Skip to content

Commit e0916ea

Browse files
NogaNHSNogaNHS
authored
Merge branch 'main' into PRMP-1499
2 parents 66a71ff + 16c63c3 commit e0916ea

18 files changed

Lines changed: 1485 additions & 113 deletions

‎.github/workflows/cron-tear-down-test.yml‎

Lines changed: 39 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
sandbox_name: ndr-test
1919
environment: test
2020
secrets:
21-
AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
21+
AWS_ASSUME_ROLE: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_WORKSPACE }}-github-actions-role
2222

2323
cleanup_versions:
2424
name: Cleanup Versions
@@ -28,7 +28,7 @@ jobs:
2828
sandbox_name: ndr-test
2929
environment: test
3030
secrets:
31-
AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
31+
AWS_ASSUME_ROLE: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_WORKSPACE }}-github-actions-role
3232

3333
terraform_destroy_process:
3434
name: Destroy Test Environment
@@ -48,11 +48,12 @@ jobs:
4848
- name: Configure AWS Credentials
4949
uses: aws-actions/configure-aws-credentials@v6
5050
with:
51-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
51+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_WORKSPACE }}-github-actions-role
5252
role-skip-session-tagging: true
5353
aws-region: ${{ vars.AWS_REGION }}
5454
mask-aws-account-id: true
5555

56+
5657
- name: Setup Terraform
5758
uses: hashicorp/setup-terraform@v4
5859
with:
@@ -100,3 +101,38 @@ jobs:
100101
id: destroy
101102
run: terraform destroy -auto-approve -var-file="${{ vars.TF_VARS_FILE }}"
102103
working-directory: ./infrastructure
104+
105+
terraform_destroy_base_iam:
106+
name: Terraform Destroy base_iam
107+
runs-on: ubuntu-latest
108+
needs: [terraform_destroy_process]
109+
environment: test
110+
steps:
111+
- name: Checkout
112+
uses: actions/checkout@v6
113+
with:
114+
ref: main
115+
116+
- name: Configure AWS Credentials
117+
uses: aws-actions/configure-aws-credentials@v5
118+
with:
119+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/test-github-bootstrap
120+
aws-region: ${{ vars.AWS_REGION }}
121+
mask-aws-account-id: true
122+
123+
- name: Setup Terraform
124+
uses: hashicorp/setup-terraform@v3
125+
with:
126+
terraform_version: 1.14.3
127+
128+
- name: Initialise Terraform
129+
run: terraform init -backend-config=bucket=${{ secrets.AWS_WORKSPACE }}-terraform-state-${{ secrets.AWS_ACCOUNT_ID }}
130+
working-directory: ./base_iam
131+
132+
- name: Select Terraform Workspace
133+
run: terraform workspace select ${{ secrets.AWS_WORKSPACE }}
134+
working-directory: ./base_iam
135+
136+
- name: Run Terraform Destroy
137+
run: terraform destroy -auto-approve -var-file="${{ vars.TF_VARS_FILE }}" -var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}
138+
working-directory: ./base_iam

‎.github/workflows/deploy-pre-prod.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "Deploy - Pre-prod"
22

3-
run-name: "${{ github.event.inputs.branch_or_tag }}"
3+
run-name: "${{ inputs.branch_or_tag }}"
44

55
on:
66
workflow_dispatch:
@@ -21,18 +21,18 @@ jobs:
2121
name: Tag main
2222
runs-on: ubuntu-latest
2323
outputs:
24-
version: ${{ steps.versioning.outputs.tag || github.event.inputs.branch_or_tag }}
24+
version: ${{ steps.versioning.outputs.tag || inputs.branch_or_tag }}
2525
permissions: write-all
2626
steps:
2727
- name: Checkout main
28-
if: ${{ github.event.inputs.branch_or_tag == 'main' }}
28+
if: ${{ inputs.branch_or_tag == 'main' }}
2929
uses: actions/checkout@v6
3030
with:
3131
ref: main
3232
fetch-depth: "0"
3333

3434
- name: Bump version and push tag
35-
if: ${{ github.event.inputs.branch_or_tag == 'main' }}
35+
if: ${{ inputs.branch_or_tag == 'main' }}
3636
id: versioning
3737
uses: anothrNick/github-tag-action@1.64.0
3838
env:
@@ -42,7 +42,7 @@ jobs:
4242

