Skip to content

Commit db87150

Browse files
marvinbussmarvinbuss
authored
Merge pull request #85 from PerfectThymeTech/marvinbuss/update_workflows
Update GitHub Workflows
2 parents 32bbc6d + 1d97b42 commit db87150

13 files changed

+279
-335
lines changed

‎.github/dependabot.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,17 @@ updates:
2424
- "pip"
2525
- "dependencies"
2626

27+
# Maintain dependencies for pip
28+
- package-ecosystem: "pip"
29+
directory: "/"
30+
schedule:
31+
interval: "weekly"
32+
day: "sunday"
33+
time: "10:00"
34+
labels:
35+
- "pip"
36+
- "dependencies"
37+
2738
# Maintain dependencies for Terraform
2839
- package-ecosystem: "terraform"
2940
directory: "/code/infra"

‎.github/workflows/_containerTemplate.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Docker Template
1+
name: Container Template
22

33
on:
44
workflow_call:
@@ -111,7 +111,7 @@ jobs:
111111
# This step uses the identity token to provision an ephemeral certificate against the sigstore community Fulcio instance.
112112
- name: Sign container image
113113
id: sign
114-
if: ${{ github.event_name != 'pull_request' }}
114+
if: github.event_name == 'release'
115115
run: |
116116
cosign sign --yes "${TAGS}@${DIGEST}"
117117
env:

‎.github/workflows/_terraformApplyTemplate.yml

Lines changed: 0 additions & 88 deletions
This file was deleted.

