name: terraform-plan
on:
  pull_request:

permissions:
  id-token: write
  contents: read

jobs:
  plan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        stack: [base, workload]
    env:
      ARM_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID_PLAN }}
      ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
      ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      ARM_USE_OIDC: "true"
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform -chdir=${{ matrix.stack }} init -backend-config=../backend.hcl -backend-config=key=lab/${{ matrix.stack }}.tfstate
      - run: terraform -chdir=${{ matrix.stack }} plan -lock=false -input=false