terraform-apply.yml

name: Terraform apply

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths: "terraform/**"

env:
  TERRAFORM: terraform
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  TF_VAR_github_token: ${{ secrets.MOJ_COLLABORATORS_GENERAL_ADMIN_BOT_PAT }}
  GITHUB_APP_ID: ${{ secrets.APP_ID }}
  GITHUB_APP_INSTALLATION_ID: ${{ secrets.APP_INSTALLATION_ID }}
  GITHUB_APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
  TF_IN_AUTOMATION: true

jobs:
  terraform-apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.3.4
      - run: |
          cd terraform
          terraform init
          terraform apply -auto-approve -lock-timeout=660s
      - name: Report failure to Slack
        if: always()
        uses: ravsamhq/notify-slack-action@v2
        with:
          status: ${{ job.status }}
          notify_when: "failure"
          notification_title: "Failed GitHub Action Run"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}