deploy-prod.yml

name: "Deploy - Prod"

run-name: "${{ inputs.git_tag }}"

on:
  workflow_dispatch:
    inputs:
      git_tag:
        description: "Git tag to deploy"
        required: true
        type: "string"

permissions:
  pull-requests: write
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  terraform_plan_apply_base_iam:
    name: Terraform Plan/Apply base-iam (prod)
    runs-on: ubuntu-latest
    environment: prod
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ github.event.inputs.git_tag }}
          fetch-depth: "0"

      - name: Apply base_iam
        uses: ./.github/actions/tf-plan-apply
        with:
          aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/prod-github-bootstrap
          bucket_prefix: "prod"
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          aws_region: ${{ vars.AWS_REGION }}
          working_directory: "./base_iam"  # Use separate base_iam directory
          workspace: ${{ secrets.AWS_WORKSPACE }}
          tf_vars_file: ${{ vars.TF_VARS_FILE }}
          tf_extra_args: "-var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}"

  terraform_plan_apply:
    name: Terraform Plan/Apply (prod)
    needs: ["terraform_plan_apply_base_iam"]
    runs-on: ubuntu-latest
    environment: prod
    steps:
      - name: Checkout Tag
        uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ inputs.git_tag }}
          fetch-depth: "0"

      - name: Apply Main
        uses: ./.github/actions/tf-plan-apply
        with:
          # use newly updated role
          aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/prod-github-actions-role
          bucket_prefix: "prod"
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          aws_region: ${{ vars.AWS_REGION }}
          workspace: ${{ secrets.AWS_WORKSPACE }}
          tf_vars_file: ${{ vars.TF_VARS_FILE }}