tf_apply.yml

name: TF Apply

on:
  workflow_call:
    inputs:
      environment:
        description: Github action environment and AWS account type
        type: string
        required: true
      oidc-domain:
        description: 'OIDC Domain. Ex: "core" or "reveng"'
        required: true
        type: string
      commit-identifier:
        description: SHA or tag to apply
        type: string
        required: true
      release-tag:
        description: release name to apply to resources
        type: string
        required: false
        default: unnamed
      terraform-workspace:
        description: Terraform Workspace
        type: string
        required: true
      terraform-root:
        description: Root directory of terraform
        type: string
        required: true
      terraform-version:
        description: Terraform version to use
        type: string
        required: true
    secrets:
      ORG_READ_ONLY_SSH_KEY:
        required: true
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN:
        required: true

concurrency:
  group: ${{ github.repository }}-${{ inputs.environment }}-TF-Apply

permissions:
  id-token: write
  contents: read

env:
  TF_INPUT: false
  TF_IN_AUTOMATION: true

jobs:
  Summary:
    runs-on: ubuntu-latest
    steps:
      - name: Markdown Summary
        run: |
          echo "### Apply Infrastructure Context"  >> $GITHUB_STEP_SUMMARY
          echo "**Trigger**: ${{ github.event_name }} ${{ github.event.action }}" >> $GITHUB_STEP_SUMMARY
          echo "**Actor**: ${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
          echo "**Workflow Ref (branch)**: ${{ github.workflow_ref }}" >> $GITHUB_STEP_SUMMARY
          echo -e "**Workflow Sha (commit)**: ${{ github.workflow_sha }}\n" >> $GITHUB_STEP_SUMMARY
          echo "**Inputs**" >> $GITHUB_STEP_SUMMARY
          echo -e "${{ toJson(inputs) }}\n" >> $GITHUB_STEP_SUMMARY
          echo "**Release Tag**: ${{ inputs.release-tag }}" >> $GITHUB_STEP_SUMMARY
          echo "*Note: Workflow Ref & Sha represent the branch and commit of the workflow defintion. This may not be the same as the branch/commit checked out supplying the code. The 'SHA or tag to apply' aka commit-identifier, is what specifies the code.*" >> $GITHUB_STEP_SUMMARY

  TF-Apply:
    name: Terraform Apply
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment}}
    defaults:
      run:
        working-directory: ${{ inputs.terraform-root }}
    env:
      TF_VAR_IACDeploymentRef: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
      TF_VAR_release_name: ${{ inputs.release-tag }}

    steps:
      - id: get-role-arn
        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
        with:
          domain: ${{ inputs.oidc-domain }}
          env: ${{ inputs.environment }}
          ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
          role-session-name: ${{ inputs.terraform-workspace }}-${{ inputs.environment }}-Run${{ github.run_id }}
          aws-region: ${{ steps.get-role-arn.outputs.region }}

      - name: Checkout Actions
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.commit-identifier }}

      - name: Configure Github Credentials
        id: configure-credentials
        shell: bash
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo '${{ secrets.ORG_READ_ONLY_SSH_KEY }}' > ~/.ssh/id_rsa
          ssh-keyscan github.com > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/id_rsa ~/.ssh/known_hosts

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ inputs.terraform-version }}
          terraform_wrapper: false # required to access terraform outputs after apply

      - name: Init Terraform
        run: terraform init -upgrade

      - name: Select Workspace
        run: terraform workspace select -or-create ${{ inputs.terraform-workspace }}

      - name: Apply Terraform
        run: terraform apply -auto-approve -input=false