pipelines-delegated.yml

name: Pipelines Execute
run-name: Run Gruntwork Pipelines
on:
  workflow_call:
    inputs:
      # This field can be overriden to customize the runner used for pipelines
      # workflows.
      #
      # IMPORTANT: To use self-hosted runners this workflow must be hosted in
      # the same GitHub organization as your infra-live repository.
      # See https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-self-hosted-runners
      #
      # The value must be an escaped JSON string that will be decoded to the
      # jobs.runs-on field
      # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on
      #
      # For example:
      # - A simple github runner: "\"ubuntu-22.04\""
      # - A list of labels: "[\"self-hosted\", \"linux\"]"
      # - A map: "{group: \"ubuntu-runners\", labels: \"ubuntu-20.04-16core\"}"
      runner:
        type: string
        default: "\"ubuntu-latest\""
    secrets:
      PIPELINES_READ_TOKEN:
        required: true

env:
  PIPELINES_CLI_VERSION: v0.15.1
  PIPELINES_ACTIONS_VERSION: main
  BOILERPLATE_VERSION: v0.5.16
  GRUNTWORK_INSTALLER_VERSION: v0.0.40

jobs:
  detect_changes:
    name: Detect Infrastructure Changes
    runs-on: ${{ fromJSON(inputs.runner) }}
    steps:
      - name: Checkout Pipelines Actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_VERSION }}
          token: ${{ secrets.PIPELINES_READ_TOKEN }}

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0

      - name: Preflight Checks
        uses: ./pipelines-actions/.github/actions/pipelines-preflight-action
        with:
          PIPELINES_READ_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}

      - name: Pipelines Orchestrate
        id: orchestrate
        uses: ./pipelines-actions/.github/actions/pipelines-orchestrate
        with:
          token: ${{ secrets.PIPELINES_READ_TOKEN || secrets.GITHUB_TOKEN }}

    outputs:
      pipelines_jobs: ${{ steps.orchestrate.outputs.jobs }}

  pipelines_determine:
    name: ${{ contains(matrix.jobs.Action.Command, 'plan') && 'Plan' || 'Apply' }} - ${{ matrix.jobs.ChangeType }} - ${{ matrix.jobs.WorkingDirectory }}
    needs: [detect_changes]
    runs-on: ${{ fromJSON(inputs.runner) }}
    # GHA can't check for length, so we just check if there is an item in the 0 index
    if: fromJson(needs.detect_changes.outputs.pipelines_jobs)[0] != null
    strategy:
      fail-fast: false
      matrix:
        jobs: ${{ fromJson(needs.detect_changes.outputs.pipelines_jobs) }}
    steps:
      - name: Checkout Pipelines Actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_VERSION }}
          token: ${{ secrets.PIPELINES_READ_TOKEN }}

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0

      - name: Bootstrap Workflow
        id: bootstrap
        uses: ./pipelines-actions/.github/actions/pipelines-bootstrap
        with:
          token: ${{ secrets.PIPELINES_READ_TOKEN }}
          change_type: ${{ matrix.jobs.ChangeType }}
          branch: ${{ matrix.jobs.Ref }}
          working_directory: ${{ matrix.jobs.WorkingDirectory }}
          account_id: ${{ matrix.jobs.AccountId }}
          terragrunt_command: ${{ matrix.jobs.Action.Command }} ${{ matrix.jobs.Action.Args }}
          additional_data: ${{ toJson(matrix.jobs.AdditionalData) }}
          child_account_id: ${{ matrix.jobs.AdditionalData.ChildAccountId }}
          account_names: ${{ matrix.jobs.AdditionalData.AccountNames }}

      - name: "Run terragrunt ${{ steps.bootstrap.outputs.terragrunt_command }} in ${{ steps.bootstrap.outputs.working_directory }}"
        id: terragrunt
        uses: ./pipelines-actions/.github/actions/pipelines-execute
        env:
          TERRAGRUNT_AUTH_PROVIDER_CMD: 'pipelines auth terragrunt-credentials --ci github-actions --cloud aws --wd .'
        with:
          token: ${{ secrets.PIPELINES_READ_TOKEN }}
          tf_binary: ${{ steps.gruntwork_context.outputs.tf_binary }}
          working_directory: ${{ steps.gruntwork_context.outputs.working_directory }}
          terragrunt_command: ${{ steps.gruntwork_context.outputs.terragrunt_command }}
          infra_live_repo_branch: ${{ steps.gruntwork_context.outputs.branch }}
          gruntwork_config_file: ${{ steps.gruntwork_context.outputs.gruntwork_config_file }}
          infra_live_repo: "."
          infra_live_directory: "."
          deploy_branch_name: ${{ steps.gruntwork_context.outputs.deploy_branch_name }}

      - name: Update comment
        if: always()
        uses: ./pipelines-actions/.github/actions/pipelines-status-update
        with:
          step_name: ${{ matrix.jobs.ChangeType }}
          step_working_directory: ${{ matrix.jobs.WorkingDirectory }}
          step_status: ${{ steps.terragrunt.conclusion == 'success' && 'success' || 'failed' }}
          step_details: ${{ steps.terragrunt.outputs.formatted_plan_output || 'Check the logs for more details.' }}
          step_details_extended_log: ${{ steps.terragrunt.outputs.execute_stdout_log }}
          pull_request_number: ${{ steps.bootstrap.outputs.pr_number }}

    outputs:
      account_id: ${{ matrix.jobs.AccountId }}
      branch: ${{ steps.bootstrap.outputs.branch }}
      action: ${{ steps.bootstrap.outputs.action }}
      working_directory: ${{ steps.bootstrap.outputs.working_directory }}
      terragrunt_command: ${{ steps.bootstrap.outputs.terragrunt_command }}
      additional_data: ${{ steps.bootstrap.outputs.additional_data }}
      child_account_id: ${{ steps.bootstrap.outputs.child_account_id }}