action.yml

name: drift-fixer
description: Detect and automatically fix Terraform/OpenTofu configuration drift, then commit or open a PR with the fixes.
author: trevor159

branding:
  icon: refresh-cw
  color: purple

inputs:
  path:
    description: Path to the Terraform/OpenTofu project directory.
    required: false
    default: "."
  tf-bin:
    description: Terraform/OpenTofu binary to use (e.g. tofu or terraform).
    required: false
    default: tofu
  verbose:
    description: Print every attribute and block change as it is applied.
    required: false
    default: "false"
  mode:
    description: |
      What to do after fixing drift. Options:
        pr      — open a pull request with the changes (default)
        commit  — commit and push directly to the current branch
        dry-run — detect and report drift without writing any files or opening a PR
    required: false
    default: pr
  pr-branch:
    description: Branch name to use when mode is 'pr'. Defaults to drift-fixer/fix-<run_id>.
    required: false
    default: ""
  pr-title:
    description: Title of the pull request when mode is 'pr'.
    required: false
    default: "fix: sync Terraform config with infrastructure drift"
  commit-message:
    description: Commit message used for both 'commit' and 'pr' modes.
    required: false
    default: "fix: sync Terraform config with infrastructure drift"
  token:
    description: GitHub token used to push branches and open PRs. Defaults to the built-in GITHUB_TOKEN.
    required: false
    default: ${{ github.token }}

outputs:
  drift-detected:
    description: "'true' if any drift was found, 'false' otherwise."
    value: ${{ steps.run.outputs.drift-detected }}
  pr-url:
    description: URL of the pull request opened when mode is 'pr' (empty otherwise).
    value: ${{ steps.pr.outputs.pull-request-url }}

runs:
  using: composite
  steps:
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: ${{ github.action_path }}/go/go.mod

    - name: Build drift-fixer
      shell: bash
      run: |
        cd "${{ github.action_path }}/go"
        GOTOOLCHAIN=local CGO_ENABLED=0 go build -ldflags="-s -w" -o "${{ github.action_path }}/drift-fixer-bin" ./cmd/drift-fixer/

    - name: Run drift-fixer
      id: run
      shell: bash
      env:
        DRIFT_FIXER_TF_BIN: ${{ inputs.tf-bin }}
      run: |
        ARGS="-path ${{ inputs.path }}"
        if [ "${{ inputs.verbose }}" = "true" ]; then
          ARGS="$ARGS -verbose"
        fi
        if [ "${{ inputs.mode }}" = "dry-run" ]; then
          ARGS="$ARGS -dry-run"
        fi

        set +e
        "${{ github.action_path }}/drift-fixer-bin" $ARGS
        EXIT_CODE=$?
        set -e

        # Fail fast on hard errors (plan failure, file not found, etc.)
        # Exit 1 from the binary means drift persists after attempted fixes,
        # which we still want to surface. Distinguish by checking git diff.
        if [ $EXIT_CODE -ne 0 ] && git diff --quiet; then
          exit $EXIT_CODE
        fi

        if git diff --quiet; then
          echo "drift-detected=false" >> "$GITHUB_OUTPUT"
        else
          echo "drift-detected=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Commit directly
      if: inputs.mode == 'commit' && steps.run.outputs.drift-detected == 'true'
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
      run: |
        git config user.name  "github-actions[bot]"
        git config use-r.email "github-actions[bot]@users.noreply.github.com"
        git add -A
        git commit -m "${{ inputs.commit-message }}"
        git push

    - name: Open pull request
      id: pr
      if: inputs.mode == 'pr' && steps.run.outputs.drift-detected == 'true'
      uses: peter-evans/create-pull-request@v7
      with:
        token: ${{ inputs.token }}
        branch: ${{ inputs.pr-branch != '' && inputs.pr-branch || format('drift-fixer/fix-{0}', github.run_id) }}
        commit-message: ${{ inputs.commit-message }}
        title: ${{ inputs.pr-title }}
        body: |
          Automated drift fix generated by [drift-fixer](https://github.com/trevor159/drift-fixer).

          Terraform/OpenTofu detected configuration drift and this PR syncs the `.tf` files to match the actual infrastructure state.

          > Triggered by workflow run [${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
        delete-branch: true