ci_terraform.yml

name: ci_terraform
on:
  push:
    branches:
      - main
    paths:
      - "terraform/**"
  pull_request:
    paths:
      - "terraform/**"

concurrency:
  # Support push/pr as event types with different behaviors each:
  # 1. push: queue up builds
  # 2. pr: only allow one run per PR
  group: ${{ github.workflow }}-${{ github.event.type }}${{ github.event.pull_request.number }}
  # If there is already a workflow running for the same pull request, cancel it
  cancel-in-progress: ${{ github.event.type == 'PullRequest' }}

jobs:
  check-fmt:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Init Terraform
        id: tf-init
        uses: WalletConnect/actions/terraform/init/@1.0.3
        with:
          environment: staging

      - name: Check Terraform Formatting
        id: tf-fmt
        uses: WalletConnect/actions/terraform/check-fmt/@1.0.3

  get-version:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.clean_version.outputs.version }}
    steps:
      #TODO: Authenticate to avoid API rate limit exceeded errors.
      - name: Get latest release for image version
        id: latest_release
        uses: pozetroninc/github-action-get-latest-release@master
        with:
          repository: ${{ github.repository }}
          excludes: draft

      - name: Get release value
        id: get_value
        uses: actions/github-script@v6
        env:
          LATEST_TAG: ${{ steps.latest_release.outputs.release }}
        with:
          result-encoding: string
          script: |
            if (context.eventName == "release") {
              return context.payload.release.tag_name
            } else {
              return process.env.LATEST_TAG
            }

      - name: Clean version
        id: clean_version
        run: |
          version=$(echo "${{ steps.get_value.outputs.result }}" | sed 's/v//g')
          echo "version=$version" >> $GITHUB_OUTPUT

  plan-staging:
    if: github.event_name == 'pull_request'
    needs:
      - get-version
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      pull-requests: 'write'
    environment:
      name: staging
      url: https://staging.echo.walletconnect.com/health

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-central-1

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Get Grafana details
        id: grafana-get-details
        uses: WalletConnect/actions/aws/grafana/get-details/@1.0.3

      - name: Get Grafana key
        id: grafana-get-key
        uses: WalletConnect/actions/aws/grafana/get-key/@1.0.3
        with:
          key-prefix: ${{ github.event.repository.name }}-staging
          workspace-id: ${{ steps.grafana-get-details.outputs.workspace-id }}

      - name: Init Terraform
        id: tf-init
        uses: WalletConnect/actions/terraform/init/@1.0.3
        with:
          environment: staging

      - name: Run Terraform Plan
        id: tf-plan-staging
        uses: WalletConnect/actions/terraform/plan/@1.0.3
        env:
          TF_VAR_grafana_auth: ${{ steps.grafana-get-key.outputs.key }}
          TF_VAR_grafana_endpoint: ${{ steps.grafana-get-details.outputs.endpoint }}
          TF_VAR_jwt_secret: ${{ secrets.JWT_SECRET }}
          TF_VAR_relay_public_key: ${{ secrets.RELAY_PUBLIC_KEY }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          environment: staging

      - name: Delete Grafana key
        id: grafana-delete-key
        uses: WalletConnect/actions/aws/grafana/delete-key/@1.0.3
        if: ${{ success() || failure() || cancelled() }} # don't use always() since it creates non-cancellable jobs
        with:
          key-name: ${{ steps.grafana-get-key.outputs.key-name }}
          workspace-id: ${{ steps.grafana-get-details.outputs.workspace-id }}