ci-infra.yml

name: CI - Infra Enforcement

on:
  push:
    branches:
      - main
    paths:
      - '.gcp/terraforms/**'
      - '.github/workflows/ci-infra.yml'
  
  # Allows manual and CDs to call this
  workflow_dispatch:
  workflow_call:

env:
  ENV: dev
  REGION: us-east1
  GITHUB_REPO: BLMgithub/operations-analytics-pipeline

# Add concurrency control to prevent state lock issues
concurrency:
  group: terraform-checkpoint
  cancel-in-progress: false

permissions:
  contents: 'read'
  id-token: 'write'
  
jobs:
  terraform-enforce:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: .gcp/terraforms
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
          service_account: ${{ secrets.DEPLOYER_SA_EMAIL }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Apply (Sync)
        env:
          TF_VAR_environment: ${{ env.ENV }}
          TF_VAR_project_id: ${{ secrets.GCP_PROJECT_ID }}
          TF_VAR_region: ${{ env.REGION }}
          TF_VAR_github_repo: ${{ env.GITHUB_REPO }}
          TF_VAR_alert_email_map: ${{ secrets.ALERT_EMAIL_MAP }}
          TF_VAR_bq_dataset_id: ${{secrets.BQ_DATASET_ID}}
        run: terraform apply -auto-approve