Google backend

README.md

@@ -55,14 +55,17 @@ After running this action, apply Terraform with the companion action, [github-ac
 
 ### Prerequisites
 
-This GitHub Action requires AWS access for two different purposes. This action will attempt to first run `terraform plan` against a given component and 
-then will use another role to save that given Terraform Plan to an S3 Bucket with metadata in a DynamoDB table. We recommend configuring 
-[OpenID Connect with AWS](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) 
-to allow GitHub to assume roles in AWS and then deploying both a Terraform Plan role and a Terraform State role. 
-For Cloud Posse documentation on setting up GitHub OIDC, see our [`github-oidc-provider` component](https://docs.cloudposse.com/components/library/aws/github-oidc-provider/).
+This GitHub Action requires cloud provider access for two different purposes. This action will attempt to first run `terraform plan` against a given component and
+then will use credentials to save that given Terraform Plan to cloud storage with metadata.
 
-In order to store Terraform State, we configure an S3 Bucket to store plan files and a DynamoDB table to track plan metadata. Both will need to be deployed before running
-this action. For more on setting up those components, see the `gitops` component (__documentation pending__). This action will then use the [github-action-terraform-plan-storage](https://github.com/cloudposse/github-action-terraform-plan-storage) action to update these resources.
+For AWS, we recommend configuring [OpenID Connect with AWS](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
+to allow GitHub to assume roles in AWS and then deploying both a Terraform Plan role and a Terraform State role.
+For Cloud Posse documentation on setting up GitHub OIDC with AWS, see our [`github-oidc-provider` component](https://docs.cloudposse.com/components/library/aws/github-oidc-provider/).
+
+For Google Cloud, we recommend configuring [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation-with-GitHub-actions)
+to allow GitHub Actions to authenticate with Google Cloud services. This will enable access to Google Cloud Storage for plan files and Firestore for metadata storage.
+
+For AWS storage, we configure an S3 Bucket to store plan files and a DynamoDB table to track plan metadata. For Google Cloud storage, we use Google Cloud Storage buckets for plan files and Firestore for metadata. These resources will need to be deployed before running this action. For more on setting up those components, see the `gitops` component (__documentation pending__). This action will then use the [github-action-terraform-plan-storage](https://github.com/cloudposse/github-action-terraform-plan-storage) action to update these resources.
 
 ### Config
 
@@ -81,6 +84,7 @@ Depending on the cloud provider, the following fields should be set in the `atmo
 
 The config should have the following structure:
 
+#### AWS
 ```yaml
 integrations:
   github:
@@ -129,6 +133,22 @@ integrations:
         group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-")
 ```
 
+#### Google Cloud
+```yaml
+integrations:
+  github:
+    gitops:
+      ...
+      artifact-storage:
+        ...
+        bucket: cptest-core-ue2-auto-gitops
+        google-service-account: terraform@project-id.iam.gserviceaccount.com
+        google-workload-identity-provider: projects/project-id/locations/global/workloadIdentityPools/github-actions/providers/github-provider
+        google-project-id: cptest-core-ue2-auto-gitops
+        google-firestore-database-name: cptest-core-ue2-auto-gitops
+        google-firestore-collection-name: terraform-plan-storage
+```
+
 ### Stack level configuration
 
 > [!IMPORTANT]

README.yaml

@@ -44,14 +44,17 @@ references:
 usage: |-
   ### Prerequisites
 
-  This GitHub Action requires AWS access for two different purposes. This action will attempt to first run `terraform plan` against a given component and 
-  then will use another role to save that given Terraform Plan to an S3 Bucket with metadata in a DynamoDB table. We recommend configuring 
-  [OpenID Connect with AWS](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) 
-  to allow GitHub to assume roles in AWS and then deploying both a Terraform Plan role and a Terraform State role. 
-  For Cloud Posse documentation on setting up GitHub OIDC, see our [`github-oidc-provider` component](https://docs.cloudposse.com/components/library/aws/github-oidc-provider/).
+  This GitHub Action requires cloud provider access for two different purposes. This action will attempt to first run `terraform plan` against a given component and
+  then will use credentials to save that given Terraform Plan to cloud storage with metadata.
 
