infrastruct.yml

name: Synchronize shared resources
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"
jobs:
  infrastruct:
    name: Infrastructural adaptations
    runs-on: tom
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    permissions:
      contents: read
    steps:
      - name: Checkout this repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Synchronize existing resources
        working-directory: ./cloud
        run: |
          nix run .# init
          nix run .# fmt -- -check
          nix run .# validate
      - name: Plan the upcoming change
        if: github.event_name == 'pull_request'
        working-directory: ./cloud
        run: |
          nix run .# plan
      - name: Actually apply the change
        if: github.ref == 'refs/heads/main'
        working-directory: ./cloud
        run: |
          nix run .# apply -- -auto-approve