Skip to content
Terraform: Member environments

DO NOT MERGE #985

Sign in to view logs

DO NOT MERGE

DO NOT MERGE #985

Workflow file for this run

.github/workflows/terraform-member-environment.yml at 1190c43
---
name: "Terraform: Member environments"
on:
push:
branches:
- main
paths:
- 'terraform/environments/*/*.tf'
- '!terraform/environments/bootstrap/*/*.tf'
- '!terraform/environments/core-*/*.tf'
pull_request:
types: [opened, edited, reopened, synchronize]
branches-ignore:
- 'date*'
paths:
- 'terraform/environments/*/*.tf'
- '!terraform/environments/bootstrap/*/*.tf'
- '!terraform/environments/core-*/*.tf'
workflow_dispatch:
defaults:
run:
shell: bash
env:
TF_IN_AUTOMATION: true
AWS_REGION: "eu-west-2"
ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}
permissions:
id-token: write # This is required for requesting the JWT
contents: read # This is required for actions/checkout
jobs:
find-environments:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Get changed directories
id: directories
run: |
git fetch origin main --unshallow
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
CHANGED_DIRECTORIES=$(git diff HEAD origin/main --name-only | awk '{print $1}' | grep ".tf" | grep -a "environments//*" | cut -f1-3 -d"/" | uniq | base64 -w 0 )
CHANGED_DIRECTORY_NAMES=$(git diff HEAD origin/main --name-only | awk '{print $1}' | grep ".tf" | grep -a "environments//*" | cut -f3 -d"/" | uniq | jq -R -s -c 'split("\n")[:-1]')
else
CHANGED_DIRECTORIES=$(git diff HEAD^ HEAD --name-only | awk '{print $1}' | grep ".tf" | grep -a "environments//*" | cut -f1-3 -d"/" | uniq | base64 -w 0)
CHANGED_DIRECTORY_NAMES=$(git diff HEAD^ HEAD --name-only | awk '{print $1}' | grep ".tf" | grep -a "environments//*" | cut -f3 -d"/" | uniq | jq -R -s -c 'split("\n")[:-1]')
fi
echo "CHANGED_DIRECTORIES=$CHANGED_DIRECTORIES" >> $GITHUB_OUTPUT
echo "CHANGED_DIRECTORY_NAMES=$CHANGED_DIRECTORY_NAMES" >> $GITHUB_OUTPUT
- name: Display changed directories
run: echo "Directories in scope:" ${{ steps.directories.outputs.CHANGED_DIRECTORIES }}
- name: Slack failure notification
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
with:
webhook-type: incoming-webhook
payload: |
{"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
if: ${{ failure() && (github.event.ref == 'refs/heads/main') }}
outputs:
directories: ${{ steps.directories.outputs.CHANGED_DIRECTORIES }}
directory_names: ${{ steps.directories.outputs.CHANGED_DIRECTORY_NAMES }}
terraform-plan-dev-test:
runs-on: ubuntu-latest
needs: find-environments
strategy:
fail-fast: false
matrix:
application: ${{ fromJson(needs.find-environments.outputs.directory_names) }}
environment: [development, test]
env:
TF_IN_AUTOMATION: "true"
steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Set account number
run: |
APPLICATION_ENVIRONMENT="${{ matrix.application }}-${{ matrix.environment }}"
echo "Application: $APPLICATION_ENVIRONMENT"
ACCOUNT_NUMBER=$(echo "$ENVIRONMENT_MANAGEMENT" | jq -r -e --arg app_env "$APPLICATION_ENVIRONMENT" '.account_ids[$app_env]')
if [ -z "$ACCOUNT_NUMBER" ]; then
echo "::warning::Account number not found for $APPLICATION_ENVIRONMENT, skipping..."
echo "SKIP=true" >> $GITHUB_ENV
else
echo "::add-mask::$ACCOUNT_NUMBER"
echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
echo "SKIP=false" >> $GITHUB_ENV
fi
- name: Configure AWS credentials
if: env.SKIP == 'false'
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions-test"
role-session-name: githubactionsrolesession
aws-region: ${{ env.AWS_REGION }}
- name: Setup Terraform
id: setup
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: "~1"
terraform_wrapper: false
- name: Terraform init
id: init
run: |
echo "Running 'terraform init' in terraform/environments/${{ matrix.application }}"
scripts/terraform-init.sh terraform/environments/${{ matrix.application }}
- name: Terraform workspace
id: workspace
run: |
workspace="${{ matrix.application }}-${{ matrix.environment }}"
terraform -chdir="terraform/environments/${{ matrix.application }}" workspace select "$workspace"
- name: Terraform plan
id: plan
run: |
scripts/terraform-plan.sh terraform/environments/${{ matrix.application }}
- name: Slack failure notification
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
with:
webhook-type: incoming-webhook
payload: |
{"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
if: ${{ failure() && (github.event.ref == 'refs/heads/main') }}
- name: Mark job skipped
if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
run: |
echo "::warning ::Terraform plan was skipped as no valid workspace was found."
terraform-plan-preprod-prod:
runs-on: ubuntu-latest
needs: find-environments
strategy:
fail-fast: false
matrix:
environment: [preproduction, production]
env:
TF_IN_AUTOMATION: "true"
steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Set account number
run: |
ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)
echo "::add-mask::$ACCOUNT_NUMBER"
echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
role-session-name: githubactionsrolesession
aws-region: ${{ env.AWS_REGION }}
- name: Setup Terraform
id: setup
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: "~1"
terraform_wrapper: false
- name: Terraform init
id: init
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
echo "Running 'terraform init' in" $directory
scripts/terraform-init.sh $directory
done
- name: Terraform workspace
id: workspace
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
if terraform -chdir="$directory" workspace list | grep "$workspace"; then
terraform -chdir="$directory" workspace select "$workspace"
else
echo "Workspace '$workspace' does not exist, skipping further processing"
echo "skip_plan=true" >> $GITHUB_OUTPUT
fi
unset workspace
done
echo "Selected $(terraform -chdir="$directory" workspace show)"
- name: Terraform plan
id: plan
if: ${{ steps.workspace.outputs.skip_plan != 'true' }}
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
scripts/terraform-plan.sh $directory
unset workspace
done
- name: Slack failure notification
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
with:
webhook-type: incoming-webhook
payload: |
{"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
if: ${{ failure() && (github.event.ref == 'refs/heads/main') }}
- name: Mark job skipped
if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
run: |
echo "::warning ::Terraform plan was skipped as no valid workspace was found."
terraform-apply-dev-test:
if: ${{ github.event_name == 'pull_request' }}
runs-on: ubuntu-latest
needs: [find-environments, terraform-plan]

