terraform.yaml

name: Terraform Deploy

on:
  push:
    branches:
    - master
    paths:
    - 'infra/**'
    - .github/workflows/terraform.yaml


permissions:
  id-token: write   # This is required for requesting the JWT
  contents: read    # This is required for actions/checkout

jobs:
  plan-and-approve:
    runs-on: ubuntu-latest
    env:
      AWS_REGION: sa-east-1
    steps:
    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@v3.0.1
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        role-session-name: GitHub_to_AWS_via_FederatedOIDC
        aws-region: ${{ env.AWS_REGION }}
    - name: install terraform
      uses: hashicorp/setup-terraform@v2
    - name: checkout repository
      uses: actions/checkout@v3
      with:
        submodules: 'true'
    - name: terraform init
      run: terraform init
      working-directory: infra
    - name: terraform plan
      run: terraform plan
      working-directory: infra

  
  execute-plan:
    runs-on: ubuntu-latest
    needs: plan-and-approve
    environment: production # This is required for the approval step
    env:
      AWS_REGION: sa-east-1
    steps:
    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@v3.0.1
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        role-session-name: GitHub_to_AWS_via_FederatedOIDC
        aws-region: ${{ env.AWS_REGION }}
    - name: install terraform
      uses: hashicorp/setup-terraform@v2
    - name: checkout repository
      uses: actions/checkout@v3
      with:
        submodules: 'true'
    - name: terraform init
      run: terraform init
      working-directory: infra
    - name: terraform apply
      run: terraform apply -auto-approve
      working-directory: infra