-  In order to store Terraform State, we configure an S3 Bucket to store plan files and a DynamoDB table to track plan metadata. Both will need to be deployed before running
-  this action. For more on setting up those components, see the `gitops` component (__documentation pending__). This action will then use the [github-action-terraform-plan-storage](https://github.com/cloudposse/github-action-terraform-plan-storage) action to update these resources.
+  For AWS, we recommend configuring [OpenID Connect with AWS](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
+  to allow GitHub to assume roles in AWS and then deploying both a Terraform Plan role and a Terraform State role.
+  For Cloud Posse documentation on setting up GitHub OIDC with AWS, see our [`github-oidc-provider` component](https://docs.cloudposse.com/components/library/aws/github-oidc-provider/).
+
+  For Google Cloud, we recommend configuring [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation-with-GitHub-actions)
+  to allow GitHub Actions to authenticate with Google Cloud services. This will enable access to Google Cloud Storage for plan files and Firestore for metadata storage.
+
+  For AWS storage, we configure an S3 Bucket to store plan files and a DynamoDB table to track plan metadata. For Google Cloud storage, we use Google Cloud Storage buckets for plan files and Firestore for metadata. These resources will need to be deployed before running this action. For more on setting up those components, see the `gitops` component (__documentation pending__). This action will then use the [github-action-terraform-plan-storage](https://github.com/cloudposse/github-action-terraform-plan-storage) action to update these resources.
 
   ### Config
 
@@ -70,6 +73,7 @@ usage: |-
 
   The config should have the following structure:
 
+  #### AWS
   ```yaml
   integrations:
     github:
@@ -118,6 +122,22 @@ usage: |-
           group-by: .stack_slug | split("-") | [.[0], .[2]] | join("-")
   ```
 
+  #### Google Cloud
+  ```yaml
+  integrations:
+    github:
+      gitops:
+        ...
+        artifact-storage:
+          ...
+          bucket: cptest-core-ue2-auto-gitops
+          google-service-account: terraform@project-id.iam.gserviceaccount.com
+          google-workload-identity-provider: projects/project-id/locations/global/workloadIdentityPools/github-actions/providers/github-provider
+          google-project-id: cptest-core-ue2-auto-gitops
+          google-firestore-database-name: cptest-core-ue2-auto-gitops
+          google-firestore-collection-name: terraform-plan-storage
+  ```
+
   ### Stack level configuration
 
   > [!IMPORTANT]

action.yml

@@ -64,6 +64,9 @@ outputs:
     description: "Summary"
     value: "${{ steps.summary.outputs.result }}"
 
+env:
+  ACTIONS_STEP_DEBUG: true
+
 runs:
   using: "composite"
   steps:
@@ -85,6 +88,13 @@ runs:
         token: ${{ inputs.token }}
         install-wrapper: false
 
+    - name: Install OpenTofu
+      uses: cloudposse-github-actions/install-gh-releases@v1
+      with:
+        cache: true
+        config: |-
+          opentofu/opentofu: latest
+
     - name: Get atmos settings
       id: atmos-settings
       uses: cloudposse/github-action-atmos-get-setting@v2
@@ -166,6 +176,26 @@ runs:
             stack: ${{ inputs.stack }}
             settingsPath: settings.integrations.github.gitops.artifact-storage.cosmos-endpoint
             outputPath: cosmos-endpoint
+          - component: ${{ inputs.component }}
+            stack: ${{ inputs.stack }}
+            settingsPath: settings.integrations.github.gitops.artifact-storage.google-project-id
+            outputPath: google-project-id
+          - component: ${{ inputs.component }}
+            stack: ${{ inputs.stack }}
+            settingsPath: settings.integrations.github.gitops.artifact-storage.google-service-account
+            outputPath: google-service-account
+          - component: ${{ inputs.component }}
+            stack: ${{ inputs.stack }}
+            settingsPath: settings.integrations.github.gitops.artifact-storage.google-workload-identity-provider
+            outputPath: google-workload-identity-provider
+          - component: ${{ inputs.component }}
+            stack: ${{ inputs.stack }}
+            settingsPath: settings.integrations.github.gitops.artifact-storage.google-firestore-database-name
+            outputPath: google-firestore-database-name
+          - component: ${{ inputs.component }}
+            stack: ${{ inputs.stack }}
+            settingsPath: settings.integrations.github.gitops.artifact-storage.google-firestore-collection-name
+            outputPath: google-firestore-collection-name
 
