sub_deploy_to_prod.yml

name: Sub - deploy to aws-prod

on:
  workflow_call:
    inputs:
      IMAGE_TAG:
        required: true
        type: string
    secrets:
      KOSLI_API_TOKEN:
        required: true


env:
  KOSLI_DRY_RUN: ${{ vars.KOSLI_DRY_RUN }}           # False
  KOSLI_HOST: ${{ vars.KOSLI_HOST }}                 # https://app.kosli.com
  KOSLI_ORG: ${{ vars.KOSLI_ORG }}                   # cyber-dojo
  KOSLI_FLOW: ${{ vars.KOSLI_FLOW }}                 # saver-ci
  KOSLI_TRAIL: ${{ github.sha }}
  SERVICE_NAME: ${{ github.event.repository.name }}  # saver
  AWS_ECR_ID: ${{ vars.AWS_ECR_ID }}
  AWS_REGION: ${{ vars.AWS_REGION }}
  AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID_PROD }}

jobs:

  variables:
    runs-on: ubuntu-latest
    outputs:
      service_name: ${{ steps.vars.outputs.service_name }}
      image_tag: ${{ steps.vars.outputs.image_tag }}
      aws_account_id: ${{ steps.vars.outputs.aws_account_id }}
      ecr_registry: ${{ steps.vars.outputs.ecr_registry }}
      aws_region: ${{ steps.vars.outputs.aws_region }}
      gh_actions_iam_role_name: ${{ steps.vars.outputs.gh_actions_iam_role_name }}
    steps:
    - name: Prepare outputs for fivexl deployment workflow
      id: vars
      run: |
        echo "service_name=${{ env.SERVICE_NAME }}"                                           >> ${GITHUB_OUTPUT}        
        echo "image_tag=${{ inputs.IMAGE_TAG }}"                                              >> ${GITHUB_OUTPUT}
        echo "aws_account_id=${{ env.AWS_ACCOUNT_ID }}"                                       >> ${GITHUB_OUTPUT}
        echo "ecr_registry=${{ env.AWS_ECR_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com" >> ${GITHUB_OUTPUT}
        echo "aws_region=${{ env.AWS_REGION }}"                                               >> ${GITHUB_OUTPUT}
        echo "gh_actions_iam_role_name=gh_actions_services"                                   >> ${GITHUB_OUTPUT}

  deploy-to-aws-prod:
    needs: [variables]
    permissions:
      id-token: write
      contents: write
    uses: fivexl/gh-workflow-tf-plan-apply/.github/workflows/base.yml@v0.0.20
    with:
      aws_region: ${{ needs.variables.outputs.aws_region }}
      aws_role_arn: arn:aws:iam::${{ needs.variables.outputs.aws_account_id }}:role/${{ needs.variables.outputs.gh_actions_iam_role_name }}
      aws_default_region: ${{ needs.variables.outputs.aws_region }}
      aws_role_duration: 900
      working_directory: deployment/terraform/
      tf_apply: 'true'
      tf_version: v1.9.1
      tf_additional_env_vars: '{"TF_VAR_TAGGED_IMAGE": "${{ needs.variables.outputs.ecr_registry }}/${{ needs.variables.outputs.service_name }}:${{ needs.variables.outputs.image_tag }}"}'
      tf_sh_version: 0.2.1
      tf_upload_artifact_name_suffix: "_prod"
      tf_upload_artifact_state_file: 'true'
      tf_upload_artifact_plan: 'true'
      tf_state_file_dir_on_s3: "terraform/${{ needs.variables.outputs.service_name }}"
      tf_state_file_name: "${{ needs.variables.outputs.service_name }}.tfstate"