drift-check.yml

name: Drift check

on:
  schedule:
    # Run every day at 12 PM Europe/Oslo time
    - cron: '0 12 * * *'
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  check-for-changes:
    name: Check for changes
    runs-on: ubuntu-latest

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v4

      - uses: pnpm/action-setup@v2

      - name: Use Node LTS ✨
        uses: actions/setup-node@v3
        with:
          node-version: lts/*
          cache: pnpm

      - uses: 'google-github-actions/setup-gcloud@v2'
        with:
          install_components: 'gke-gcloud-auth-plugin'

      - name: Authenticate with Google 🔑
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}

      - name: Install dependencies 📦️
        run: pnpm install --frozen-lockfile

      - name: Run Pulumi 🚀
        uses: pulumi/actions@v4
        id: pulumi
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        with:
          command: preview
          refresh: true
          stack-name: branches/branches-main/main
          expect-no-changes: true

      - uses: slackapi/slack-github-action@v1
        if: failure()
        with:
          payload: |
            {
              "repository": "${{ github.repository }}",
              "jobUrl": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
              "message": "Drift check failed",
              "details": ${{ toJSON(steps.pulumi.outputs.output) }}
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_DRIFTCHECK_WEBHOOK_URL }}