aws-template-terraform.yml

name: AWS Template Workflow

on:
  workflow_call:
    inputs:
      CONTEXT_FOLDER:
        required: true
        type: string
      ENVIRONMENT_NAME:
        required: true
        type: string
      CHANGE_FOLDER_NAME:
        required: true
        type: string
      APPLY_TF_CODE:
        required: true
        default: false
        type: boolean

permissions:
  id-token: write
  contents: read

jobs:
  check_changes:
    name: Check Changes
    runs-on: ubuntu-20.04
    outputs:
      infra_changed: ${{ steps.check_changes.outputs.infra_changed }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
      - name: Check modified folders
        id: check_changes
        env:
          CONTEXT_FOLDER: ${{ inputs.CONTEXT_FOLDER }}
          CHANGE_FOLDER_NAME: ${{ inputs.CHANGE_FOLDER_NAME }}
        run: |
          echo "=============== list modified files ==============="
          git diff --name-only HEAD^ HEAD

          echo "========== check paths of modified files =========="
          git diff --name-only HEAD^ HEAD >> files.txt
          infra_changed=false
          while IFS= read -r file
          do
            echo $file
            if [[ $file == $CHANGE_FOLDER_NAME/* ]]; then
              infra_changed=true
              break
            fi
          done < files.txt
          echo "infra_changed=$infra_changed" >> "$GITHUB_OUTPUT"

  scan:
    name: Scan TF Code
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: tfsec
        uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: tfsec.sarif
          working_directory: ${{ inputs.CONTEXT_FOLDER }}
          tfsec_args: "--tfvars-file=${{ inputs.CONTEXT_FOLDER }}/${{ inputs.ENVIRONMENT_NAME }}.tfvars"
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: tfsec.sarif
    needs: [check_changes]

  deploy_infra:
    name: Deploy Infra
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.ENVIRONMENT_NAME }}
    env:
      TF_VAR_app_name: ${{ vars.APP_NAME }}
      TF_VAR_environment: ${{ vars.ENVIRONMENT_NAME }}
      TF_VAR_kms_key_name: ${{ vars.KMS_KEY_NAME }}
      TF_VAR_vpc_id: ${{ vars.VPC_ID }}
      TF_VAR_lambda_memory_size: ${{ vars.LAMBDA_MEMORY_SIZE }}
    needs: [check_changes, scan]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-skip-session-tagging: true
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          role-duration-seconds: 1800
          role-session-name: ci-deployment

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.0
      - name: Terraform Init
        id: init
        env:
          CONTEXT_FOLDER: ${{ inputs.CONTEXT_FOLDER }}
        run: |
          terraform init -input=false -backend-config=backend.tfvars -var-file=${{ inputs.ENVIRONMENT_NAME }}.tfvars
        working-directory: ${{ inputs.CONTEXT_FOLDER }}
      - name: Terraform Plan
        id: plan
        env:
          CONTEXT_FOLDER: ${{ inputs.CONTEXT_FOLDER }}
        run: |
          terraform plan -no-color -input=false -var-file=${{ inputs.ENVIRONMENT_NAME }}.tfvars
        continue-on-error: true
        working-directory: ${{ inputs.CONTEXT_FOLDER }}
      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1
      - name: Terraform Apply
        if: inputs.APPLY_TF_CODE == true
        env:
          CONTEXT_FOLDER: ${{ inputs.CONTEXT_FOLDER }}
        run: |
          terraform apply --auto-approve -input=false -var-file=${{ inputs.ENVIRONMENT_NAME }}.tfvars
        working-directory: ${{ inputs.CONTEXT_FOLDER }}