# terraform.tf（OpenTofu用設定）
terraform {
  encryption {
    key_provider "aws_kms" "my_key" {
      kms_key_id = "arn:aws:kms:ap-northeast-1:123456789012:key/your-key-id"
      key_spec   = "AES_256"
      region     = "ap-northeast-1"
    }

    method "aes_gcm" "default_method" {
      keys = key_provider.aws_kms.my_key
    }

    state {
      method   = method.aes_gcm.default_method
      enforced = true
    }

    plan {
      method = method.aes_gcm.default_method
    }
  }
}

# tests/main.tftest.hcl
mock_provider "aws" {
  mock_resource "aws_instance" {
    defaults = {
      id         = "i-mock1234567890abcdef"
      public_ip  = "203.0.113.10"
      private_ip = "10.0.1.100"
      arn        = "arn:aws:ec2:ap-northeast-1:123456789012:instance/i-mock1234567890abcdef"
    }
  }

  mock_resource "aws_security_group" {
    defaults = {
      id  = "sg-mock1234567890abcdef"
      arn = "arn:aws:ec2:ap-northeast-1:123456789012:security-group/sg-mock1234567890abcdef"
    }
  }
}

run "test_web_server_creation" {
  command = plan

  assert {
    condition     = aws_instance.web_server.instance_type == "t3.micro"
    error_message = "Instance type should be t3.micro"
  }

  assert {
    condition     = length(aws_security_group.web_sg.ingress) > 0
    error_message = "Security group must have ingress rules"
  }
}

# variables.tf
variable "environment" {
  type    = string
  default = "dev"
}

variable "project_name" {
  type    = string
  default = "my-app"
}

# backend.tf（OpenTofu v1.8+専用機能）
terraform {
  backend "s3" {
    bucket = "my-state-bucket-${var.environment}"
    key    = "${var.project_name}/${var.environment}/terraform.tfstate"
    region = "ap-northeast-1"
  }
}

# ephemeral_secret.tf
ephemeral "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/myapp/db-password"
}

resource "aws_db_instance" "main" {
  identifier     = "myapp-prod"
  engine         = "mysql"
  engine_version = "8.0"
  instance_class = "db.t3.medium"

  # ephemeral値はstateに残らない！
  password = ephemeral.aws_secretsmanager_secret_version.db_password.secret_string

  db_name  = "myappdb"
  username = "admin"
}

# backend設定を確認する
grep -r "backend" . --include="*.tf" | grep "remote\|cloud"

# Sentinel設定の確認
ls -la .sentinel/ 2>/dev/null || echo "Sentinelポリシーなし"

brew install opentofu

sudo snap install --classic opentofu

asdf plugin add opentofu
asdf install opentofu latest
asdf global opentofu latest

docker run --rm \
  -v $(pwd):/workspace \
  -w /workspace \
  ghcr.io/opentofu/opentofu:latest \
  tofu init

tofu version
# OpenTofu v1.x.x と表示されればOKデス！！

# 1. 既存プロジェクトのディレクトリに移動
cd your-terraform-project

# 2. .terraform.lock.hclのバックアップ（念のため！！）
cp .terraform.lock.hcl .terraform.lock.hcl.backup

# 3. tofuでinitを実行（OpenTofu用にlockファイルが更新される）
tofu init -upgrade

# 4. planで差分確認（ゼロ差分が出れば移行完了！！）
tofu plan

# terraform.tf（既存のterraformブロックに追記）
terraform {
  required_version = ">= 1.7.0"

  encryption {
    key_provider "aws_kms" "my_key" {
      kms_key_id = var.kms_key_id
      key_spec   = "AES_256"
      region     = var.aws_region
    }

    method "aes_gcm" "default_method" {
      keys = key_provider.aws_kms.my_key
    }

    state {
      method   = method.aes_gcm.default_method
      enforced = true
    }

    plan {
      method = method.aes_gcm.default_method
    }
  }
}

# .github/workflows/opentofu.yml
name: OpenTofu CI/CD Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  TF_VERSION: "1.8.2"
  AWS_REGION: "ap-northeast-1"

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  # ─────────────────────────────────────────
  # JOB 1: Validate & Plan
  # ─────────────────────────────────────────
  plan:
    name: "OpenTofu Plan"
    runs-on: ubuntu-latest
    environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'development' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1
        with:
          tofu_version: ${{ env.TF_VERSION }}

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: OpenTofu Init
        id: init
        run: tofu init -input=false

      - name: OpenTofu Validate
        id: validate
        run: tofu validate -no-color

      - name: OpenTofu Plan
        id: plan
        run: tofu plan -no-color -out=tfplan
        continue-on-error: false

      - name: Upload Plan Artifact
        uses: actions/upload-artifact@v4
        with:
          name: tfplan
          path: tfplan
          retention-days: 1

      - name: Comment Plan on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const output = `#### OpenTofu Plan 📖
            \`\`\`
            ${{ steps.plan.outputs.stdout }}
            \`\`\`
            *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            });

  # ─────────────────────────────────────────
  # JOB 2: Apply（mainブランチのみ）
  # ─────────────────────────────────────────
  apply:
    name: "OpenTofu Apply"
    runs-on: ubuntu-latest
    needs: plan
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment:
      name: production
      url: https://console.aws.amazon.com

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1
        with:
          tofu_version: ${{ env.TF_VERSION }}

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: OpenTofu Init
        run: tofu init -input=false

      - name: Download Plan Artifact
        uses: actions/download-artifact@v4
        with:
          name: tfplan

      - name: OpenTofu Apply
        id: apply
        run: tofu apply -auto-approve -input=false tfplan

      - name: Notify Slack on Success
        if: success()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "✅ OpenTofu Apply 成功！！\nRepo: ${{ github.repository }}\nCommit: ${{ github.sha }}\nActor: ${{ github.actor }}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

      - name: Notify Slack on Failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "🚨 OpenTofu Apply 失敗……やらかしちゃいましたヨ……\nRepo: ${{ github.repository }}\nCommit: ${{ github.sha }}\nActor: ${{ github.actor }}\nワークフロー確認してネ！！"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

# iam_github_oidc.tf
data "aws_iam_policy_document" "github_actions_trust" {
  statement {
    effect = "Allow"
    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github.arn]
    }
    actions = ["sts:AssumeRoleWithWebIdentity"]
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:your-org/your-repo:*"]
    }
  }
}

infrastructure/
├── modules/              # 再利用可能なモジュール
│   ├── vpc/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   ├── eks/
│   └── rds/
├── environments/         # 環境別設定
│   ├── dev/
│   │   ├── main.tf
│   │   ├── backend.tf    # OpenTofu v1.8+で変数補間可能！！
│   │   └── terraform.tfvars
│   ├── staging/
│   └── prod/
└── .github/
    └── workflows/
        └── opentofu.yml  # 上記の完全版CI/CDデス！！

# .opentofu-version（プロジェクトルートに置くだけ！！）
1.8.2

# .tool-versions
opentofu 1.8.2