From 7a5ecd0e512e977c99b66d023b5fffa7d39b1823 Mon Sep 17 00:00:00 2001
From: Dan Fuchs <330402+fajpunk@users.noreply.github.com>
Date: Fri, 11 Sep 2026 14:06:34 -0500
Subject: [PATCH] Adopt reusable Terraform workflow for GCP foundation

---
 .../terraform-foundation-1-org-b.yaml         | 70 ++----------------
 .../workflows/terraform-foundation-1-org.yaml | 70 ++----------------
 .../terraform-foundation-2-network.yaml       | 70 ++----------------
 .../terraform-foundation-monitoring.yaml      | 70 ++----------------
 .../workflows/terraform-google-groups.yaml    | 71 ++-----------------
 5 files changed, 35 insertions(+), 316 deletions(-)

diff --git a/.github/workflows/terraform-foundation-1-org-b.yaml b/.github/workflows/terraform-foundation-1-org-b.yaml
index 796442f5..b5e151e6 100644
--- a/.github/workflows/terraform-foundation-1-org-b.yaml
+++ b/.github/workflows/terraform-foundation-1-org-b.yaml
@@ -16,66 +16,10 @@ on:
 
 jobs:
   terraform:
-    name: 'Terraform'
-    runs-on: ubuntu-latest
-
-    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./environment/foundation/1-org-b/
-
-    # Checkout the repository to the GitHub Actions runner
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-
-    # gcp auth
-    - name: GCP login
-      uses: google-github-actions/auth@v2
-      with:
-        credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
-
-    # gcloud setup
-    - name: 'Set up Cloud SDK'
-      uses: 'google-github-actions/setup-gcloud@v2'
-      with:
-        project_id: ${{ secrets.GCP_PROJECT_ID }}
-        skip_install: true
-
-    # Installs terraform
-    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
-      with:
-        terraform_version: 1.9.5
-
-    # Checks for proper formatting in terraform code
-    - name: Terraform Fmt
-      run: terraform fmt
-
-    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
-    - name: Terraform Init
-      run: terraform init -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET }} -backend-config=prefix=foundation/1-org-b
-
-    # Checks that all Terraform configuration files adhere to a canonical format
-    - name: Terraform Validate
-      run: terraform validate
-
-    # Generates terraform execution plan
-    - name: Terraform Plan
-      run: terraform plan -input=false -var-file=1-org-b.tfvars -no-color ${{ github.event_name == 'schedule' && '-detailed-exitcode' || '' }}
-
-    # On push to main, build or change infrastructure according to Terraform configuration files
-    - name: Terraform Apply
-      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-      run: terraform apply -var-file=1-org-b.tfvars -refresh=false -auto-approve
-
-    - name: Report status
-      if: failure() && github.ref == 'refs/heads/main'
-      uses: ravsamhq/notify-slack-action@v2
-      with:
-        status: ${{ job.status }}
-        notify_when: failure
-        notification_title: 'idf_deploy: Periodic plan for {workflow} failed'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK }}
+    name: Terraform
+    uses: ./.github/workflows/_reusable-terraform-plan-apply.yaml
+    with:
+      working_directory: ./environment/foundation/1-org-b/
+      state_prefix: foundation/1-org-b
+      tfvars_file: 1-org-b.tfvars
+    secrets: inherit
diff --git a/.github/workflows/terraform-foundation-1-org.yaml b/.github/workflows/terraform-foundation-1-org.yaml
index f6672947..c5d98b7c 100644
--- a/.github/workflows/terraform-foundation-1-org.yaml
+++ b/.github/workflows/terraform-foundation-1-org.yaml
@@ -16,66 +16,10 @@ on:
 
