deployment.yaml

name: Terraform (Plan||Apply)
run-name: Terraform ${{ inputs.terraform_action }} ${{ inputs.workspace }} by @${{ github.actor }}

on:
  workflow_dispatch:
    inputs:
      workspace:
        description: 'The workspace to terraform against'
        required: true
        type: choice
        options:
          - ""
          - prod
      terraform_action:
        description: 'The terraform action to perform'
        required: true
        type: choice
        options:
          - plan
          - apply

concurrency:
  group: ${{ github.event.inputs.workspace }}-terraform
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

env:
  workspace: ${{ github.event.inputs.workspace }}
  terraform_action: ${{ github.event.inputs.terraform_action }}

jobs:
  terraform:
    name: Run Terraform
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ./terraform/implementation/ecs
    steps:
      - name: Check Out Changes
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          role-session-name: githubDeploymentWorkflow
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Terraform
        env:
          ACTION: ${{ env.terraform_action }}
          BUCKET: ${{ secrets.TFSTATE_BUCKET }}
          DYNAMODB_TABLE: ${{ secrets.TFSTATE_DYNAMODB_TABLE }}
          OWNER: ${{ vars.OWNER }}
          PROJECT: ${{ vars.PROJECT }}
          REGION: ${{ secrets.AWS_REGION }}
          WORKSPACE: ${{ env.workspace }}
        shell: bash
        run: |
          echo "owner = \"$OWNER\"" >> $WORKSPACE.tfvars
          echo "project = \"$PROJECT\"" >> $WORKSPACE.tfvars
          echo "region = \"$REGION\"" >> $WORKSPACE.tfvars
          terraform init \
            -var-file="$WORKSPACE.tfvars" \
            -backend-config "bucket=$BUCKET" \
            -backend-config "dynamodb_table=$DYNAMODB_TABLE" \
            -backend-config "region=$REGION" \
            || (echo "terraform init failed, exiting..." && exit 1)
          terraform workspace select "$WORKSPACE"
          if [ "$ACTION" == "plan" ]; then
            terraform plan -var-file="$WORKSPACE.tfvars"
          fi
          if [ "$ACTION" == "apply" ]; then
            terraform apply -auto-approve -var-file="$WORKSPACE.tfvars"
          fi