core-security-deployment.yml

---
name: core-security-deployment

on:
  push:
    branches:
      - main
    paths:
      - 'terraform/environments/core-security/**'
      - 'terraform/modules/vpc-hub/**'
      - 'terraform/modules/core-monitoring/**'
      - '.github/workflows/core-security-deployment.yml'
  pull_request:
    branches:
      - main
    paths:
      - 'terraform/environments/core-security/**'
      - 'terraform/modules/vpc-hub/**'
      - 'terraform/modules/core-monitoring/**'
      - '.github/workflows/core-security-deployment.yml'
  workflow_dispatch:

env:
  TF_IN_AUTOMATION: true
  AWS_REGION: "eu-west-2"
  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout


defaults:
  run:
    shell: bash

jobs:
  core-security-deployment-plan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: 1.21
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false

      - name: Run terraform plan in terraform/environments/core-security
        run: |
          git_dir=`git rev-parse --show-toplevel`
          terraform --version
          # Test if this is a PR or PULL event
          if [ ! -z ${{ github.event.pull_request.number }} ]
          then
          #CONFIGURE TERRAFORM AND WORKSPACE
          bash scripts/terraform-init.sh terraform/environments/core-security
          terraform -chdir="terraform/environments/core-security" workspace select core-security-production

          #RUN TERRATEST
          pushd terraform/environments/core-security/test
          go mod tidy
          TEST=`go test | ${git_dir}/scripts/redact-output.sh | tee /dev/stderr | tail -n 1`
          popd
          TEST="> TERRATEST RESULT - core-security
          ${TEST}"
          bash scripts/update-pr-comments.sh "${TEST}"

          #RUN TERRAFORM PLAN
          PLAN=`bash scripts/terraform-plan.sh terraform/environments/core-security | tee /dev/stderr | grep '^Plan: \|^No changes.'`
          PLAN="> TERRAFORM PLAN RESULT - core-security
          ${PLAN}"
          bash scripts/update-pr-comments.sh "${PLAN}"
          fi
        env:
          SECRET: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ secrets.GITHUB_REPOSITORY }}
          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}

  core-security-deployment-apply:
    runs-on: ubuntu-latest
    if: github.event.ref == 'refs/heads/main'
    needs: [core-security-deployment-plan]
    steps:
      - name: Checkout Repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false

      - name: Run Terraform apply in terraform/environments/core-security
        run: |
          terraform --version
          bash scripts/terraform-init.sh terraform/environments/core-security
          terraform -chdir="terraform/environments/core-security" workspace select core-security-production
          bash scripts/terraform-apply.sh terraform/environments/core-security
      - name: Slack failure notification
        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
        with:
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        if: ${{ failure() }}