4343
- name: View outputs
4444
run: |
45-
echo Tag to deploy: ${{ steps.versioning.outputs.tag || github.event.inputs.branch_or_tag }}
45+
echo Tag to deploy: ${{ steps.versioning.outputs.tag || inputs.branch_or_tag }}
4646
4747
terraform_plan_apply_base_iam:
4848
name: Terraform Plan/Apply base-iam (pre-prod)

‎.github/workflows/deploy-prod.yml‎

Lines changed: 34 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "Deploy - Prod"
22

3-
run-name: "${{ github.event.inputs.git_tag }}"
3+
run-name: "${{ inputs.git_tag }}"
44

55
on:
66
workflow_dispatch:
@@ -16,54 +16,48 @@ permissions:
1616
contents: read # This is required for actions/checkout
1717

1818
jobs:
19-
terraform_plan_apply:
20-
name: Terraform Plan/Apply (prod)
19+
terraform_plan_apply_base_iam:
20+
name: Terraform Plan/Apply base-iam (prod)
2121
runs-on: ubuntu-latest
2222
environment: prod
2323
steps:
24-
- name: Checkout Tag
24+
- name: Checkout
2525
uses: actions/checkout@v6
2626
with:
2727
ref: refs/tags/${{ github.event.inputs.git_tag}}
2828
fetch-depth: "0"
2929

30-
- name: Configure AWS Credentials
31-
uses: aws-actions/configure-aws-credentials@v6
30+
- name: Apply base_iam
31+
uses: ./.github/actions/tf-plan-apply
3232
with:
33-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
34-
role-skip-session-tagging: true
35-
aws-region: ${{ vars.AWS_REGION }}
36-
mask-aws-account-id: true
33+
aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/prod-github-bootstrap
34+
bucket_prefix: "prod"
35+
aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
36+
aws_region: ${{ vars.AWS_REGION }}
37+
working_directory: "./base_iam" # Use separate base_iam directory
38+
workspace: ${{ secrets.AWS_WORKSPACE }}
39+
tf_vars_file: ${{ vars.TF_VARS_FILE }}
40+
tf_extra_args: "-var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}"
3741

38-
- name: Setup Terraform
39-
uses: hashicorp/setup-terraform@v4
42+
terraform_plan_apply:
43+
name: Terraform Plan/Apply (prod)
44+
needs: ["terraform_plan_apply_base_iam"]
45+
runs-on: ubuntu-latest
46+
environment: prod
47+
steps:
48+
- name: Checkout Tag
49+
uses: actions/checkout@v6
4050
with:
41-
terraform_version: 1.14.6
42-
terraform_wrapper: false
43-
44-
- name: Initialise Terraform
45-
id: init
46-
run: terraform init -backend-config=backend-prod.conf
47-
working-directory: ./infrastructure
48-
shell: bash
49-
50-
- name: Select Terraform Workspace
51-
id: workspace
52-
run: terraform workspace select ${{ secrets.AWS_WORKSPACE }}
53-
working-directory: ./infrastructure
54-
shell: bash
55-
56-
- name: Check Terraform Formatting
57-
run: terraform fmt -check
58-
working-directory: ./infrastructure
59-
60-
- name: Run Terraform Plan
61-
id: plan
62-
run: |
63-
terraform plan -input=false -no-color -var-file="${{vars.TF_VARS_FILE}}" -out tf.plan
64-
working-directory: ./infrastructure
65-
shell: bash
51+
ref: refs/tags/${{ inputs.git_tag}}
52+
fetch-depth: "0"
6653

67-
- name: Run Terraform Apply
68-
run: terraform apply -auto-approve -input=false tf.plan
69-
working-directory: ./infrastructure
54+
- name: Apply Main
55+
uses: ./.github/actions/tf-plan-apply
56+
with:
57+
# use newly updated role
58+
aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/prod-github-actions-role
59+
bucket_prefix: "prod"
60+
aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
61+
aws_region: ${{ vars.AWS_REGION }}
62+
workspace: ${{ secrets.AWS_WORKSPACE }}
63+
tf_vars_file: ${{ vars.TF_VARS_FILE }}

‎.github/workflows/deploy-test.yml‎

Lines changed: 34 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "Deploy - Test"
22

3-
run-name: "${{ github.event.inputs.git_ref }}"
3+
run-name: "${{ inputs.git_ref }}"
44

55
on:
66
workflow_dispatch:
@@ -16,54 +16,46 @@ permissions:
1616
contents: read # This is required for actions/checkout
1717