     - name: Install Terraform
       if: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-version != '' && fromJson(steps.atmos-settings.outputs.settings).terraform-version != 'null' }}
@@ -197,6 +227,16 @@ runs:
         role-session-name: "atmos-terraform-plan-gitops"
         mask-aws-account-id: "no"
 
+    - name: Configure Google Credentials
+      if: ${{ fromJson(steps.atmos-settings.outputs.settings).google-workload-identity-provider != '' &&
+        fromJson(steps.atmos-settings.outputs.settings).google-workload-identity-provider != 'null' &&
+        fromJson(steps.atmos-settings.outputs.settings).google-service-account != '' &&
+        fromJson(steps.atmos-settings.outputs.settings).google-service-account != 'null' }}
+      uses: google-github-actions/auth@v2
+      with:
+        workload_identity_provider: ${{ fromJson(steps.atmos-settings.outputs.settings).google-workload-identity-provider }}
+        service_account: ${{ fromJson(steps.atmos-settings.outputs.settings).google-service-account }}
+
     - name: Set atmos cli base path vars
       if: ${{ fromJson(steps.atmos-settings.outputs.settings).enabled }}
       shell: bash
@@ -369,7 +409,7 @@ runs:
 
     - name: Store New Plan
       if: ${{ steps.atmos-plan.outputs.error == 'false' }}
-      uses: cloudposse/github-action-terraform-plan-storage@v1
+      uses: cloudposse/github-action-terraform-plan-storage@v2
       with:
         action: storePlan
         commitSHA: ${{ inputs.sha }}
@@ -383,12 +423,15 @@ runs:
         cosmosContainerName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-container-name }}
         cosmosDatabaseName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-database-name }}
         cosmosEndpoint: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-endpoint }}
+        gcpProjectId: ${{ fromJson(steps.atmos-settings.outputs.settings).google-project-id }}
+        gcpFirestoreDatabaseName: ${{ fromJson(steps.atmos-settings.outputs.settings).google-firestore-database-name }}
+        gcpFirestoreCollectionName: ${{ fromJson(steps.atmos-settings.outputs.settings).google-firestore-collection-name }}
         tableName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-table }}
         bucketName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-bucket }}
 
     - name: Store Lockfile for New Plan
       if: ${{ steps.atmos-plan.outputs.error == 'false' }}
-      uses: cloudposse/github-action-terraform-plan-storage@v1
+      uses: cloudposse/github-action-terraform-plan-storage@v2
       with:
         action: storePlan
         commitSHA: ${{ inputs.sha }}
@@ -402,6 +445,9 @@ runs:
         cosmosContainerName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-container-name }}
         cosmosDatabaseName: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-database-name }}
         cosmosEndpoint: ${{ fromJson(steps.atmos-settings.outputs.settings).cosmos-endpoint }}
+        gcpProjectId: ${{ steps.config.outputs.google-project-id }}
+        gcpFirestoreDatabaseName: ${{ steps.config.outputs.google-firestore-database-name }}
+        gcpFirestoreCollectionName: ${{ steps.config.outputs.google-firestore-collection-name }}
         tableName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-table }}
         bucketName: ${{ fromJson(steps.atmos-settings.outputs.settings).terraform-state-bucket }}