-
Notifications
You must be signed in to change notification settings - Fork 6
170 lines (157 loc) · 7.05 KB
/
terraform.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
name: Terraform
# This reusable workflow will perform terraform related actions like verify the validity of
# the terraform modules and update the PR with the terraform plan output. It also has steps
# to apply the respective terraform changes when a commit is pushed.
on:
workflow_call:
inputs:
workspaces:
description: "A newline-separated list of globs or dependency glob expressions ('workspace-glob : dependency-glob') representing specific workspaces"
required: true
type: string
global_dependencies:
description: "A newline-separated list of globs representing dependencies of each workspace. If any of the dependencies have changed then all workspaces will be returned. Applies only to 'push' and 'pull_request' events."
required: false
type: string
relative_to_path:
description: "If provided, results will be relative to the given path"
required: false
type: string
secrets:
aws_access_key_id:
required: true
aws_secret_access_key:
required: true
ssh_private_key:
required: true
codefresh_api_key:
required: false
jobs:
minimize-previous-comments:
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- name: Minimize previous comments
uses: iStreamPlanet/github-actions/[email protected]
with:
github-token: ${{secrets.GITHUB_TOKEN}}
by-author: github-actions
body-includes: |
terraform init
terraform fmt
terraform validate
terraform plan
determine-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.build-workspace-matrix.outputs.matrix }}
steps:
- uses: actions/checkout@v4
- id: build-workspace-matrix
uses: iStreamPlanet/github-actions/[email protected]
with:
github-token: ${{secrets.GITHUB_TOKEN}}
workspaces: ${{ inputs.workspaces }}
workflow_dispatch_workspace: ${{ github.event.inputs.workspace }}
global_dependencies: ${{ inputs.global_dependencies }}
relative_to_path: ${{ inputs.relative_to_path }}
terraform:
needs: [determine-matrix]
runs-on: ubuntu-latest
if: needs.determine-matrix.outputs.matrix != '{"workspace":[]}'
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
concurrency: terraform-${{ matrix.workspace }}
# Only declare an environment on events that result in 'terraform apply'
environment: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && matrix.workspace || null }}
env:
AWS_ACCESS_KEY_ID: ${{ secrets.aws_access_key_id }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.aws_secret_access_key }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CODEFRESH_API_KEY: ${{ secrets.codefresh_api_key }}
WORKSPACE: ${{ matrix.workspace }}
WORKFLOW_RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
steps:
- uses: actions/checkout@v4
- name: Install asdf on the Action Runner
uses: asdf-vm/actions/[email protected]
with:
asdf_branch: "v0.10.2"
- name: Install asdf tools
working-directory: ${{ env.WORKSPACE }}
run: |
cp ./.tool-versions $HOME/
asdf plugin-add terraform
asdf plugin-add sops
asdf install
- name: "terraform fmt"
uses: iStreamPlanet/github-actions/[email protected]
if: github.event_name == 'pull_request'
with:
command: fmt
working_directory: ${{ env.WORKSPACE }}
- name: "Setup SSH access"
uses: webfactory/[email protected]
with:
ssh-private-key: ${{ secrets.ssh_private_key }}
- name: "terraform init"
uses: iStreamPlanet/github-actions/[email protected]
env:
GIT_SSH_COMMAND: "ssh -o StrictHostKeyChecking=no -i $HOME/.ssh/id_rsa"
with:
command: init
working_directory: ${{ env.WORKSPACE }}
- name: "terraform validate"
uses: iStreamPlanet/github-actions/[email protected]
with:
command: validate
working_directory: ${{ env.WORKSPACE }}
- name: "terraform plan"
id: terraform-plan
uses: iStreamPlanet/github-actions/[email protected]
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
with:
command: plan
working_directory: ${{ env.WORKSPACE }}
- name: "terraform apply"
uses: iStreamPlanet/github-actions/[email protected]
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
with:
command: apply
working_directory: ${{ env.WORKSPACE }}
- name: Update drift issue
uses: iStreamPlanet/github-actions/[email protected]
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
# Open an issue if drift detected during on schedule run, otherwise we just ran an 'apply' so assume drift is resolved
open: ${{ github.event_name == 'schedule' && steps.terraform-plan.outputs.plan-has-changes == 'true' }}
title: "Terraform drift in `${{ env.WORKSPACE }}`"
body: |
#### Terraform plan for `${{ env.WORKSPACE }}`
```diff
${{steps.terraform-plan.outputs.plan-output}}
```
Run the [apply workflow][1] manually with workspace `${{ env.WORKSPACE }}` to resolve.
*Workflow: [`${{ github.workflow }}`](${{ env.WORKFLOW_RUN_URL }})*
[1]: https://github.com/${{github.repository}}/actions/workflows/terraform.yml
close-comment: |
Drift resolved.
*Workflow: [`${{ github.workflow }}`](${{ env.WORKFLOW_RUN_URL }}), Event: `${{ github.event_name }}`, Actor `${{ github.actor }}`*
# NOTE: this step should always be last in the job
- name: Update execution failure issue
uses: iStreamPlanet/github-actions/[email protected]
# Run regardless of job completion status, except for PRs, where the workflow result is communicated via a Check status
if: always() && github.event_name != 'pull_request'
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
# Open an issue if anything in the job failed, otherwise close any matching existing issues
open: ${{ job.status == 'failure' }}
title: "${{ github.workflow }} on ${{ github.event_name }} failed in `${{ matrix.workspace }}`"
body: |
The workflow run failed. Please investigate using the workflow run log linked below.
*Workflow: [`${{ github.workflow }}`](${{ env.WORKFLOW_RUN_URL }})*
close-comment: |
Most recent workflow run succeeded.
*Workflow: [`${{ github.workflow }}`](${{ env.WORKFLOW_RUN_URL }})*