Skip to content

Commit 41d8271

Browse files
galarghgalargh
committed
Initial commit
0 parents  commit 41d8271

25 files changed

+1539
-0
lines changed

‎.github/actions/git-config-user/action.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Configure git user
2+
description: Configure git user
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- run: |
8+
git config --global user.email '${{ github.actor }}@users.noreply.github.com>'
9+
git config --global user.name '${{ github.actor }}'
10+
shell: bash

‎.github/actions/git-push/action.yml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Push to a git branch
2+
description: Push to a git branch
3+
4+
inputs:
5+
suffix:
6+
description: Branch name suffix
7+
required: true
8+
working-directory:
9+
description: Working directory
10+
required: false
11+
default: ${{ github.workspace }}
12+
13+
runs:
14+
using: composite
15+
steps:
16+
- run: |
17+
protected="$(gh api 'repos/{owner}/{repo}/branches/${{ github.ref_name }}' --jq '.protected')"
18+
19+
if [[ "$protected" == 'true' ]]; then
20+
git_branch='${{ github.ref_name }}-${{ inputs.suffix }}'
21+
else
22+
git_branch='${{ github.ref_name }}'
23+
fi
24+
25+
git checkout -B "$git_branch"
26+
27+
if [[ "$protected" == 'true' ]]; then
28+
git push origin "$git_branch" --force
29+
if [[ ! -z "$(git diff --name-only 'origin/${{ github.ref_name }}')" ]]; then
30+
state="$(gh pr view "$git_branch" --json state --jq .state 2> /dev/null || echo '')"
31+
if [[ "$state" != 'OPEN' ]]; then
32+
gh pr create --body 'The changes in this PR were made by a bot. Please review carefully.' --head "$git_branch" --base '${{ github.ref_name }}' --fill
33+
fi
34+
fi
35+
else
36+
git push origin "$git_branch"
37+
fi
38+
shell: bash
39+
working-directory: ${{ inputs.working-directory }}

‎.github/workflows/apply.yml

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: Apply
2+
3+
on:
4+
push:
5+
workflow_dispatch:
6+
7+
jobs:
8+
prepare:
9+
if: github.ref_name == github.event.repository.default_branch &&
10+
github.event.repository.is_template == false
11+
permissions:
12+
contents: read
13+
issues: read
14+
pull-requests: read
15+
name: Prepare
16+
runs-on: ubuntu-latest
17+
outputs:
18+
workspaces: ${{ steps.workspaces.outputs.this }}
19+
sha: ${{ steps.sha.outputs.this }}
20+
defaults:
21+
run:
22+
shell: bash
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v2
26+
- name: Discover workspaces
27+
id: workspaces
28+
run: echo "::set-output name=this::$(ls github | jq --raw-input '[.]' | jq -sc add)"
29+
- name: Find pull request number
30+
id: pull_request
31+
if: github.event_name == 'push'
32+
env:
33+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
uses: protocol/github-api-action-library/find-content-by-query@v1
35+
with:
36+
query: repository:${{ github.repository }} ${{ github.sha }}
37+
- name: Find sha for plan
38+
id: sha
39+
env:
40+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41+
run: |
42+
if [[ '${{ github.event_name }}' == 'push' ]]; then
43+
number="$(jq -r '.[0].number // ""' <<< '${{ steps.pull_request.outputs.issues-or-pull-requests }}')"
44+
if [[ ! -z "$number" ]]; then
45+
sha="$(gh pr view "$number" --json commits --jq '.commits[-1].oid')"
46+
fi
47+
else
48+
sha='${{ github.sha }}'
49+
fi
50+
echo "::set-output name=this::$sha"
51+
apply:
52+
needs: [prepare]
53+
if: needs.prepare.outputs.sha != '' && needs.prepare.outputs.workspaces != ''
54+
permissions:
55+
actions: read
56+
contents: read
57+
strategy:
58+
fail-fast: false
59+
matrix:
60+
workspace: ${{ fromJson(needs.prepare.outputs.workspaces) }}
61+
name: Apply
62+
runs-on: ubuntu-latest
63+
env:
64+
TF_IN_AUTOMATION: 1
65+
TF_INPUT: 0
66+
TF_WORKSPACE: ${{ matrix.workspace }}
67+
AWS_ACCESS_KEY_ID: ${{ secrets.RW_AWS_ACCESS_KEY_ID }}
68+
AWS_SECRET_ACCESS_KEY: ${{ secrets.RW_AWS_SECRET_ACCESS_KEY }}
69+
GITHUB_APP_ID: ${{ secrets.RW_GITHUB_APP_ID }}
70+
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RW_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] }}
71+
GITHUB_APP_PEM_FILE: ${{ secrets.RW_GITHUB_APP_PEM_FILE }}
72+
TF_VAR_write_delay_ms: 300
73+
defaults:
74+
run:
75+
shell: bash
76+
working-directory: terraform
77+
steps:
78+
- name: Checkout
79+
uses: actions/checkout@v2
80+
- name: Setup terraform
81+
uses: hashicorp/setup-terraform@3d8debd658c92063839bc97da5c2427100420dec # v1.3.2
82+
with:
83+
terraform_version: 1.1.4
84+
- name: Initialize terraform
85+
run: terraform init
86+
- name: Retrieve targets from config
87+
id: target
88+
run: echo "::set-output name=this::$(jq -r 'split(" ")[:-1] | map("-target=github_\(sub(".json$"; "")).this") | join(" ")' <<< '"'"$(ls | tr '\n' ' ')"'"')"
89+
working-directory: github/${{ env.TF_WORKSPACE }}
90+
- name: Terraform Plan Download
91+
env:
92+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
93+
run: gh run download -n ${{ env.TF_WORKSPACE }}_${{ needs.prepare.outputs.sha }}.tfplan --repo ${{ github.repository }}
94+
- name: Terraform Apply
95+
run: terraform apply -auto-approve -lock-timeout=0s -no-color ${{ env.TF_WORKSPACE }}.tfplan