‎.github/workflows/_terraformEnvironmentTemplate.yml

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
name: Terraform Template
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environment:
7+
required: true
8+
type: string
9+
description: "Specifies the environment of the deployment."
10+
config:
11+
required: true
12+
type: string
13+
description: "Specifies the configuration folder for the deployment."
14+
terraform_version:
15+
required: true
16+
type: string
17+
description: "Specifies the terraform version."
18+
working_directory:
19+
required: true
20+
type: string
21+
description: "Specifies the working directory."
22+
tenant_id:
23+
required: true
24+
type: string
25+
description: "Specifies the tenant id of the deployment."
26+
subscription_id:
27+
required: true
28+
type: string
29+
description: "Specifies the subscription id of the deployment."
30+
secrets:
31+
CLIENT_ID:
32+
required: true
33+
description: "Specifies the client id."
34+
CLIENT_SECRET:
35+
required: true
36+
description: "Specifies the client secret."
37+
MY_SAMPLE_SECRET:
38+
required: true
39+
description: "Specifies a sample secret."
40+
41+
permissions:
42+
id-token: write
43+
contents: read
44+
pull-requests: write
45+
46+
jobs:
47+
lint:
48+
name: Terraform Lint
49+
runs-on: ubuntu-latest
50+
continue-on-error: false
51+
52+
steps:
53+
# Setup Terraform
54+
- name: Setup Terraform
55+
id: terraform_setup
56+
uses: hashicorp/setup-terraform@v3
57+
with:
58+
terraform_version: ${{ inputs.terraform_version }}
59+
terraform_wrapper: true
60+
61+
# Check Out Repository
62+
- name: Check Out Repository
63+
id: checkout_repository
64+
uses: actions/checkout@v4
65+
66+
# Terraform Format
67+
- name: Terraform Format
68+
id: terraform_format
69+
working-directory: ${{ inputs.working_directory }}
70+
run: |
71+
terraform fmt -check -recursive
72+
73+
# Add Pull Request Comment
74+
- name: Add Pull Request Comment
75+
uses: actions/github-script@v7
76+
id: pr_comment
77+
if: github.event_name == 'pull_request'
78+
with:
79+
github-token: ${{ secrets.GITHUB_TOKEN }}
80+
script: |
81+
const output = `#### Terraform Lint Results
82+
* Terraform Version 📎\`${{ inputs.terraform_version }}\`
83+
* Working Directory 📂\`${{ inputs.working_directory }}\`
84+
* Terraform Format and Style 🖌\`${{ steps.terraform_format.outcome }}\``;
85+
86+
github.rest.issues.createComment({
87+
issue_number: context.issue.number,
88+
owner: context.repo.owner,
89+
repo: context.repo.repo,
90+
body: output
91+
})
92+
93+
plan:
94+
name: Terraform Plan
95+
runs-on: self-hosted
96+
continue-on-error: false
97+
environment: ${{ inputs.environment }}
98+
needs: [lint]
99+
100+
env:
101+
ARM_TENANT_ID: ${{ inputs.tenant_id }}
102+
ARM_SUBSCRIPTION_ID: ${{ inputs.subscription_id }}
103+
ARM_CLIENT_ID: ${{ secrets.CLIENT_ID }}
104+
ARM_CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
105+
ARM_USE_OIDC: false
106+
107+
steps:
108+
# Setup Node
109+
- name: Setup Node
110+
id: node_setup
111+
uses: actions/setup-node@v4
112+
with:
113+
node-version: 18
114+
115+
# Setup Terraform
116+
- name: Setup Terraform
117+
id: terraform_setup
118+
uses: hashicorp/setup-terraform@v3
119+
with:
120+
terraform_version: ${{ inputs.terraform_version }}
121+
terraform_wrapper: true
122+
123+
# Check Out Repository
124+
- name: Check Out Repository
125+
id: checkout_repository
126+
uses: actions/checkout@v4
127+
128+
# Terraform Init
129+
- name: Terraform Init
130+
id: terraform_init
131+
working-directory: ${{ inputs.working_directory }}
132+
run: |
133+
terraform init -backend-config=../../config/${CONFIG}/azurerm.tfbackend
134+
env:
135+
CONFIG: ${{ inputs.config }}
136+
137+
# Terraform Validate
138+
- name: Terraform Validate
139+
id: terraform_validate
140+
working-directory: ${{ inputs.working_directory }}
141+
run: |
142+
terraform validate
143+
144+
# Terraform Plan
145+
- name: Terraform Plan
146+
id: terraform_plan
147+
working-directory: ${{ inputs.working_directory }}
148+
run: |
149+
terraform plan -var-file="../../config/${CONFIG}/vars.tfvars" -input=false
150+
env:
151+
CONFIG: ${{ inputs.config }}
152+
TF_VAR_my_secret: ${{ secrets.MY_SAMPLE_SECRET }}
153+
154+
# Add Pull Request Comment
155+
- name: Add Pull Request Comment
156+
id: pr_comment
157+
uses: actions/github-script@v7
158+
if: github.event_name == 'pull_request'
159+
continue-on-error: true
160+
env:
161+
PLAN: "terraform\n${{ steps.terraform_plan.outputs.stdout }}"
162+
with:
163+
github-token: ${{ secrets.GITHUB_TOKEN }}
164+
script: |
165+
const output = `#### Terraform Validation & Plan Results
166+
* Terraform Version 📎\`${{ inputs.terraform_version }}\`
167+
* Working Directory 📂\`${{ inputs.working_directory }}\`
168+
* Terraform Initialization ⚙️\`${{ steps.terraform_init.outcome }}\`
169+
* Terraform Validation 🤖\`${{ steps.terraform_validate.outcome }}\`
170+
* Terraform Plan 📖\`${{ steps.terraform_plan.outcome }}\`
171+
172+
<details><summary>Show Plan</summary>
173+
174+
\`\`\`\n
175+
${process.env.PLAN}
176+
\`\`\`
177+
178+
</details>`;
179+
180+
github.rest.issues.createComment({
181+
issue_number: context.issue.number,
182+
owner: context.repo.owner,
183+
repo: context.repo.repo,
184+
body: output
185+
})
186+
187+
apply:
188+
name: Terraform Apply
189+
runs-on: self-hosted
190+
continue-on-error: false
191+
environment: ${{ inputs.environment }}
192+
if: github.event_name == 'push' || github.event_name == 'release'
193+
needs: [plan]
194+
195+
env:
196+
ARM_TENANT_ID: ${{ inputs.tenant_id }}
197+
ARM_SUBSCRIPTION_ID: ${{ inputs.subscription_id }}
198+
ARM_CLIENT_ID: ${{ secrets.CLIENT_ID }}
199+
ARM_CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
200+
ARM_USE_OIDC: false
201+
202+
steps:
203+
# Setup Node
204+
- name: Setup Node
205+
id: node_setup
206+
uses: actions/setup-node@v4
207+
with:
208+
node-version: 18
209+
210+
# Setup Terraform
211+
- name: Setup Terraform
212+
id: terraform_setup
213+
uses: hashicorp/setup-terraform@v3
214+
with:
215+
terraform_version: ${{ inputs.terraform_version }}
216+
terraform_wrapper: true
217+
218+
# Check Out Repository
219+
- name: Check Out Repository
220+
id: checkout_repository
221+
uses: actions/checkout@v4
222+
223+
# Terraform Init
224+
- name: Terraform Init
225+
working-directory: ${{ inputs.working_directory }}
226+
run: |
227+
terraform init -backend-config=../../config/${CONFIG}/azurerm.tfbackend
228+
env:
229+
CONFIG: ${{ inputs.config }}
230+
231+
# Terraform Apply
232+
- name: Terraform Apply
233+
working-directory: ${{ inputs.working_directory }}
234+
run: |
235+
terraform apply -var-file="../../config/${CONFIG}/vars.tfvars" -auto-approve -input=false
236+
env:
237+
CONFIG: ${{ inputs.config }}
238+
TF_VAR_my_secret: ${{ secrets.MY_SAMPLE_SECRET }}

0 commit comments

Comments
 (0)