platform.yml

# One button to create or destroy the ephemeral environment.
# Runs in the protected `platform` GitHub Environment: a reviewer must approve, and only
# jobs in that environment can assume the admin apply role (OIDC subject claim).
name: platform

on:
  workflow_dispatch:
    inputs:
      action:
        description: Create or destroy the environment
        type: choice
        options: [up, down]
        required: true
      ui_allowed_cidr:
        description: Your public IP as CIDR (e.g. 203.0.113.7/32) for Argo CD/Grafana/Rollouts UIs
        type: string
        required: false

permissions: {}

concurrency:
  group: platform
  cancel-in-progress: false

jobs:
  platform:
    runs-on: ubuntu-24.04
    environment: platform
    timeout-minutes: 90
    permissions:
      contents: read
      id-token: write
    env:
      AWS_REGION: ${{ vars.AWS_REGION || 'eu-north-1' }}
      TF_IN_AUTOMATION: "true"
      TF_VAR_cluster_admin_arns: ${{ vars.CLUSTER_ADMIN_ARNS || '[]' }}
      ACTION: ${{ inputs.action }}
      UI_CIDR: ${{ inputs.ui_allowed_cidr }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_wrapper: false
      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ vars.AWS_ROLE_TF_APPLY }}
          aws-region: ${{ env.AWS_REGION }}
          role-duration-seconds: 7200

      - name: Validate input
        run: |
          if [ "$ACTION" = up ]; then
            [[ "$UI_CIDR" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/(3[0-2]|[12]?[0-9])$ ]] || { echo "::error::ui_allowed_cidr must be an IPv4 CIDR"; exit 1; }
            echo "TF_VAR_ui_allowed_cidrs=[\"$UI_CIDR\"]" >> "$GITHUB_ENV"
          else
            # Destroy does not use the value, but the variable has no default.
            echo 'TF_VAR_ui_allowed_cidrs=["127.0.0.1/32"]' >> "$GITHUB_ENV"
          fi

      - name: Up
        if: inputs.action == 'up'
        run: make up AUTO_APPROVE=1

      - name: Down
        if: inputs.action == 'down'
        run: ./scripts/platform-down.sh

      - name: Summary
        if: inputs.action == 'up'
        run: |
          domain=$(make -s init-00-foundation >/dev/null && terraform -chdir=infra/live/00-foundation output -raw domain)
          {
            echo "### Platform is up"
            echo "- API: https://api.${domain}/version"
            echo "- Argo CD: https://argocd.${domain}"
            echo "- Grafana: https://grafana.${domain}"
            echo "- Rollouts: https://rollouts.${domain}"
            echo
            echo "Add-ons take ~10 minutes to converge after this job finishes."
          } >> "$GITHUB_STEP_SUMMARY"