WIP

Author: bogsi17

.github/workflows/deploy-infrastructure.yml

@@ -97,7 +97,7 @@ jobs:
     name: Terraform plan
     runs-on: ubuntu-latest
     needs: [validate-permissions, update-permissions]
-    if: needs.update-permissions.result == 'success' || needs.validate-permissions.outputs.policy-mismatch != 'true'
+    if: always() && needs.validate-permissions.outputs.policy-mismatch != 'true'
     permissions:
       id-token: write
     steps:

terraform/scripts/validate-github-actions-policy.sh

@@ -8,6 +8,8 @@ fi
 POLICY_ARN=$1
 POLICY_FILE=$2
 
+echo "policy_mismatch=false" >> "$GITHUB_OUTPUT"
+
 VERSION_ID=$(aws iam get-policy --policy-arn "$POLICY_ARN" --query 'Policy.DefaultVersionId' --output text)
 aws iam get-policy-version --policy-arn "$POLICY_ARN" --version-id "$VERSION_ID" --query 'PolicyVersion.Document' --output json > deployed_policy.json
 echo "fetched deployed policy: $(cat deployed_policy.json)"