Use OpenTofu to have single .tfvars files for each environment, rather than nested modules
#130
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI / IaC | |
| on: | |
| pull_request: | |
| branches: [dev, stg, prd] | |
| types: [opened, reopened, synchronize, edited] | |
| paths: | |
| - 'terraform/**' | |
| - '.github/workflows/ci-iac.yml' | |
| env: | |
| tf_version: "1.8.0-alpha1" # must match value in terraform/app/main.tf | |
| jobs: | |
| env: | |
| name: Set Env Vars | |
| timeout-minutes: 1 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Set up DEV Environment Variables | |
| if: github.base_ref == 'dev' | |
| run: | | |
| matrix='{ | |
| "env":[ | |
| { | |
| "environment_name":"dev", | |
| "aws_account":"977306314792", | |
| "aws_gha_role":"hw-fargate-api-dev-gha" | |
| } | |
| ] | |
| }' | |
| echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV | |
| - name: Set up STG Environment Variables | |
| if: github.base_ref == 'stg' | |
| run: | | |
| matrix='{ | |
| "env":[ | |
| { | |
| "environment_name":"stg", | |
| "aws_account":"977306314792", | |
| "aws_gha_role":"hw-fargate-api-stg-gha" | |
| } | |
| ] | |
| }' | |
| echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV | |
| - name: Set up PRD/CPY Environment Variables | |
| if: github.base_ref == 'prd' | |
| run: | | |
| matrix='{ | |
| "env":[ | |
| { | |
| "environment_name":"prd", | |
| "aws_account":"539738229445", | |
| "aws_gha_role":"hw-fargate-api-prd-gha" | |
| }, | |
| { | |
| "environment_name":"cpy", | |
| "aws_account":"539738229445", | |
| "aws_gha_role":"hw-fargate-api-cpy-gha" | |
| } | |
| ] | |
| }' | |
| echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV | |
| outputs: | |
| matrix: ${{ env.matrix }} | |
| format: | |
| name: Terraform Format | |
| timeout-minutes: 3 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Terraform Setup | |
| uses: opentofu/setup-opentofu@v1 | |
| with: | |
| tofu_version: ${{ env.tf_version }} | |
| - name: Terraform Format | |
| working-directory: terraform | |
| run: tofu fmt -check -recursive | |
| plan: | |
| name: Terraform Plan / ${{ matrix.env.environment_name }} | |
| timeout-minutes: 6 | |
| runs-on: ubuntu-latest | |
| needs: env | |
| strategy: | |
| matrix: ${{ fromJson(needs.env.outputs.matrix) }} | |
| fail-fast: false | |
| permissions: | |
| contents: read | |
| actions: read | |
| pull-requests: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: "arn:aws:iam::${{ matrix.env.aws_account }}:role/${{ matrix.env.aws_gha_role }}" | |
| role-session-name: ${{ github.sha }} | |
| aws-region: us-west-2 | |
| - name: Terraform Setup | |
| uses: opentofu/setup-opentofu@v1 | |
| with: | |
| tofu_version: ${{ env.tf_version }} | |
| - name: Terraform Init | |
| working-directory: terraform/app | |
| run: tofu init -backend-config=${{ matrix.env.environment_name }}.s3.tfbackend | |
| - name: Terraform Plan | |
| working-directory: terraform/app | |
| run: tofu plan -var-file=${{ matrix.env.environment_name }}.tfvars -var 'image_tag=ci_test' -input=false -out plan -lock=false | |
| - name: Comment Terraform Plan | |
| uses: byu-oit/github-action-tf-plan-comment@v1 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| working-directory: terraform/app | |
| terraform-plan-file: plan | |
| - name: Analyze Terraform Plan | |
| uses: byu-oit/github-action-tf-plan-analyzer@v2 | |
| if: github.repository_owner == 'byu-oit' | |
| # If you're at BYU, but outside the byu-oit GitHub org, you may be able to obtain credentials by contacting [email protected] | |
| with: | |
| working-directory: terraform/app | |
| terraform-plan-file: plan | |
| divvycloud-username: ${{ secrets.DIVVYCLOUD_USERNAME }} | |
| divvycloud-password: ${{ secrets.DIVVYCLOUD_PASSWORD }} | |