-
Notifications
You must be signed in to change notification settings - Fork 0
157 lines (135 loc) · 4.17 KB
/
plan-backstage.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
---
name: "Plan Backstage"
on: # yamllint disable-line rule:truthy
pull_request:
branches:
- main
paths:
- 'terraform/*'
- '.github/workflows/plan-backstage.yaml'
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
## run terraform plan
plan_poc:
name: Plan - POC
runs-on: ubuntu-latest
outputs:
plan_id: ${{ steps.workflow_vars.outputs.plan_id }}
permissions:
id-token: write
contents: read
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v3
# install aws cli
- name: Install AWS CLI
shell: bash
run: ./scripts/dependencies/install-aws-cli.sh
continue-on-error: false
# install tfenv
- name: Install tfenv
shell: bash
run: ./scripts/dependencies/install-tfenv.sh
continue-on-error: false
# Setup plan id for plan exports
- name: Set outputs
id: workflow_vars
run: |
echo "plan_id=$(git rev-parse --short "$GITHUB_SHA")" >> $GITHUB_OUTPUT
# configure iam
- name: Configure IAM Role
uses: aws-actions/configure-aws-credentials@v2
with:
role-to-assume: ${{ secrets.POC_BACKSTAGE_DEPLOY_ARN }}
aws-region: us-east-1
continue-on-error: false
# initialize backend
- name: Initialize backend
shell: bash
run: |
./scripts/action-init-plan-apply.sh -i poc
continue-on-error: false
# Running plan
- name: Plan against Prod
id: poc_plan
shell: bash
run: |
./scripts/action-init-plan-apply.sh -p poc
continue-on-error: false
#publish plan to artifacts
- name: Publish Terraform Plan
uses: actions/upload-artifact@v3
with:
name: "poc-${{ steps.workflow_vars.outputs.plan_id }}.tfplan"
path: "terraform/poc-${{ steps.workflow_vars.outputs.plan_id }}.tfplan"
continue-on-error: false
- name: Update plan output to pr
uses: mshick/add-pr-comment@v2
with:
message-id: poc-tfplan
message-path: "terraform/poc-plan-output.txt"
continue-on-error: false
plan_prod:
name: Plan - Prod
runs-on: ubuntu-latest
outputs:
plan_id: ${{ steps.workflow_vars.outputs.plan_id }}
permissions:
id-token: write
contents: read
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v3
# install aws cli
- name: Install AWS CLI
shell: bash
run: ./scripts/dependencies/install-aws-cli.sh
continue-on-error: false
# install tfenv
- name: Install tfenv
shell: bash
run: ./scripts/dependencies/install-tfenv.sh
continue-on-error: false
# Setup plan id for plan exports
- name: Set outputs
id: workflow_vars
run: |
echo "plan_id=$(git rev-parse --short "$GITHUB_SHA")" >> $GITHUB_OUTPUT
# configure iam
- name: Configure IAM Role
uses: aws-actions/configure-aws-credentials@v2
with:
role-to-assume: ${{ secrets.PROD_BACKSTAGE_DEPLOY_ARN }}
aws-region: us-east-1
continue-on-error: false
# initialize backend
- name: Initialize backend
shell: bash
run: |
./scripts/action-init-plan-apply.sh -i prod
continue-on-error: false
# Running plan
- name: Plan against Prod
id: prod_plan
shell: bash
run: |
./scripts/action-init-plan-apply.sh -p prod
continue-on-error: false
#publish plan to artifacts
- name: Publish Terraform Plan
uses: actions/upload-artifact@v3
with:
name: "prod-${{ steps.workflow_vars.outputs.plan_id }}.tfplan"
path: "terraform/prod-${{ steps.workflow_vars.outputs.plan_id }}.tfplan"
continue-on-error: false
- name: Update plan output to pr
uses: mshick/add-pr-comment@v2
with:
message-id: prod-tfplan
message-path: "terraform/prod-plan-output.txt"
continue-on-error: false