{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::＜tfstate保存用のバケット名＞/*",
                "arn:aws:s3:::＜tfstate保存用のバケット名＞"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:GetHostedZone",
                "route53:ListHostedZones",
                "route53:ListHostedZonesByName",
                "route53:CreateHostedZone",
                "route53:DeleteHostedZone",
                "route53:UpdateHostedZoneComment",
                "route53:GetChange",
                "route53:ListResourceRecordSets",
                "route53:ChangeResourceRecordSets",
                "route53:GetHostedZoneCount",
                "route53:ListTagsForResource",
                "route53:ChangeTagsForResource",
                "route53:AssociateVPCWithHostedZone",
                "route53:DisassociateVPCFromHostedZone",
                "route53:ListHostedZonesByVPC"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeRegions"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:CreateRole",
                "iam:UpdateRole",
                "iam:DeleteRole",
                "iam:ListRolePolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:TagRole",
                "iam:UntagRole",
                "iam:GetPolicy",
                "iam:CreatePolicy",
                "iam:DeletePolicy",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicyVersion",
                "iam:TagPolicy",
                "iam:UntagPolicy",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:PutRolePolicy",
                "iam:GetRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:GetGroup",
                "iam:CreateGroup",
                "iam:DeleteGroup",
                "iam:UpdateGroup",
                "iam:ListGroupPolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:AttachGroupPolicy",
                "iam:DetachGroupPolicy",
                "iam:PutGroupPolicy",
                "iam:GetGroupPolicy",
                "iam:DeleteGroupPolicy",
                "iam:GetInstanceProfile",
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:TagInstanceProfile",
                "iam:UntagInstanceProfile",
                "iam:PassRole"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "TerraformVPCManagement",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "ec2:CreateSecurityGroup",
                "ec2:DeleteSecurityGroup",
                "ec2:AuthorizeSecurityGroup*",
                "ec2:RevokeSecurityGroup*",
                "ec2:ModifySecurityGroupRules",
                "ec2:UpdateSecurityGroupRuleDescriptions*",
                "ec2:CreateVpc",
                "ec2:DeleteVpc",
                "ec2:ModifyVpcAttribute",
                "ec2:CreateNetworkAcl",
                "ec2:DeleteNetworkAcl",
                "ec2:*NetworkAclEntry",
                "ec2:ReplaceNetworkAcl*",
                "ec2:CreateSubnet",
                "ec2:DeleteSubnet",
                "ec2:ModifySubnetAttribute",
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Principal": {
                "Federated": "arn:aws:iam::＜AWS アカウントID＞:oidc-provider/token.actions.githubusercontent.com"
            },
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": [
                        "sts.amazonaws.com"
                    ]
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": [
                        "repo:＜Github Org名＞/＜リポジトリ名＞:*"
                    ]
                }
            }
        }
    ]
}

locals {
  account_id = "＜アカウントID＞"
}

terraform {
  required_version = "= 1.13.3"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.15.0"
    }
  }
}

name: Terraform Plan

on:
  pull_request:
    branches:
      - "main"
    paths:
      - "terraform/**/*.tf"

jobs:
  terraform-plan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write

    steps:
      # 0. 処理開始コメント（最初に投稿）
      - name: Post processing start comment
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          curl -X POST \
            -H "Authorization: token $GITHUB_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments \
            -d "{\"body\":\"**terraform plan処理中...**\n**⚠️ レビュアーが承認するまでマージしないで下さい！ terraform applyも起動します**\"}"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # 1. GitHub APIでPR変更ファイルから対象terraformディレクトリを検出
      - name: Find target terraform directory (via GitHub API)
        id: detect-dir
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          files=$(gh api repos/${GITHUB_REPOSITORY}/pulls/$PR_NUMBER/files --paginate --jq '.[].filename')
          dir=$(echo "$files" | grep -E '^terraform/.*\.tf$' | xargs -I{} dirname {} | sort -u | head -1)
          if [ -z "$dir" ]; then
            echo "No changed terraform/*.tf files in this PR. Skip."
            echo "target_dir=" >> $GITHUB_OUTPUT
            exit 0
          fi
          echo "target_dir=$dir" >> $GITHUB_OUTPUT
          echo "Detected target_dir=$dir"

      # 2. locals.tfからAWSアカウントIDを取得してロールARNを決定
      - name: Determine AWS Account from locals.tf
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        id: aws-account
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: |
          # locals.tfからaccount_idを抽出
          if [ ! -f "locals.tf" ]; then
            echo "Error: locals.tf not found in ${{ steps.detect-dir.outputs.target_dir }}"
            exit 1
          fi

