Gate OpenTofu Applies Behind Human Approval

id: opentofu-apply-approval-gate
namespace: company.team
description: |
  Gate every apply behind a human decision. The flow saves an OpenTofu
  plan, posts a review pointer to Slack, pauses until someone resumes the
  execution, and then applies exactly the plan file that was reviewed.

tasks:
  - id: plan
    type: io.kestra.plugin.opentofu.cli.OpenTofuCLI
    description: Save a binary plan file plus a human readable rendering of it, and
      upload both to Kestra internal storage for review and for the later apply.
    inputFiles:
      main.tf: |
        terraform {
          required_providers {
            local = {
              source  = "hashicorp/local"
              version = "2.5.2"
            }
          }
        }

        resource "local_file" "release_manifest" {
          filename = "release-manifest.json"
          content = jsonencode({
            release = "demo-release"
            gated   = true
          })
        }
    commands:
      - tofu init -input=false -no-color
      - tofu plan -input=false -no-color -out=plan.tfplan
      - tofu show -no-color plan.tfplan > plan.txt
    outputFiles:
      - plan.tfplan
      - plan.txt

  - id: notify_approver
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Point the approver at the saved plan before the flow pauses, so
      nobody has to discover a silently waiting execution.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "OpenTofu plan ready for review in flow {{ flow.id }} (execution {{ execution.id }}). Read plan.txt in the plan task outputs, then resume the paused execution to apply exactly that plan."
      }

  - id: wait_for_approval
    type: io.kestra.plugin.core.flow.Pause
    description: Hold the execution until a human resumes it from the UI or the API.
      Nothing is applied while the flow is paused.

  - id: apply_reviewed_plan
    type: io.kestra.plugin.opentofu.cli.OpenTofuCLI
    description: Reinitialize the pinned provider and apply the exact plan file the
      approver reviewed, so no re-planning can slip new changes past the
      approval.
    inputFiles:
      main.tf: |
        terraform {
          required_providers {
            local = {
              source  = "hashicorp/local"
              version = "2.5.2"
            }
          }
        }

        resource "local_file" "release_manifest" {
          filename = "release-manifest.json"
          content = jsonencode({
            release = "demo-release"
            gated   = true
          })
        }
      plan.tfplan: "{{ outputs.plan.outputFiles['plan.tfplan'] }}"
    commands:
      - tofu init -input=false -no-color
      - tofu apply -input=false -no-color plan.tfplan
    outputFiles:
      - terraform.tfstate

  - id: confirm
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Close the loop by telling the channel the reviewed plan was applied.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Approved OpenTofu plan applied in flow {{ flow.id }} (execution {{ execution.id }}). The resulting state file is attached to the apply_reviewed_plan task outputs."
      }

errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert whether the plan or the gated apply failed, with the
      execution ID for the logs.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Gated OpenTofu apply FAILED in flow {{ flow.id }} (execution {{ execution.id }}). Open the execution to see whether the plan or the apply broke."
      }