national-document-repository-infrastructure/.github/workflows/tear-down-sandbox.yml at 55127ca1d273fdfd25ceb6163ea1ede540b7468b · NHSDigital/national-document-repository-infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
name: "Tear down - Sandbox/Test"

run-name: "${{ inputs.git_ref }} | ${{ inputs.sandbox_name }} | ${{ inputs.environment }}"

on:
  workflow_dispatch:
    inputs:
      git_ref:
        default: "main"
        description: "Branch, tag or SHA for the destroy action"
        required: true
        type: "string"
      sandbox_name:
        description: "Sandbox to destroy"
        required: true
        type: "string"
      environment:
        default: "development"
        description: "GitHub Environment name"
        required: true
        type: choice
        options:
          - "development"
          - "test"

  workflow_call:
    inputs:
      git_ref:
        default: "main"
        description: "Branch, tag or SHA for the destroy action"
        required: true
        type: "string"
      sandbox_name:
        description: "Sandbox to destroy"
        required: true
        type: "string"
      environment:
        default: "development"
        description: "GitHub Environment name"
        required: true
        type: "string"

permissions:
  pull-requests: write
  id-token: write
  contents: read

jobs:
  remove_edge_associations:
    name: Remove Lambda@Edge Associations
    uses: ./.github/workflows/base-cleanup-lambda-edge.yml
    with:
      git_ref: ${{ inputs.git_ref }}
      sandbox_name: ${{ inputs.sandbox_name }}
      environment: ${{ inputs.environment }}
    secrets:
      AWS_ASSUME_ROLE: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ inputs.sandbox_name}}-github-actions-role

  cleanup_versions:
    name: Cleanup Versions
    uses: ./.github/workflows/base-cleanup-workspace.yml
    with:
      git_ref: ${{ inputs.git_ref }}
      sandbox_name: ${{ inputs.sandbox_name }}
      environment: ${{ inputs.environment }}
    secrets:
      AWS_ASSUME_ROLE: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ inputs.sandbox_name}}-github-actions-role

  terraform_destroy:
    name: Terraform Destroy
    runs-on: ubuntu-latest
    needs: [remove_edge_associations] # Ensure this runs after Lambda@Edge removal
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.git_ref }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ inputs.sandbox_name}}-github-actions-role
          aws-region: ${{ vars.AWS_REGION }}
          mask-aws-account-id: true

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.14.7

      - name: Initialise Terraform
        run: terraform init -backend-config=${{ vars.TF_BACKEND_FILE }}
        working-directory: ./infrastructure

      - name: Select Terraform Workspace
        run: terraform workspace select ${{ inputs.sandbox_name }}
        working-directory: ./infrastructure

      - name: Run Terraform Destroy
        run: terraform destroy -auto-approve -var-file="${{ vars.TF_VARS_FILE }}"
        working-directory: ./infrastructure

  terraform_destroy_base_iam:
    name: Terraform Destroy (base_iam)
    # Only destroy base_iam in a Sandbox environment. Don't tear down in ndr-test or ndr-dev environments.
    if: ${{ inputs.environment == 'development' && inputs.sandbox_name != 'ndr-dev' }}
    runs-on: ubuntu-latest
    needs: [terraform_destroy]
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.git_ref }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/dev-github-bootstrap
          aws-region: ${{ vars.AWS_REGION }}
          mask-aws-account-id: true

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.14.7

      - name: Initialise Terraform
        run: terraform init -backend-config=bucket=ndr-dev-terraform-state-${{ secrets.AWS_ACCOUNT_ID }}
        working-directory: ./base_iam

      - name: Select Terraform Workspace
        run: terraform workspace select ${{ inputs.sandbox_name }}
        working-directory: ./base_iam

      - name: Run Terraform Destroy
        run: terraform destroy -auto-approve -var-file="${{ vars.TF_VARS_FILE }}" -var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}
        working-directory: ./base_iam

  cleanup_resources:
    name: Cleanup Resources
    runs-on: ubuntu-latest
    needs: [terraform_destroy_base_iam]
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.git_ref }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/dev-github-bootstrap
          aws-region: ${{ vars.AWS_REGION }}
          mask-aws-account-id: true

      - name: Setup Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: 3.11

      - name: Install Python Dependencies
        run: |
          python3 -m venv ./venv
          ./venv/bin/pip3 install --upgrade pip boto3

      - name: Run Cleanup Script (Terraform Workspace)
        run: ./venv/bin/python3 -u scripts/cleanup_terraform_states.py ${{ inputs.sandbox_name }}

      - name: Run Cleanup Script (Log Group)
        run: ./venv/bin/python3 -u scripts/cleanup_log_groups.py ${{ inputs.sandbox_name }}