deploy-test.yml

name: "Deploy - Test"

run-name: "${{ inputs.git_ref }}"

on:
  workflow_dispatch:
    inputs:
      git_ref:
        description: "Branch, tag or SHA to deploy"
        required: true
        type: "string"

permissions:
  pull-requests: write
  id-token: write # This is required for requesting the JWT
  contents: read  # This is required for actions/checkout

jobs:
  terraform_plan_apply_base_iam:
    name: Terraform Plan/Apply (base_iam)
    runs-on: ubuntu-latest
    environment: test
    steps:
      - name: Checkout branch
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.git_ref }}

      - name: Apply base_iam
        uses: ./.github/actions/tf-plan-apply
        with:
          aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/test-github-bootstrap
          bucket_prefix: "test"
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          aws_region: ${{ vars.AWS_REGION }}
          working_directory: "./base_iam"  # Use separate base_iam directory
          workspace: ${{ secrets.AWS_WORKSPACE }}
          tf_vars_file: ${{ vars.TF_VARS_FILE }}
          tf_extra_args: "-var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}"

  terraform_plan_apply:
    name: Terraform Plan/Apply (ndr-test)
    runs-on: ubuntu-latest
    needs: terraform_plan_apply_base_iam
    environment: test
    steps:
      - name: Checkout main
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.git_ref }}

      - name: Apply Main
        uses: ./.github/actions/tf-plan-apply
        with:
          # use newly created role
          aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_WORKSPACE }}-github-actions-role
          bucket_prefix: "test"
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          aws_region: ${{ vars.AWS_REGION }}
          workspace: ${{ secrets.AWS_WORKSPACE }}
          tf_vars_file: ${{ vars.TF_VARS_FILE }}