          # account_id = "数字12桁" の形式から数字部分を抽出
          account_id=$(grep -E 'account_id\s*=\s*"[0-9]{12}"' locals.tf | sed -E 's/.*account_id\s*=\s*"([0-9]{12})".*/\1/')

          if [ -z "$account_id" ]; then
            echo "Error: Could not extract account_id from locals.tf"
            exit 1
          fi

          # アカウントIDに基づいてロールARNを設定
          if [ "$account_id" = "アカウントID-A" ]; then
            role_arn="arn:aws:iam::アカウントID-A:role/ロール名"
          elif [ "$account_id" = "アカウントID-B" ]; then
            role_arn="arn:aws:iam::アカウントID-B:role/ロール名"
          else
            echo "Error: Unknown account ID: $account_id"
            echo "Please add the role ARN mapping for this account ID in the workflow"
            exit 1
          fi

          echo "account_id=$account_id" >> $GITHUB_OUTPUT
          echo "role_arn=$role_arn" >> $GITHUB_OUTPUT
          echo "Detected AWS Account ID: $account_id"
          echo "Using Role ARN: $role_arn"

      # 3. Configure AWS credentials (OIDC)
      - name: Configure AWS credentials (OIDC)
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ steps.aws-account.outputs.role_arn }}
          aws-region: ap-northeast-1

      # 4. terraform.tfからrequired_versionを抽出
      - name: Extract required_version
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        id: tf-version
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: |
          ver=$(grep 'required_version' terraform.tf | sed -E 's/.*=\s*"([^"]+)".*/\1/')
          echo "version=$ver" >> $GITHUB_OUTPUT
          echo "Detected required_version: $ver"

      # 5. Setup Terraform
      - name: Setup Terraform
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ steps.tf-version.outputs.version }}

      # 6. terraform plan 実行（エラーハンドリング付き）
      - name: Terraform Init
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: terraform init -input=false

      - name: Terraform Plan
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        id: plan
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: |
          # terraform planを実行し、結果とエラーの両方をキャプチャ
          set +e  # エラーでも続行
          terraform plan -no-color > $GITHUB_WORKSPACE/plan-result.txt 2>&1
          plan_exit_code=$?
          set -e

          # 終了コードを保存
          echo "exit_code=$plan_exit_code" >> $GITHUB_OUTPUT

          # planが失敗した場合のフラグ
          if [ $plan_exit_code -ne 0 ]; then
            echo "has_error=true" >> $GITHUB_OUTPUT
            echo "Terraform plan failed with exit code: $plan_exit_code"
          else
            echo "has_error=false" >> $GITHUB_OUTPUT
            echo "Terraform plan succeeded"
          fi

          # エラーでもワークフローは継続
          exit 0

      # 7. 分割してPRにコメント投稿（エラーメッセージ付き）
      - name: Post plan result to PR comment(s)
        if: ${{ steps.detect-dir.outputs.target_dir != '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail

          # エラーメッセージの準備
          error_header=""
          if [ "${{ steps.plan.outputs.has_error }}" = "true" ]; then
            error_header="**⚠️ Terraform Planの結果エラーがあるので、修正して再度pushして下さい**\n\n"
          fi

          split -b 60000 "$GITHUB_WORKSPACE/plan-result.txt" plan-part- || true
          if ls plan-part-* 1> /dev/null 2>&1; then
            i=0
            for f in plan-part-*; do
              body_file=$(mktemp)
              if [ $i -eq 0 ]; then
                {
                  if [ -n "$error_header" ]; then
                    echo -e "$error_header"
                  fi
                  echo "**terraform plan** in \`${{ steps.detect-dir.outputs.target_dir }}\`"
                  echo "AWS Account: \`${{ steps.aws-account.outputs.account_id }}\`"
                  echo "AWS Role: \`${{ steps.aws-account.outputs.role_arn }}\`"
                  if [ "${{ steps.plan.outputs.has_error }}" = "true" ]; then
                    echo "Status: ❌ **Failed**"
                  else
                    echo "Status: ✅ **Success**"
                  fi
                  echo '```'
                  cat "$f"
                  echo '```'
                } > "$body_file"
              else
                {
                  echo "続き **terraform plan (part $i)** in \`${{ steps.detect-dir.outputs.target_dir }}\`"
                  echo '```'
                  cat "$f"
                  echo '```'
                } > "$body_file"
              fi
              gh pr comment "$PR_NUMBER" --body-file "$body_file"
              i=$((i+1))
            done
          else
            body_file=$(mktemp)
            {
              if [ -n "$error_header" ]; then
                echo -e "$error_header"
              fi
              echo "**terraform plan** in \`${{ steps.detect-dir.outputs.target_dir }}\` 完了（出力なし or 短文）"
              echo "AWS Account: \`${{ steps.aws-account.outputs.account_id }}\`"
              echo "AWS Role: \`${{ steps.aws-account.outputs.role_arn }}\`"
              if [ "${{ steps.plan.outputs.has_error }}" = "true" ]; then
                echo "Status: ❌ **Failed**"
              else
                echo "Status: ✅ **Success**"
              fi
            } > "$body_file"
            gh pr comment "$PR_NUMBER" --body-file "$body_file"
          fi