 jobs:
   terraform:
-    name: 'Terraform'
-    runs-on: ubuntu-latest
-
-    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./environment/foundation/1-org/
-
-    # Checkout the repository to the GitHub Actions runner
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-
-    # gcp auth
-    - name: GCP login
-      uses: google-github-actions/auth@v2
-      with:
-        credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
-
-    # gcloud setup
-    - name: 'Set up Cloud SDK'
-      uses: 'google-github-actions/setup-gcloud@v2'
-      with:
-        project_id: ${{ secrets.GCP_PROJECT_ID }}
-        skip_install: true
-
-    # Installs terraform
-    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
-      with:
-        terraform_version: 1.9.5
-
-    # Checks for proper formatting in terraform code
-    - name: Terraform Fmt
-      run: terraform fmt
-
-    # Initialize a new or existing terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
-    - name: Terraform Init
-      run: terraform init -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET }} -backend-config=prefix=foundation/1-org
-
-    # Checks that all Terraform configuration files adhere to a canonical format
-    - name: Terraform Validate
-      run: terraform validate
-
-    # Generates an execution plan for terraform
-    - name: Terraform Plan
-      run: terraform plan -input=false -var-file=1-org.tfvars -no-color ${{ github.event_name == 'schedule' && '-detailed-exitcode' || '' }}
-
-    # On push to main, build or change infrastructure according to Terraform configuration files
-    - name: Terraform Apply
-      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-      run: terraform apply -var-file=1-org.tfvars -refresh=false -auto-approve
-
-    - name: Report status
-      if: failure() && github.ref == 'refs/heads/main'
-      uses: ravsamhq/notify-slack-action@v2
-      with:
-        status: ${{ job.status }}
-        notify_when: failure
-        notification_title: 'idf_deploy: Periodic plan for {workflow} failed'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK }}
+    name: Terraform
+    uses: ./.github/workflows/_reusable-terraform-plan-apply.yaml
+    with:
+      working_directory: ./environment/foundation/1-org/
+      state_prefix: foundation/1-org
+      tfvars_file: 1-org.tfvars
+    secrets: inherit
diff --git a/.github/workflows/terraform-foundation-2-network.yaml b/.github/workflows/terraform-foundation-2-network.yaml
index f2c9c13a..5e16bb27 100644
--- a/.github/workflows/terraform-foundation-2-network.yaml
+++ b/.github/workflows/terraform-foundation-2-network.yaml
@@ -16,66 +16,10 @@ on:
 
 jobs:
   terraform:
-    name: 'Terraform'
-    runs-on: ubuntu-latest
-
-    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./environment/foundation/2-networks/
-
-    # Checkout the repository to the GitHub Actions runner
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-
-    # gcp auth
-    - name: GCP login
-      uses: google-github-actions/auth@v2
-      with:
-        credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
-
-    # gcloud setup
-    - name: 'Set up Cloud SDK'
-      uses: 'google-github-actions/setup-gcloud@v2'
-      with:
-        project_id: ${{ secrets.GCP_PROJECT_ID }}
-        skip_install: true
-
-    # Installs terraform
-    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
-      with:
-        terraform_version: 1.9.5
-
-    # Checks for proper formatting
-    - name: Terraform Fmt
-      run: terraform fmt
-
-    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
-    - name: Terraform Init
-      run: terraform init -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET }} -backend-config=prefix=foundation/2-networks
-
-    # Checks that all Terraform configuration files adhere to a canonical format
-    - name: Terraform Validate
-      run: terraform validate
-
-    # Generates an execution plan for terraform
-    - name: Terraform Plan
-      run: terraform plan -input=false -var-file=network.tfvars -no-color ${{ github.event_name == 'schedule' && '-detailed-exitcode' || '' }}
-
-    # On push to main, build or change infrastructure according to Terraform configuration files
-    - name: Terraform Apply
-      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-      run: terraform apply -var-file=network.tfvars -refresh=false -auto-approve
-
-    - name: Report status
-      if: failure() && github.ref == 'refs/heads/main'
-      uses: ravsamhq/notify-slack-action@v2
-      with:
-        status: ${{ job.status }}
-        notify_when: failure
-        notification_title: 'idf_deploy: Periodic plan for {workflow} failed'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK }}
+    name: Terraform
+    uses: ./.github/workflows/_reusable-terraform-plan-apply.yaml
+    with:
+      working_directory: ./environment/foundation/2-networks/
+      state_prefix: foundation/2-networks
+      tfvars_file: network.tfvars
+    secrets: inherit
diff --git a/.github/workflows/terraform-foundation-monitoring.yaml b/.github/workflows/terraform-foundation-monitoring.yaml
index 33eae66f..14e63f05 100644
--- a/.github/workflows/terraform-foundation-monitoring.yaml
+++ b/.github/workflows/terraform-foundation-monitoring.yaml
@@ -16,66 +16,10 @@ on:
 
