Skip to content

Commit 126edea

Browse files
lixhunterlixhunter
committed
moved reusable Workflow to this repository
Signed-off-by: Andre Licht <al@cloudeteer.de>
1 parent 4c20b69 commit 126edea

6 files changed

+169
-5
lines changed

‎.github/workflows/prod-stackit-terraform-10-launchpad.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ permissions:
2424
jobs:
2525
terraform:
2626
name: Terraform
27-
uses: cloudeteer/iac-deployment-framework/.github/workflows/terraform-deploy-stackit.yaml@wip/stackit
27+
uses: ./.github/workflows/terraform-deploy-stackit.yaml
2828
with:
2929
directory: prod-stackit/terraform/10_launchpad
3030
terraform-force-unlock-id: ${{ github.event_name == 'workflow_dispatch' && inputs.terraform-force-unlock == true && inputs.terraform-force-unlock-id }}

‎.github/workflows/prod-stackit-terraform-40-organization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ permissions:
2424
jobs:
2525
terraform:
2626
name: Terraform
27-
uses: cloudeteer/iac-deployment-framework/.github/workflows/terraform-deploy-stackit.yaml@wip/stackit
27+
uses: ./.github/workflows/terraform-deploy-stackit.yaml
2828
with:
2929
directory: prod-stackit/terraform/40_organization
3030
terraform-force-unlock-id: ${{ github.event_name == 'workflow_dispatch' && inputs.terraform-force-unlock == true && inputs.terraform-force-unlock-id }}

‎.github/workflows/prod-stackit-terraform-50-opsstack-agent-test-server.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ permissions:
2424
jobs:
2525
terraform:
2626
name: Terraform
27-
uses: cloudeteer/iac-deployment-framework/.github/workflows/terraform-deploy-stackit.yaml@wip/stackit
27+
uses: ./.github/workflows/terraform-deploy-stackit.yaml
2828
with:
2929
directory: prod-stackit/terraform/50_projects/opsstack-agent-test-server
3030
terraform-force-unlock-id: ${{ github.event_name == 'workflow_dispatch' && inputs.terraform-force-unlock == true && inputs.terraform-force-unlock-id }}

‎.github/workflows/prod-stackit-terraform-50-prj-vpn-fw-test-firewall.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ permissions:
2424
jobs:
2525
terraform:
2626
name: Terraform
27-
uses: cloudeteer/iac-deployment-framework/.github/workflows/terraform-deploy-stackit.yaml@wip/stackit
27+
uses: ./.github/workflows/terraform-deploy-stackit.yaml
2828
with:
2929
directory: prod-stackit/terraform/50_projects/prj-vpn-fw-test-firewall
3030
terraform-force-unlock-id: ${{ github.event_name == 'workflow_dispatch' && inputs.terraform-force-unlock == true && inputs.terraform-force-unlock-id }}

‎.github/workflows/prod-stackit-terraform-50-team-iac-test01.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ permissions:
2424
jobs:
2525
terraform:
2626
name: Terraform
27-
uses: cloudeteer/iac-deployment-framework/.github/workflows/terraform-deploy-stackit.yaml@wip/stackit
27+
uses: ./.github/workflows/terraform-deploy-stackit.yaml
2828
with:
2929
directory: prod-stackit/terraform/50_projects/team-iac-test01
3030
terraform-force-unlock-id: ${{ github.event_name == 'workflow_dispatch' && inputs.terraform-force-unlock == true && inputs.terraform-force-unlock-id }}

