pr_push_auth.yaml

---
name: Trigger on pull_request (plan) and push (apply) events with Terraform and AWS authentication.

on:
  pull_request:
  push:
    branches: [main]

jobs:
  tf:
    runs-on: ubuntu-latest

    permissions:
      actions: read # Required to download repository artifact.
      checks: write # Required to add status summary.
      contents: read # Required to checkout repository.
      id-token: write # Required to authenticate via OIDC.
      pull-requests: write # Required to add PR comment and label.

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Authenticate AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_ROLE }}

      - name: Setup TF
        uses: hashicorp/setup-terraform@v3

      - name: Provision TF
        uses: devsectop/tf-via-pr@v11
        with:
          arg_chdir: directory/path
          arg_command: ${{ github.event_name == 'push' && 'apply' || 'plan' }}
          arg_lock: ${{ github.event_name == 'push' && 'true' || 'false' }}