region }}

    - name: Run TF Test
      shell: bash
      run: |
        ${{ inputs.tf_type }} init
        ${{ inputs.tf_type }} test