account-terraform.yml

name: Account Terraform

on:
  workflow_call:
    inputs:
      base_sha:
        required: true
        type: string
      head_sha:
        required: true
        type: string
      environment:
        required: true
        type: string
      artifact_name:
        required: true
        type: string

concurrency:
  group: account-terraform-${{ github.repository }}-${{ inputs.environment }}
  cancel-in-progress: false

jobs:
  detect-account-infra-changes:
    runs-on: ubuntu-latest
    outputs:
      account_infra_changed: ${{ steps.diff.outputs.account_infra_changed }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
        with:
          fetch-depth: 0

      - name: Detect account terraform changes
        id: diff
        run: |
          base_sha="${{ inputs.base_sha }}"
          if [ -z "$base_sha" ] || [ "$base_sha" = "0000000000000000000000000000000000000000" ]; then
            base_sha=$(git rev-parse HEAD~1)
          fi

          changed_files=$(git diff --name-only "$base_sha" "${{ inputs.head_sha }}")
          if echo "$changed_files" | grep -q '^infrastructure/account/'; then
            echo "account_infra_changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "account_infra_changed=false" >> "$GITHUB_OUTPUT"
          fi

  account-terraform-plan:
    permissions:
      id-token: write
      contents: read
    needs: [detect-account-infra-changes]
    if: ${{ needs.detect-account-infra-changes.outputs.account_infra_changed == 'true' }}
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98

      - name: Connect to AWS
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
        with:
          aws-region: eu-west-2
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
          role-session-name: github-actions

      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85
        with:
          terraform_version: "1.12.2"

      - name: Resolve account terraform state bucket
        id: account-state-bucket
        env:
          CONFIGURED_ACCOUNT_TERRAFORM_STATE_BUCKET: ${{ vars.ACCOUNT_TERRAFORM_STATE_BUCKET }}
        run: |
          bucket_name="$(bash ./utilities/scripts/resolve_account_terraform_state_bucket.sh)"
          if [ -z "$bucket_name" ]; then
            echo "Resolved empty account terraform state bucket." >&2
            exit 1
          fi
          echo "bucket_name=$bucket_name" >> "$GITHUB_OUTPUT"

      - name: Terraform Init (account)
        working-directory: infrastructure/account
        run: make init ENVIRONMENT=${{ inputs.environment }} BUCKET_NAME=${{ steps.account-state-bucket.outputs.bucket_name }}

      - name: Terraform Plan (account)
        # Ignore cancellations to prevent Terraform from being killed while it holds a state lock
        # A stuck process can still be killed with the force-cancel API operation
        if: ${{ !failure() }}
        working-directory: infrastructure/account
        run: make plan-ci ENVIRONMENT=${{ inputs.environment }}

      - name: Save Account Terraform Plan
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        with:
          name: ${{ inputs.artifact_name }}
          path: infrastructure/account/tfplan

  account-terraform-manual-approval:
    needs: [account-terraform-plan]
    if: ${{ !cancelled() && needs.account-terraform-plan.result == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: account-level-infra-approval
    steps:
      - name: Await manual approval
        run: echo "Waiting for account-level infrastructure approval."

  account-terraform-apply:
    permissions:
      id-token: write
      contents: read
    needs: [account-terraform-manual-approval]
    if: ${{ !cancelled() && needs.account-terraform-manual-approval.result == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98

      - name: Connect to AWS
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
        with:
          aws-region: eu-west-2
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
          role-session-name: github-actions

      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85
        with:
          terraform_version: "1.12.2"

      - name: Resolve account terraform state bucket
        id: account-state-bucket
        env:
          CONFIGURED_ACCOUNT_TERRAFORM_STATE_BUCKET: ${{ vars.ACCOUNT_TERRAFORM_STATE_BUCKET }}
        run: |
          bucket_name="$(bash ./utilities/scripts/resolve_account_terraform_state_bucket.sh)"
          if [ -z "$bucket_name" ]; then
            echo "Resolved empty account terraform state bucket." >&2
            exit 1
          fi
          echo "bucket_name=$bucket_name" >> "$GITHUB_OUTPUT"

      - name: Retrieve Account Terraform Plan
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: ${{ inputs.artifact_name }}
          path: infrastructure/account

      - name: Terraform Init (account)
        working-directory: infrastructure/account
        run: make init ENVIRONMENT=${{ inputs.environment }} BUCKET_NAME=${{ steps.account-state-bucket.outputs.bucket_name }}

      - name: Terraform Apply (account)
        # Ignore cancellations to prevent Terraform from being killed while it holds a state lock
        # A stuck process can still be killed with the force-cancel API operation
        if: ${{ !failure() }}
        working-directory: infrastructure/account
        run: make apply-ci ENVIRONMENT=${{ inputs.environment }}

  account-terraform-not-required:
    needs: [detect-account-infra-changes]
    if: ${{ needs.detect-account-infra-changes.outputs.account_infra_changed != 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Skip account terraform
        run: echo "No account-level infrastructure changes detected."

  account-terraform-ready:
    needs:
      - account-terraform-plan
      - account-terraform-manual-approval
      - account-terraform-apply
      - account-terraform-not-required
    if: ${{ always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
    runs-on: ubuntu-latest
    steps:
      - name: Account terraform stage complete
        run: echo "Account terraform stage complete."