helmfile_production_plan.yaml

name: Production - Helmfile Diff

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
    paths:
      - "VERSION"

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  HELMFILE_FILE_PATH: ${{ github.workspace }}/helmfile
  PRODUCTION_AWS_ACCOUNT: ${{ secrets.PRODUCTION_AWS_ACCOUNT_ID }}
  OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_PRODUCTION }}  

jobs:
  helmfile-diff:
    if: github.event.pull_request.base.ref == 'main' && (contains(github.event.pull_request.title, '[AUTO-PR]') || contains(github.event.pull_request.title, '[MANIFEST]'))
    runs-on: ubuntu-latest
    steps:

      - name: Inject token authentication
        run: |
          git config --global url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
        id: awsconfig
        with:
          aws-access-key-id: ${{ secrets.PRODUCTION_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.PRODUCTION_AWS_SECRET_ACCESS_KEY }}
          aws-region: ca-central-1

      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          # Fetches entire history, so we can analyze commits since last tag
          fetch-depth: 0

      - name: Setup helmfile
        uses: mamezou-tech/setup-helmfile@03233e1cd9b19b2ba320e431f7bcc0618db4248d # v2.0.0
        with:
          install-kubectl: yes
          install-helm: yes
          helmfile-version: "v0.151.0"

      - name: Install 1Pass CLI
        run: |
          curl -o 1pass.deb https://downloads.1password.com/linux/debian/amd64/stable/1password-cli-amd64-latest.deb
          sudo dpkg -i 1pass.deb 

      - name: Install OpenVPN
        run: |
          sudo apt update
          sudo apt install -y openvpn openvpn-systemd-resolved

      - name: Setup Terraform tools
        uses: cds-snc/terraform-tools-setup@v1
        env: # In case you want to override default versions
          CONFTEST_VERSION: 0.30.0 
          TERRAFORM_VERSION: 1.9.5
          TERRAGRUNT_VERSION: 0.66.9
          TF_SUMMARIZE_VERSION: 0.2.3                      

      - name: Retrieve VPN Config
        run: |
          scripts/createVPNConfig.sh production 2> /dev/null            

      - name: Connect to VPN
        uses: "kota65535/github-openvpn-connect-action@cd2ed8a90cc7b060dc4e001143e811b5f7ea0af5" # v3.1.0
        with:
          config_file: /var/tmp/production.ovpn
          echo_config: false               

      - name: Configure kubeconfig
        run: |
          aws eks update-kubeconfig --name notification-canada-ca-production-eks-cluster --alias production  

      - name: Load EnvVars
        run: |
            ./helmfile/getContext.sh -g

      - name: Helmfile Diff
        id: helmfile_diff
        run: |
          pushd helmfile
          echo 'var<<EOF' >> $GITHUB_OUTPUT
          helmfile --environment production diff >> $GITHUB_OUTPUT
          echo 'EOF' >> $GITHUB_OUTPUT
          popd

      - name: Helmfile Diff Comment
        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
        with:
          message: | 
            ${{join(steps.helmfile_diff.outputs.*, '\n')}}