 jobs:
   terraform:
-    name: 'Terraform'
-    runs-on: ubuntu-latest
-
-    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./environment/foundation/monitoring/
-
-    # Checkout the repository to the GitHub Actions runner
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-
-    # gcp auth
-    - name: GCP login
-      uses: google-github-actions/auth@v2
-      with:
-        credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
-
-    # gcloud setup
-    - name: 'Set up Cloud SDK'
-      uses: 'google-github-actions/setup-gcloud@v2'
-      with:
-        project_id: ${{ secrets.GCP_PROJECT_ID }}
-        skip_install: true
-
-    # Installs terraform
-    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
-      with:
-        terraform_version: 1.9.5
-
-    # Checks for proper formatting
-    - name: Terraform Fmt
-      run: terraform fmt
-
-    # Initialize a new or existing terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
-    - name: Terraform Init
-      run: terraform init -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET }} -backend-config=prefix=foundation/monitoring
-
-    # Checks that all terraform configuration files adhere to a canonical format
-    - name: Terraform Validate
-      run: terraform validate
-
-    # Generates an execution plan for terraform
-    - name: Terraform Plan
-      run: terraform plan -input=false -var-file=monitoring.tfvars -no-color ${{ github.event_name == 'schedule' && '-detailed-exitcode' || '' }}
-
-    # On push to main, build or change infrastructure according to Terraform configuration files
-    - name: Terraform Apply
-      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-      run: terraform apply -var-file=monitoring.tfvars -refresh=false -auto-approve
-
-    - name: Report status
-      if: failure() && github.ref == 'refs/heads/main'
-      uses: ravsamhq/notify-slack-action@v2
-      with:
-        status: ${{ job.status }}
-        notify_when: failure
-        notification_title: 'idf_deploy: Periodic plan for {workflow} failed'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK }}
+    name: Terraform
+    uses: ./.github/workflows/_reusable-terraform-plan-apply.yaml
+    with:
+      working_directory: ./environment/foundation/monitoring/
+      state_prefix: foundation/monitoring
+      tfvars_file: monitoring.tfvars
+    secrets: inherit
diff --git a/.github/workflows/terraform-google-groups.yaml b/.github/workflows/terraform-google-groups.yaml
index 5c21bd88..dab2fabc 100644
--- a/.github/workflows/terraform-google-groups.yaml
+++ b/.github/workflows/terraform-google-groups.yaml
@@ -16,67 +16,10 @@ on:
 
 jobs:
   terraform:
-    name: 'Terraform'
-    runs-on: ubuntu-latest
-
-    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./environment/foundation/google_groups/
-
-    # Checkout the repository to the GitHub Actions runner
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-
-    # gcp auth
-    - name: GCP login
-      uses: google-github-actions/auth@v2
-      with:
-        credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
-
-    # gcloud setup
-    - name: 'Set up Cloud SDK'
-      uses: 'google-github-actions/setup-gcloud@v2'
-      with:
-        project_id: ${{ secrets.GCP_PROJECT_ID }}
-        skip_install: true
-
-    # Installs terraform
-    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
-      with:
-        terraform_version: 1.9.5
-
-    # Checks for proper formatting in terraform code
-    - name: Terraform Fmt
-      run: terraform fmt
-
-    # Initialize a new or existing terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
-    - name: Terraform Init
-      run: terraform init -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET }} -backend-config=prefix=foundation/google_groups
-
-    # Checks that all terraform configuration files adhere to a canonical format
-    - name: Terraform Validate
-      run: terraform validate
-
-    # Generates an execution plan for terraform
-    - name: Terraform Plan
-      id: plan
-      run: terraform plan -input=false -var-file=env/groups.tfvars -no-color ${{ github.event_name == 'schedule' && '-detailed-exitcode' || '' }}
-
-    # On push to main, build or change infrastructure according to terraform configuration files
-    - name: Terraform Apply
-      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-      run: terraform apply -var-file=env/groups.tfvars -auto-approve
-
-    - name: Report status
-      if: failure() && github.ref == 'refs/heads/main'
-      uses: ravsamhq/notify-slack-action@v2
-      with:
-        status: ${{ job.status }}
-        notify_when: failure
-        notification_title: 'idf_deploy: Periodic plan for {workflow} failed'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK }}
+    name: Terraform
+    uses: ./.github/workflows/_reusable-terraform-plan-apply.yaml
+    with:
+      working_directory: ./environment/foundation/google_groups/
+      state_prefix: foundation/google_groups
+      tfvars_file: env/groups.tfvars
+    secrets: inherit