terraform.yaml

name: Terraform
on:
  workflow_call:
    inputs:
      module:
        type: string
        required: true
      terraform_command:
        type: string
        default: apply
      terraform_version:
        default: 1.4.2
        type: string
    secrets:
      AWS_ACCOUNT_ID:
        description: AWS account in which Terraform will run
        required: true
      SLACK_BOT_TOKEN:
        description: Token used to send messages to Slack
        required: true

env:
  SLACK_CHANNEL: '#mission-control'

jobs:
  plan:
    name: Terraform
    runs-on: ubuntu-20.04
    defaults:
      run:
        shell: bash
        working-directory: ${{ inputs.module }}

    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        repository: thoughtbot/flightdeck-template
        path: template

    - name: Configure repository
      working-directory: template
      run: |
        bin/set-flightdeck-version ${{ github.ref_name }}
        bin/set-terraform-value attach_certificate_domains "[\"flightdeck-test.thoughtbot.com\"]"
        bin/set-terraform-value issue_certificate_domains '[]'
        bin/set-terraform-value create_domain_aliases "[\"${{ github.ref_name }}.flightdeck-test.thoughtbot.com\"]"
        bin/set-template-var ACCOUNT_ID ${{ secrets.AWS_ACCOUNT_ID }}
        ORG_NAME=$(echo 'flightdeck-${{ github.ref_name }}' | cut -c1-20)
        set -x
        bin/set-template-var ORG_NAME "$ORG_NAME"
        bin/set-template-var REGION us-east-1
        bin/set-template-var STATE_PREFIX ${{ github.ref_name }}/
        bin/set-template-var SANDBOX_ACCOUNT_ID ${{ secrets.AWS_ACCOUNT_ID }}
        bin/set-template-var SANDBOX_CERTIFICATE_DOMAIN_NAME flightdeck-test.thoughtbot.com
        bin/set-template-var SANDBOX_DOMAIN_NAME ${{ github.ref_name }}.flightdeck-test.thoughtbot.com
        bin/set-template-var SANDBOX_EXECUTION_ROLE flightdeck-ci-execution
        bin/set-template-var SANDBOX_HOSTED_ZONE flightdeck-test.thoughtbot.com
        bin/set-template-var SANDBOX_STATE_BUCKET flightdeck-ci-state
        bin/set-template-var SANDBOX_STATE_TABLE flightdeck-ci-state
        bin/set-template-var SANDBOX_STATE_KMS_KEY flightdeck-ci-state
        bin/set-template-var SANDBOX_STATE_ROLE flightdeck-ci-state

        # Destroy log group when destroying cluster
        bin/append-terraform-value platform/sandbox-v1/main.tf workload_platform logs_skip_destroy 'false'
        set +x

    - name: Archive Terraform configuration
      uses: actions/upload-artifact@v4
      with:
        name: terraform
        path: template
        overwrite: true

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-region: us-east-1
        role-to-assume: "arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/flightdeck-ci"

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: ${{ inputs.terraform_version }}

    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: '20'

    - name: Init
      working-directory: template/${{ inputs.module }}
      run: terraform init

    - name: Run
      working-directory: template/${{ inputs.module }}
      run: |
        terraform ${{ inputs.terraform_command }} -auto-approve

    - name: Notify Slack
      if: failure()
      uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
      with:
        channel-id: ${{ env.SLACK_CHANNEL }}
        slack-message: "Flightdeck acceptance terraform has failed to ${{ inputs.terraform_command }} on the ${{ inputs.module }} module."
      env:
        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}