‎.github/workflows/terraform-deploy-stackit.yaml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: deploy
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
directory:
7+
type: string
8+
required: true
9+
terraform-force-unlock:
10+
default: false
11+
description: Terraform force unlock
12+
required: false
13+
type: boolean
14+
terraform-force-unlock-id:
15+
description: Terraform LOCK_ID
16+
required: false
17+
type: string
18+
env:
19+
required: false
20+
type: string
21+
environment:
22+
required: false
23+
type: string
24+
default: prod-stackit
25+
secrets:
26+
env:
27+
required: false
28+
stackit_service_account_key:
29+
required: true
30+
backend_s3_secret_key:
31+
required: true
32+
backend_s3_access_key:
33+
required: true
34+
35+
env:
36+
# StackIT
37+
TF_VAR_stackit_service_account_key: ${{ secrets.stackit_service_account_key }}
38+
AWS_ACCESS_KEY_ID: ${{ secrets.backend_s3_access_key }}
39+
AWS_SECRET_ACCESS_KEY: ${{ secrets.backend_s3_secret_key }}
40+
41+
# Working directory
42+
CDT_IAC_WORKING_DIRECTORY: ${{ inputs.directory }}
43+
44+
# Terraform Paramaters
45+
TF_IN_AUTOMATION: true
46+
TF_INPUT: false
47+
TF_VERSION: ~1.10.0
48+
49+
# https://developer.hashicorp.com/terraform/cli/commands#upgrade-and-security-bulletin-checks
50+
CHECKPOINT_DISABLE: true
51+
52+
concurrency:
53+
group: ${{ github.workflow }}
54+
55+
permissions:
56+
contents: read
57+
id-token: write
58+
59+
jobs:
60+
plan:
61+
name: Plan
62+
environment: ${{ inputs.environment }} (plan)
63+
runs-on: self-hosted
64+
outputs:
65+
exitcode: ${{ steps.plan.outputs.exitcode }}
66+
steps:
67+
- name: Checkout
68+
uses: actions/checkout@v4
69+
- name: Cache Setup
70+
uses: actions/cache@v4
71+
with:
72+
key: iac-deployment-framework:~/${{ env.CDT_IAC_WORKING_DIRECTORY }}#${{ hashFiles(format('{0}/{1}', env.CDT_IAC_WORKING_DIRECTORY, '/.terraform.lock.hcl')) }}@${{ runner.os }}
73+
path: |
74+
${{ env.CDT_IAC_WORKING_DIRECTORY }}/.terraform
75+
- name: Set environment variables from input
76+
uses: cloudeteer/actions/set-env@main
77+
with:
78+
env: ${{ inputs.env }}
79+
- name: Set environment variables from secrets
80+
uses: cloudeteer/actions/set-env@main
81+
with:
82+
env: ${{ secrets.env }}
83+
- name: Terraform Setup
84+
uses: hashicorp/setup-terraform@v3
85+
with:
86+
terraform_version: ${{ env.TF_VERSION }}
87+
terraform_wrapper: false
88+
- name: Terraform Init
89+
working-directory: ${{ env.CDT_IAC_WORKING_DIRECTORY }}
90+
run: terraform init
91+
- name: Terraform State Force-Unlock
92+
if: github.event_name == 'workflow_dispatch' && inputs.terraform-force-unlock == true
93+
working-directory: ${{ env.CDT_IAC_WORKING_DIRECTORY }}
94+
env:
95+
LOCK_ID: ${{ inputs.terraform-force-unlock-id }}
96+
run: |
97+
if [ -z "$LOCK_ID" ]; then
98+
echo "::debug::Workflow input 'terraform-force-unlock-id' is empty. Please provide a valid Terraform LOCK_ID."
99+
exit 1
100+
fi
101+
terraform force-unlock -force "$LOCK_ID"
102+
echo "::notice::Terraform state file successfully unlocked."
103+
- name: Terraform Plan
104+
id: plan
105+
working-directory: ${{ env.CDT_IAC_WORKING_DIRECTORY }}
106+
run: |
107+
set +e
108+
terraform plan -out terraform.tfplan -detailed-exitcode
109+
exitcode=$?
110+
[ "$exitcode" -ne 2 ] && [ "$exitcode" -ne 0 ] && exit $exitcode
111+
echo "exitcode=$exitcode" >> $GITHUB_OUTPUT
112+
- name: Upload Artifact terraform.tfplan
113+
uses: actions/upload-artifact@v4
114+
with:
115+
name: terraform.tfplan
116+
path: ${{ env.CDT_IAC_WORKING_DIRECTORY }}/terraform.tfplan
117+
- name: Print status
118+
run: |
119+
if [ "${{ github.event.pull_request.draft }}" = "false" ] ; then
120+
echo "::notice::The GitHub pull request that triggered this action is in draft status. As a result, the next apply step will be skipped."
121+
fi
122+
123+
if [ "${{ steps.plan.outputs.exitcode }}" == "0" ] ; then
124+
echo "::notice::No changes. Your infrastructure matches the configuration."
125+
fi
126+
apply:
127+
if: ${{ !cancelled() && !failure() && github.event.pull_request.draft == false && needs.plan.outputs.exitcode == 2 }}
128+
name: Apply
129+
needs: plan
130+
environment: ${{ inputs.environment }}
131+
runs-on: self-hosted
132+
steps:
133+
- name: Checkout
134+
uses: actions/checkout@v4
135+
- name: Cache Setup
136+
uses: actions/cache@v4
137+
with:
138+
key: iac-deployment-framework:~/${{ env.CDT_IAC_WORKING_DIRECTORY }}#${{ hashFiles(format('{0}/{1}', env.CDT_IAC_WORKING_DIRECTORY, '/.terraform.lock.hcl')) }}@${{ runner.os }}
139+
path: |
140+
${{ env.CDT_IAC_WORKING_DIRECTORY }}/.terraform
141+
- name: Set environment variables from input
142+
uses: cloudeteer/actions/set-env@main
143+
with:
144+
env: ${{ inputs.env }}
145+
- name: Set environment variables from secrets
146+
uses: cloudeteer/actions/set-env@main
147+
with:
148+
env: ${{ secrets.env }}
149+
- name: Terraform Setup
150+
uses: hashicorp/setup-terraform@v3
151+
with:
152+
terraform_version: ${{ env.TF_VERSION }}
153+
terraform_wrapper: false
154+
- name: Download Artifact terraform.tfplan
155+
uses: actions/download-artifact@v4
156+
with:
157+
name: terraform.tfplan
158+
path: ${{ env.CDT_IAC_WORKING_DIRECTORY }}
159+
- name: Terraform Init
160+
working-directory: ${{ env.CDT_IAC_WORKING_DIRECTORY }}
161+
run: terraform init
162+
- name: Terraform Apply
163+
working-directory: ${{ env.CDT_IAC_WORKING_DIRECTORY }}
164+
run: terraform apply terraform.tfplan

0 commit comments

Comments
 (0)