KainosStudio-CoreInfra-Public/.github/workflows/nonprod-deploy-specific-env.yaml at main · KainosSoftwareLtd/KainosStudio-CoreInfra-Public · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: Non-Prod AWS Deployment - Specific Environment

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: true
        type: choice
        options:
          - pipeline
          - dev
          - staging
      Apply:
        description: 'Apply Terraform changes'
        required: true
        default: false
        type: boolean

permissions:
  id-token: write
  contents: read

defaults:
  run:
    working-directory: aws/non-prod-infra

jobs:
  plan:
    name: Plan - ${{ inputs.environment }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Configure AWS Credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::975050265283:role/GHA-CodeBuild-Service-Role
          aws-region: eu-west-2

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.4

      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'

      - name: Install Checkov
        run: pip3 install checkov==3.2.365

      - name: Initialize Terraform
        run: ./run.sh ${{ inputs.environment }} init

      - name: Run Terraform validation and checkov
        run: make check ${{ inputs.environment }}

      - name: Run Terraform plan
        id: plan
        run: make plan ${{ inputs.environment }}

  apply:
    name: Apply - ${{ inputs.environment }}
    needs: plan
    if: ${{ github.event.inputs.Apply == 'true' }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment == 'pipeline' && 'Pipeline' || inputs.environment == 'dev' && 'Dev' || inputs.environment == 'staging' && 'Staging' }}

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Configure AWS Credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::975050265283:role/GHA-CodeBuild-Service-Role
          aws-region: eu-west-2

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.4

      - name: Initialize Terraform
        run: ./run.sh ${{ inputs.environment }} init

      - name: Run Terraform plan
        id: plan
        run: make plan ${{ inputs.environment }}

      - name: Run Terraform apply
        run: make apply ${{ inputs.environment }}