‎.github/workflows/plan.yml

+171
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
name: Plan
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- "Plan (pre)"
7+
types:
8+
- completed
9+
workflow_dispatch:
10+
11+
jobs:
12+
prepare:
13+
if: (github.event_name == 'workflow_dispatch' &&
14+
github.ref_name == github.event.repository.default_branch) ||
15+
(github.event_name == 'workflow_run' &&
16+
github.event.workflow_run.conclusion == 'success')
17+
permissions:
18+
actions: read
19+
contents: read
20+
statuses: write
21+
name: Prepare
22+
runs-on: ubuntu-latest
23+
outputs:
24+
workspaces: ${{ steps.workspaces.outputs.this }}
25+
repository: ${{ steps.github.outputs.repository }}
26+
sha: ${{ steps.github.outputs.sha }}
27+
number: ${{ steps.github.outputs.number }}
28+
defaults:
29+
run:
30+
shell: bash
31+
steps:
32+
- name: Find repository and sha to checkout
33+
id: github
34+
env:
35+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+
run: |
37+
if [[ '${{ github.event_name }}' == 'workflow_dispatch' ]]; then
38+
repository='${{ github.repository }}'
39+
sha='${{ github.sha }}'
40+
elif [[ '${{ github.event_name }}' == 'workflow_run' ]]; then
41+
repository='${{ github.event.workflow_run.head_repository.full_name }}'
42+
sha='${{ github.event.workflow_run.head_commit.id }}'
43+
number="$(gh api '/repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}' --jq '.pull_requests[0].number')"
44+
fi
45+
echo "::set-output name=repository::$repository"
46+
echo "::set-output name=sha::$sha"
47+
echo "::set-output name=number::$number"
48+
- run: sha=${{ steps.github.outputs.sha }}
49+
- env:
50+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
51+
run: gh api 'repos/${{ github.repository }}/statuses/${{ steps.github.outputs.sha }}' -f context='Plan' -f state='pending' -f target_url='${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
52+
- name: Checkout
53+
uses: actions/checkout@v2
54+
with:
55+
repository: ${{ steps.github.outputs.repository }}
56+
ref: ${{ steps.github.outputs.sha }}
57+
- name: Discover workspaces
58+
id: workspaces
59+
run: echo "::set-output name=this::$(ls github | jq --raw-input '[.]' | jq -sc add)"
60+
plan:
61+
needs: [prepare]
62+
if: needs.prepare.outputs.workspaces != ''
63+
permissions:
64+
contents: read
65+
strategy:
66+
fail-fast: false
67+
matrix:
68+
workspace: ${{ fromJson(needs.prepare.outputs.workspaces) }}
69+
name: Plan
70+
runs-on: ubuntu-latest
71+
env:
72+
TF_IN_AUTOMATION: 1
73+
TF_INPUT: 0
74+
TF_WORKSPACE: ${{ matrix.workspace }}
75+
AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
76+
AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
77+
GITHUB_APP_ID: ${{ secrets.RO_GITHUB_APP_ID }}
78+
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RO_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] }}
79+
GITHUB_APP_PEM_FILE: ${{ secrets.RO_GITHUB_APP_PEM_FILE }}
80+
TF_VAR_write_delay_ms: 300
81+
defaults:
82+
run:
83+
shell: bash
84+
working-directory: terraform
85+
steps:
86+
- name: Checkout
87+
uses: actions/checkout@v2
88+
with:
89+
repository: ${{ needs.prepare.outputs.repository }}
90+
ref: ${{ needs.prepare.outputs.sha }}
91+
- name: Setup terraform
92+
uses: hashicorp/setup-terraform@3d8debd658c92063839bc97da5c2427100420dec # v1.3.2
93+
with:
94+
terraform_version: 1.1.4
95+
- name: Initialize terraform
96+
run: terraform init
97+
- name: Check terraform lock
98+
if: github.event_name == 'workflow_run'
99+
run: git diff --exit-code .terraform.lock.hcl
100+
- name: Format terraform
101+
run: terraform fmt -check
102+
- name: Validate terraform
103+
run: terraform validate -no-color
104+
- name: Retrieve targets from config
105+