1818
jobs:
19-
terraform_plan_apply:
20-
name: Terraform Plan/Apply (ndr-test)
19+
terraform_plan_apply_base_iam:
20+
name: Terraform Plan/Apply (base_iam)
2121
runs-on: ubuntu-latest
2222
environment: test
2323
steps:
24-
- name: Checkout
24+
- name: Checkout branch
2525
uses: actions/checkout@v6
2626
with:
27-
ref: ${{ github.event.inputs.git_ref}}
27+
ref: ${{ inputs.git_ref}}
2828

29-
- name: Configure AWS Credentials
30-
uses: aws-actions/configure-aws-credentials@v6
29+
- name: Apply base_iam
30+
uses: ./.github/actions/tf-plan-apply
3131
with:
32-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
33-
role-skip-session-tagging: true
34-
aws-region: ${{ vars.AWS_REGION }}
35-
mask-aws-account-id: true
32+
aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/test-github-bootstrap
33+
bucket_prefix: "test"
34+
aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
35+
aws_region: ${{ vars.AWS_REGION }}
36+
working_directory: "./base_iam" # Use separate base_iam directory
37+
workspace: ${{ secrets.AWS_WORKSPACE }}
38+
tf_vars_file: ${{ vars.TF_VARS_FILE }}
39+
tf_extra_args: "-var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}"
3640

37-
# Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
38-
- name: Setup Terraform
39-
uses: hashicorp/setup-terraform@v4
41+
terraform_plan_apply:
42+
name: Terraform Plan/Apply (ndr-test)
43+
runs-on: ubuntu-latest
44+
needs: terraform_plan_apply_base_iam
45+
environment: test
46+
steps:
47+
- name: Checkout main
48+
uses: actions/checkout@v6
4049
with:
41-
terraform_version: 1.14.6
42-
terraform_wrapper: false
43-
44-
- name: Initialise Terraform
45-
id: init
46-
run: terraform init -backend-config=backend-test.conf
47-
working-directory: ./infrastructure
48-
shell: bash
49-
50-
- name: Select Terraform Workspace
51-
id: workspace
52-
run: terraform workspace select -or-create ${{ secrets.AWS_WORKSPACE }}
53-
working-directory: ./infrastructure
54-
shell: bash
55-
56-
- name: Check Terraform Formatting
57-
run: terraform fmt -check
58-
working-directory: ./infrastructure
59-
60-
- name: Run Terraform Plan
61-
id: plan
62-
run: |
63-
terraform plan -input=false -no-color -var-file="${{vars.TF_VARS_FILE}}" -out tf.plan
64-
working-directory: ./infrastructure
65-
shell: bash
50+
ref: ${{ github.event.inputs.git_ref}}
6651

67-
- name: Run Terraform Apply
68-
run: terraform apply -auto-approve -input=false tf.plan
69-
working-directory: ./infrastructure
52+
- name: Apply Main
53+
uses: ./.github/actions/tf-plan-apply
54+
with:
55+
# use newly created role
56+
aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_WORKSPACE }}-github-actions-role
57+
bucket_prefix: "test"
58+
aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
59+
aws_region: ${{ vars.AWS_REGION }}
60+
workspace: ${{ secrets.AWS_WORKSPACE }}
61+
tf_vars_file: ${{ vars.TF_VARS_FILE }}

‎.github/workflows/tool-rename-git-tag.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: 'Tool: Rename Git Tag'
22

3-
run-name: "${{ github.event.inputs.old_tag }} -> ${{ github.event.inputs.new_tag }}"
3+
run-name: "${{ inputs.old_tag }} -> ${{ inputs.new_tag }}"
44

55
on:
66
workflow_dispatch:
@@ -29,7 +29,7 @@ jobs:
2929
- name: Checkout
3030
uses: actions/checkout@v6
3131
with:
32-
ref: ${{ github.event.inputs.old_tag }}
32+
ref: ${{ inputs.old_tag }}
3333
fetch-depth: 0
3434

3535
- name: Check SHA
@@ -49,6 +49,6 @@ jobs:
4949
github.rest.git.createRef({
5050
owner: context.repo.owner,
5151
repo: context.repo.repo,
52-
ref: 'refs/tags/${{ github.event.inputs.new_tag }}',
52+
ref: 'refs/tags/${{ inputs.new_tag }}',
5353
sha: '${{ steps.get-sha.outputs.BRANCH_SHA }}'
5454
})

0 commit comments

Comments
 (0)