      # 8. Plan失敗時は最終的にワークフローを失敗させる
      - name: Check plan result
        if: ${{ steps.detect-dir.outputs.target_dir != '' && steps.plan.outputs.has_error == 'true' }}
        run: |
          echo "::error::Terraform plan failed. Please check the PR comments for details."
          exit 1

name: Terraform Apply (on PR merge)

on:
  pull_request:
    types: [closed]
    branches:
      - "main"
    paths:
      - "terraform/**/*.tf"

concurrency:
  group: terraform-apply
  cancel-in-progress: false

jobs:
  apply:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write

    steps:
      # 0. 処理開始コメント（チェックアウト前に即座に投稿）
      - name: Post processing start comment (fast)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TZ: 'Asia/Tokyo'
        run: |
          jst_time=$(date '+%Y-%m-%d %H:%M:%S JST')
          curl -X POST \
            -H "Authorization: token $GITHUB_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments \
            -d "{\"body\":\"🔄 **Terraform Apply 処理中...** (開始時刻: $jst_time)\"}"

      # 1. マージ後の main をチェックアウト
      - name: Checkout main
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0

      # 2. PRの変更ファイルから対象terraformディレクトリを検出（GitHub API）
      - name: Find target terraform directory
        id: detect-dir
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          files=$(gh api repos/${GITHUB_REPOSITORY}/pulls/$PR_NUMBER/files --jq '.[].filename')
          dirs=$(echo "$files" | grep '^terraform/' | grep '\.tf$' | xargs -I{} dirname {} | sort -u)
          if [ -z "$dirs" ]; then
            echo "対象Terraformディレクトリがありませんでした（終了）"
            exit 0
          fi
          dir=$(echo "$dirs" | head -1)
          echo "target_dir=$dir" >> $GITHUB_OUTPUT
          echo "Detected target_dir=$dir"

      # 3. locals.tfからAWSアカウントIDを取得してロールARNを決定
      - name: Determine AWS Account from locals.tf
        id: aws-account
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: |
          # locals.tfからaccount_idを抽出
          if [ ! -f "locals.tf" ]; then
            echo "Error: locals.tf not found in ${{ steps.detect-dir.outputs.target_dir }}"
            exit 1
          fi

          # account_id = "数字12桁" の形式から数字部分を抽出
          account_id=$(grep -E 'account_id\s*=\s*"[0-9]{12}"' locals.tf | sed -E 's/.*account_id\s*=\s*"([0-9]{12})".*/\1/')

          if [ -z "$account_id" ]; then
            echo "Error: Could not extract account_id from locals.tf"
            exit 1
          fi

          # アカウントIDに基づいてロールARNを設定
          if [ "$account_id" = "アカウントID-A" ]; then
            role_arn="arn:aws:iam::アカウントID-A:role/ロール名"
          elif [ "$account_id" = "アカウントID-B" ]; then
            role_arn="arn:aws:iam::アカウントID-B:role/ロール名"
          else
            echo "Error: Unknown account ID: $account_id"
            echo "Please add the role ARN mapping for this account ID in the workflow"
            exit 1
          fi

          echo "account_id=$account_id" >> $GITHUB_OUTPUT
          echo "role_arn=$role_arn" >> $GITHUB_OUTPUT
          echo "Detected AWS Account ID: $account_id"
          echo "Using Role ARN: $role_arn"

      # 4. AWS 認証（OIDC）
      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ steps.aws-account.outputs.role_arn }}
          aws-region: ap-northeast-1

      # 5. required_version を terraform.tf から抽出
      - name: Extract required_version
        id: tf-version
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: |
          ver=$(grep 'required_version' terraform.tf | sed -E 's/.*=\s*"([^"]+)".*/\1/')
          echo "version=$ver" >> $GITHUB_OUTPUT
          echo "Detected required_version: $ver"

      # 6. Terraform セットアップ
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ steps.tf-version.outputs.version }}

      # 7. Terraform init & apply（エラーハンドリング付き）
      - name: Terraform Init
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: terraform init -input=false

