refresh-data-replication.yml

name: Refresh Data Replication
run-name: Refresh data replication resources & data for ${{ inputs.environment }}

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Deployment environment
        required: true
        type: choice
        options:
          - training
          - production
          - test
          - qa
          - sandbox-alpha
          - sandbox-beta
      db_snapshot_arn:
        description: ARN of the DB snapshot to use (optional)
        required: false
        type: string
      egress_cidr:
        description: CIDR blocks to allow egress traffic.
        type: string
        required: true
        default: "[]"
      take_db_snapshot:
        description: Take a new DB snapshot before creating the environment
        type: boolean
        default: false

permissions: {}

env:
  environment: ${{ inputs.environment }}
  db_snapshot_arn: ${{ inputs.db_snapshot_arn }}
  egress_cidr: ${{ inputs.egress_cidr }}
  aws_role: ${{ inputs.environment == 'production'
    && 'arn:aws:iam::820242920762:role/GithubDeployDataReplicationInfrastructure'
    || 'arn:aws:iam::393416225559:role/GithubDeployDataReplicationInfrastructure' }}
  db_snapshot_role: ${{ inputs.environment == 'production'
    && 'arn:aws:iam::820242920762:role/DatabaseSnapshotRole'
    || 'arn:aws:iam::393416225559:role/DatabaseSnapshotRole' }}

defaults:
  run:
    working-directory: terraform/data_replication

concurrency:
  group: deploy-data-replica-${{ inputs.environment }}

jobs:
  prepare-db-replica:
    name: Prepare data replica
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
      - name: Assume DB Snapshot role
        if: inputs.take_db_snapshot
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.db_snapshot_role }}
          aws-region: eu-west-2
      - name: Take DB snapshot
        if: inputs.take_db_snapshot
        run: |
          set -e
          snapshot_identifier=snapshot-for-data-replication-$(date +"%Y-%m-%d-%H-%M-%S")
          aws rds create-db-cluster-snapshot --db-cluster-identifier mavis-$environment --db-cluster-snapshot-identifier $snapshot_identifier
          echo "Waiting for snapshot to be available. This can take a while."
          aws rds wait db-cluster-snapshot-available --db-cluster-snapshot-identifier $snapshot_identifier
          echo "New snapshot is now available"
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.aws_role }}
          aws-region: eu-west-2
      - name: Get latest snapshot
        id: get-latest-snapshot
        run: |
          set -e
          if [ -z "$db_snapshot_arn" ]; then
              echo "No snapshot ARN provided, fetching the latest snapshot"
              SNAPSHOT_ARN=$(aws rds describe-db-cluster-snapshots \
              --query "DBClusterSnapshots[?DBClusterIdentifier=='mavis-$environment'].[DBClusterSnapshotArn, SnapshotCreateTime]" \
              --output text | sort -k2 -r | head -n 1 | cut -f1)

              if [ -z "$SNAPSHOT_ARN" ]; then
                  echo "No snapshots found for mavis-$environment"
                  exit 1
              fi
          else
              echo "Using provided snapshot ARN: $db_snapshot_arn"
              SNAPSHOT_ARN="$db_snapshot_arn"
          fi
          echo "Using snapshot ARN: $SNAPSHOT_ARN"
          echo "SNAPSHOT_ARN=$SNAPSHOT_ARN" >> $GITHUB_OUTPUT
      - name: Install terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.13.3
    outputs:
      SNAPSHOT_ARN: ${{ steps.get-latest-snapshot.outputs.SNAPSHOT_ARN }}

  plan:
    name: Terraform plan
    runs-on: ubuntu-latest
    needs:
      - prepare-db-replica
    env:
      SNAPSHOT_ARN: ${{ needs.prepare-db-replica.outputs.SNAPSHOT_ARN }}
      DB_SECRET_ARN: ${{ needs.prepare-db-replica.outputs.DB_SECRET_ARN || 'arn:aws:secretsmanager:eu-west-2:000000000000:secret:placeholder' }}
    permissions:
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.aws_role }}
          aws-region: eu-west-2
      - name: Install terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.13.3
      - name: Get db secret arn
        id: get-db-secret-arn
        working-directory: terraform/app
        run: |
          terraform init -backend-config="env/$environment-backend.hcl" -upgrade
          DB_SECRET_ARN=$(terraform output --raw db_secret_arn)
          echo "DB_SECRET_ARN=$DB_SECRET_ARN" >> $GITHUB_OUTPUT
      - name: Terraform Plan
        id: plan
        run: |
          set -eo pipefail
          terraform init -backend-config="env/$environment-backend.hcl" -upgrade

          PLAN_ARGS=(
            "plan"
            "-var=db_secret_arn=${{ steps.get-db-secret-arn.outputs.DB_SECRET_ARN }}"
            "-var=imported_snapshot=$SNAPSHOT_ARN"
            "-var-file=env/$environment.tfvars"
            "-var=allowed_egress_cidr_blocks=$egress_cidr"
            "-out=${{ runner.temp }}/tfplan"
            "-replace" "aws_rds_cluster.cluster"
          )

          terraform "${PLAN_ARGS[@]}" | tee ${{ runner.temp }}/tf_stdout
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: tfplan_infrastructure-${{ inputs.environment }}
          path: ${{ runner.temp }}/tfplan

  notify-approval-required:
    name: Notify on approval required
    runs-on: ubuntu-latest
    needs: plan
    if: ${{ inputs.environment == 'production' }}
    steps:
      - name: Notify pending approval
        if: inputs.environment == 'production'
        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a
        with:
          webhook: ${{ secrets.SLACK_MAVIS_TECH_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            text: ":hourglass: Approval required :hourglass:"
            blocks:
              - type: "section"
                text:
                  type: "mrkdwn"
                  text: "${{ github.workflow }} requires approval"
              - type: "section"
                fields:
                  - type: "mrkdwn"
                    text: "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run>"
                  - type: "mrkdwn"
                    text: "*Triggered by:*\n${{ github.actor }}"

  apply:
    name: Terraform apply
    runs-on: ubuntu-latest
    needs: plan
    environment: ${{ inputs.environment }}
    permissions:
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.aws_role }}
          aws-region: eu-west-2
      - name: Download artifact
        uses: actions/download-artifact@v5
        with:
          name: tfplan_infrastructure-${{ inputs.environment }}
          path: ${{ runner.temp }}
      - name: Install terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.13.3
      - name: Apply the changes
        run: |
          set -e
          terraform init -backend-config="env/$environment-backend.hcl" -upgrade
          terraform apply ${{ runner.temp }}/tfplan