terraform-member-environment.yml

---
name: "Terraform: Member environments"

on:
  push:
    branches:
      - main
    paths:
      - 'terraform/environments/*/*.tf'
      - '!terraform/environments/bootstrap/*/*.tf'
      - '!terraform/environments/core-*/*.tf'
  pull_request:
    types: [opened, edited, reopened, synchronize]
    branches-ignore:
      - 'date*'
    paths:
      - 'terraform/environments/*/*.tf'
      - '!terraform/environments/bootstrap/*/*.tf'
      - '!terraform/environments/core-*/*.tf'
  workflow_dispatch:

defaults:
  run:
    shell: bash

env:
  TF_IN_AUTOMATION: true
  AWS_REGION: "eu-west-2"
  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  find-environments:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Get changed directories
        id:   directories
        run:  |
          git fetch origin main --unshallow
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "CHANGED_DIRECTORIES=$(git diff HEAD origin/main --name-only | awk '{print $1}' | grep ".tf" | grep -a "environments//*" | cut -f1-3 -d"/" | uniq | base64 -w 0 )"
          else
            echo "CHANGED_DIRECTORIES=$(git diff HEAD^ HEAD --name-only | awk '{print $1}' | grep ".tf" | grep -a "environments//*" | cut -f1-3 -d"/" | uniq | base64 -w 0)"
          fi >> $GITHUB_OUTPUT
      - name: Display changed directories
        run: echo "Directories in scope:" ${{ steps.directories.outputs.CHANGED_DIRECTORIES }}
      - name: Slack failure notification
        uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
        with:
          webhook-type: incoming-webhook
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        if: ${{ failure() && (github.event.ref == 'refs/heads/main') }}
    outputs:
      directories: ${{ steps.directories.outputs.CHANGED_DIRECTORIES }}

  terraform-plan:
    runs-on: ubuntu-latest
    needs: find-environments
    strategy:
      fail-fast: false
      matrix:
        environment: [development, test, preproduction, production]
    env:
      TF_IN_AUTOMATION: "true"
    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set account number
        run: |
          ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)
          echo "::add-mask::$ACCOUNT_NUMBER"
          echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - name: Setup Terraform
        id: setup
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: Terraform init
        id: init
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            echo "Running 'terraform init' in" $directory
            scripts/terraform-init.sh $directory
          done
      - name: Terraform workspace
        id: workspace
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
                workspace="$(basename $directory)-${{ matrix.environment }}"

                if terraform -chdir="$directory" workspace list | grep "$workspace"; then
                  terraform -chdir="$directory" workspace select "$workspace"

                else
                  echo "Workspace '$workspace' does not exist, skipping further processing"
                  echo "skip_plan=true" >> $GITHUB_OUTPUT
                fi

                unset workspace
          done
          echo "Selected $(terraform -chdir="$directory" workspace show)"
      - name: Terraform plan
        id: plan
        if: ${{ steps.workspace.outputs.skip_plan != 'true' }}
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            workspace="$(basename $directory)-${{ matrix.environment }}"
            scripts/terraform-plan.sh $directory
            unset workspace
          done
      - name: Slack failure notification
        uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
        with:
          webhook-type: incoming-webhook
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        if: ${{ failure() && (github.event.ref == 'refs/heads/main') }}
      - name: Mark job skipped
        if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
        run: |
          echo "::warning ::Terraform plan was skipped as no valid workspace was found."

  terraform-apply-dev-test:
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    needs: [find-environments, terraform-plan]
    strategy:
      fail-fast: false
      matrix:
        environment: [development, test]
    environment: ${{ matrix.environment }}
    env:
      TF_IN_AUTOMATION: "true"
    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set account number
        run: |
          ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)
          echo "::add-mask::$ACCOUNT_NUMBER"
          echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - name: Setup Terraform
        id: setup
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: Terraform init
        id: init
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            echo "Running 'terraform init' in" $directory
            scripts/terraform-init.sh $directory
          done
      - name: Terraform workspace
        id: workspace
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
                workspace="$(basename $directory)-${{ matrix.environment }}"

                if terraform -chdir="$directory" workspace list | grep "$workspace"; then
                  terraform -chdir="$directory" workspace select "$workspace"

                else
                  echo "Workspace '$workspace' does not exist, skipping further processing"
                  echo "skip_plan=true" >> $GITHUB_OUTPUT
                fi

                unset workspace
          done
          echo "Selected $(terraform -chdir="$directory" workspace show)"
      - name: Terraform plan
        id: plan
        if: ${{ steps.workspace.outputs.skip_plan != 'true' }}
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            workspace="$(basename $directory)-${{ matrix.environment }}"
            scripts/terraform-plan.sh $directory -out="$workspace.tfplan"
            unset workspace
          done
      - name: Terraform apply
        id: apply
        if: ${{ steps.plan.conclusion == 'success' }}
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            workspace="$(basename $directory)-${{ matrix.environment }}"
            scripts/terraform-apply.sh $directory "$workspace.tfplan"
            unset workspace
          done

      - name: Mark job skipped
        if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
        run: |
          echo "::warning ::Terraform plan was skipped as no valid workspace was found."

  terraform-apply-preprod-prod:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: [find-environments, terraform-plan]
    strategy:
      fail-fast: false
      matrix:
        environment: [preproduction, production]
    environment: ${{ matrix.environment }}
    env:
      TF_IN_AUTOMATION: "true"
    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set account number
        run: |
          ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)
          echo "::add-mask::$ACCOUNT_NUMBER"
          echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - name: Setup Terraform
        id: setup
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: "~1"
          terraform_wrapper: false
      - name: Terraform init
        id: init
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            echo "Running 'terraform init' in" $directory
            scripts/terraform-init.sh $directory
          done
      - name: Terraform workspace
        id: workspace
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
                workspace="$(basename $directory)-${{ matrix.environment }}"

                if terraform -chdir="$directory" workspace list | grep "$workspace"; then
                  terraform -chdir="$directory" workspace select "$workspace"

                else
                  echo "Workspace '$workspace' does not exist, skipping further processing"
                  echo "skip_plan=true" >> $GITHUB_OUTPUT
                fi

                unset workspace
          done
          echo "Selected $(terraform -chdir="$directory" workspace show)"
      - name: Terraform plan
        id: plan
        if: ${{ steps.workspace.outputs.skip_plan != 'true' }}
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            workspace="$(basename $directory)-${{ matrix.environment }}"
            scripts/terraform-plan.sh $directory -out="$workspace.tfplan"
            unset workspace
          done
      - name: Terraform apply
        id: apply
        if: ${{ steps.plan.conclusion == 'success' }}
        run: |
          export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
          for directory in $CHANGED_DIRECTORIES; do
            workspace="$(basename $directory)-${{ matrix.environment }}"
            scripts/terraform-apply.sh $directory "$workspace.tfplan"
            unset workspace
          done

      - name: Slack failure notification
        uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
        with:
          webhook-type: incoming-webhook
          payload: |
            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        if: ${{ failure() }}

      - name: Mark job skipped
        if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
        run: |
          echo "::warning ::Terraform plan was skipped as no valid workspace was found."