      - name: Terraform Apply
        id: apply
        working-directory: ${{ steps.detect-dir.outputs.target_dir }}
        run: |
          # terraform applyを実行し、結果とエラーの両方をキャプチャ
          set +e  # エラーでも続行
          terraform apply -auto-approve -no-color > $GITHUB_WORKSPACE/apply-result.txt 2>&1
          apply_exit_code=$?
          set -e

          # 終了コードを保存
          echo "exit_code=$apply_exit_code" >> $GITHUB_OUTPUT

          # applyが失敗した場合のフラグ
          if [ $apply_exit_code -ne 0 ]; then
            echo "has_error=true" >> $GITHUB_OUTPUT
            echo "Terraform apply failed with exit code: $apply_exit_code"
          else
            echo "has_error=false" >> $GITHUB_OUTPUT
            echo "Terraform apply succeeded"
          fi

          # エラーでもワークフローは継続（コメント投稿のため）
          exit 0

      # 8. 結果をPRにコメント（エラー情報付き）
      - name: Post apply result to PR comment(s)
        if: always()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          # エラーメッセージの準備
          error_header=""
          if [ "${{ steps.apply.outputs.has_error }}" = "true" ]; then
            error_header="**⚠️ Terraform Apply でエラーが発生しました。以下の内容を確認してください。**\n\n"
          fi

          split -b 60000 $GITHUB_WORKSPACE/apply-result.txt apply-part- || true
          if ls apply-part-* 1> /dev/null 2>&1; then
            i=0
            for f in apply-part-*; do
              body_file=$(mktemp)
              if [ $i -eq 0 ]; then
                {
                  if [ -n "$error_header" ]; then
                    echo -e "$error_header"
                  fi
                  echo "**terraform apply** in \`${{ steps.detect-dir.outputs.target_dir }}\`"
                  echo "AWS Account: \`${{ steps.aws-account.outputs.account_id }}\`"
                  echo "AWS Role: \`${{ steps.aws-account.outputs.role_arn }}\`"
                  if [ "${{ steps.apply.outputs.has_error }}" = "true" ]; then
                    echo "Status: ❌ **Failed**"
                  else
                    echo "Status: ✅ **Success**"
                  fi
                  echo '```'
                  cat "$f"
                  echo '```'
                } > "$body_file"
              else
                {
                  echo "続き **terraform apply (part $i)** in \`${{ steps.detect-dir.outputs.target_dir }}\`"
                  echo '```'
                  cat "$f"
                  echo '```'
                } > "$body_file"
              fi
              gh pr comment "$PR_NUMBER" --body-file "$body_file"
              i=$((i+1))
            done
          else
            body_file=$(mktemp)
            {
              if [ -n "$error_header" ]; then
                echo -e "$error_header"
              fi
              echo "**terraform apply** in \`${{ steps.detect-dir.outputs.target_dir }}\` 完了（出力なし or 短文）"
              echo "AWS Account: \`${{ steps.aws-account.outputs.account_id }}\`"
              echo "AWS Role: \`${{ steps.aws-account.outputs.role_arn }}\`"
              if [ "${{ steps.apply.outputs.has_error }}" = "true" ]; then
                echo "Status: ❌ **Failed**"
              else
                echo "Status: ✅ **Success**"
              fi
            } > "$body_file"
            gh pr comment "$PR_NUMBER" --body-file "$body_file"
          fi

      # 9. 処理完了コメント（エラー状態も反映）
      - name: Post processing complete comment
        if: always()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TZ: 'Asia/Tokyo'
        run: |
          # apply自体のエラーとワークフロー全体のステータスを区別
          if [ "${{ steps.apply.outputs.has_error }}" = "true" ]; then
            gh pr comment ${{ github.event.pull_request.number }} \
              --body "❌ **Terraform Apply 失敗** (終了時刻: $(date '+%Y-%m-%d %H:%M:%S JST'))"
          elif [ "${{ job.status }}" == "success" ]; then
            gh pr comment ${{ github.event.pull_request.number }} \
              --body "✅ **Terraform Apply 完了** (終了時刻: $(date '+%Y-%m-%d %H:%M:%S JST'))"
          else
            gh pr comment ${{ github.event.pull_request.number }} \
              --body "⚠️ **Terraform Apply ワークフローエラー** (終了時刻: $(date '+%Y-%m-%d %H:%M:%S JST'))"
          fi

      # 10. Apply失敗時は最終的にワークフローを失敗させる
      - name: Check apply result
        if: ${{ steps.apply.outputs.has_error == 'true' }}
        run: |
          echo "::error::Terraform apply failed. Please check the PR comments for details."
          exit 1