id: target
106+
run: echo "::set-output name=this::$(jq -r 'split(" ")[:-1] | map("-target=github_\(sub(".json$"; "")).this") | join(" ")' <<< '"'"$(ls | tr '\n' ' ')"'"')"
107+
working-directory: github/${{ env.TF_WORKSPACE }}
108+
- name: Plan terraform
109+
id: plan
110+
run: terraform plan ${{ steps.target.outputs.this }} -refresh=false -lock=false -out=${{ env.TF_WORKSPACE }}.tfplan -no-color
111+
- name: Upload terraform plan
112+
uses: actions/upload-artifact@v2
113+
with:
114+
name: ${{ env.TF_WORKSPACE }}_${{ needs.prepare.outputs.sha }}.tfplan
115+
path: terraform/${{ env.TF_WORKSPACE }}.tfplan
116+
if-no-files-found: error
117+
retention-days: 90
118+
comment:
119+
needs: [prepare, plan]
120+
if: github.event_name == 'workflow_run'
121+
permissions:
122+
contents: read
123+
pull-requests: write
124+
name: Comment
125+
runs-on: ubuntu-latest
126+
env:
127+
AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
128+
AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
129+
defaults:
130+
run:
131+
shell: bash
132+
working-directory: terraform
133+
steps:
134+
- name: Checkout
135+
uses: actions/checkout@v2
136+
with:
137+
repository: ${{ needs.prepare.outputs.repository }}
138+
ref: ${{ needs.prepare.outputs.sha }}
139+
- name: Setup terraform
140+
uses: hashicorp/setup-terraform@3d8debd658c92063839bc97da5c2427100420dec # v1.3.2
141+
with:
142+
terraform_version: 1.1.4
143+
terraform_wrapper: false
144+
- name: Initialize terraform
145+
run: terraform init
146+
- name: Download terraform plans
147+
uses: actions/download-artifact@v2
148+
with:
149+
path: terraform
150+
- name: Show terraform plans
151+
run: |
152+
echo 'COMMENT<<EOF' >> $GITHUB_ENV
153+
for plan in $(find . -type f -name '*.tfplan'); do
154+
echo "<details><summary>$(basename "$plan" '.tfplan')</summary>" >> $GITHUB_ENV
155+
echo '' >> $GITHUB_ENV
156+
echo '```' >> $GITHUB_ENV
157+
echo "$(terraform show -no-color "$plan" 2>&1)" >> $GITHUB_ENV
158+
echo '```' >> $GITHUB_ENV
159+
echo '' >> $GITHUB_ENV
160+
echo '</details>' >> $GITHUB_ENV
161+
done
162+
echo 'EOF' >> $GITHUB_ENV
163+
- name: Comment on pull request
164+
uses: marocchino/sticky-pull-request-comment@39c5b5dc7717447d0cba270cd115037d32d28443 # v2.2.0
165+
with:
166+
number: ${{ needs.prepare.outputs.number }}
167+
message: |
168+
Before merge, verify that all the following plans are correct. They will be applied as-is after the merge.
169+
170+
#### Terraform plans
171+
${{ env.COMMENT }}

‎.github/workflows/plan_post.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "Plan (post)"
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- Plan
7+
types:
8+
- completed
9+
10+
jobs:
11+
notify:
12+
permissions:
13+
actions: read
14+
statuses: write
15+
name: "Notify"
16+
runs-on: ubuntu-latest
17+
defaults:
18+
run:
19+
shell: bash
20+
steps:
21+
- env:
22+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
23+
run: |
24+
sha="$(gh api '/repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}/jobs' --jq '.jobs[] | .steps[] | .name | select(startswith("Run sha="))')"
25+
sha="${sha#Run sha=}"
26+
gh api "repos/${{ github.repository }}/statuses/$sha" -f context='Plan' -f state='${{ github.event.workflow_run.conclusion }}' -f target_url='${{ github.event.workflow_run.html_url }}'

‎.github/workflows/plan_pre.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: "Plan (pre)"
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
trigger:
8+
if: github.event.pull_request.base.ref == github.event.repository.default_branch &&
9+
github.event.repository.is_template == false
10+
name: "Trigger"
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: "true"

0 commit comments

Comments
 (0)