My GitHub Workflow to run Terraform https://twitter.com/yuya_takeyama/status/1439154780060848133

terraform-aws.yaml

name: terraform-aws

on:
  push:
    branches:
      - main
    paths:
      - .github/workflows/terraform-aws.yaml
      - actions/**
      - environments/aws/**

  pull_request:
    paths:
      - .github/workflows/terraform-aws.yaml
      - actions/**
      - environments/aws/**

jobs:
  detect:
    permissions:
      contents: read
      pull-requests: read
    outputs:
      updated-environments: ${{ steps.detect.outputs.updated-environments }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - id: detect
        uses: ./actions/detect-updated-environments
        with:
          detection-root: environments/aws
      - run: |
          echo "${{ steps.detect.outputs.updated-environments }}"
  run:
    if: ${{ needs.detect.outputs.updated-environments != '[]' }}
    needs: detect
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    strategy:
      matrix:
        terraform-environment: ${{ fromJSON(needs.detect.outputs.updated-environments) }}
      fail-fast: false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - id: variables
        uses: ./actions/load-aws-variables
        with:
          directory: environments/aws/${{ matrix.terraform-environment }}
          apply: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
      - uses: ./actions/setup-aws-web-identity-token
        with:
          aws-role-arn: ${{ steps.variables.outputs.aws-role-arn }}
          aws-default-region: ${{ steps.variables.outputs.aws-region }}
      - run: aws sts get-caller-identity
      - uses: ./actions/run-terraform
        with:
          directory: environments/aws/${{ matrix.terraform-environment }}
          environment: aws/${{ matrix.terraform-environment }}
          apply: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}