Check failure on line 218 in .github/workflows/terraform-member-environment.yml

View workflow run for this annotation

GitHub Actions / Terraform: Member environments

Invalid workflow file 

The workflow is not valid. .github/workflows/terraform-member-environment.yml (Line: 218, Col: 32): Job 'terraform-apply-dev-test' depends on unknown job 'terraform-plan'. .github/workflows/terraform-member-environment.yml (Line: 301, Col: 32): Job 'terraform-apply-preprod-prod' depends on unknown job 'terraform-plan'.
strategy:
fail-fast: false
matrix:
environment: [development, test]
environment: ${{ matrix.environment }}
env:
TF_IN_AUTOMATION: "true"
steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Set account number
run: |
ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)
echo "::add-mask::$ACCOUNT_NUMBER"
echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
role-session-name: githubactionsrolesession
aws-region: ${{ env.AWS_REGION }}
- name: Setup Terraform
id: setup
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: "~1"
terraform_wrapper: false
- name: Terraform init
id: init
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
echo "Running 'terraform init' in" $directory
scripts/terraform-init.sh $directory
done
- name: Terraform workspace
id: workspace
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
if terraform -chdir="$directory" workspace list | grep "$workspace"; then
terraform -chdir="$directory" workspace select "$workspace"
else
echo "Workspace '$workspace' does not exist, skipping further processing"
echo "skip_plan=true" >> $GITHUB_OUTPUT
fi
unset workspace
done
echo "Selected $(terraform -chdir="$directory" workspace show)"
- name: Terraform plan
id: plan
if: ${{ steps.workspace.outputs.skip_plan != 'true' }}
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
scripts/terraform-plan.sh $directory -out="$workspace.tfplan"
unset workspace
done
- name: Terraform apply
id: apply
if: ${{ steps.plan.conclusion == 'success' }}
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
scripts/terraform-apply.sh $directory "$workspace.tfplan"
unset workspace
done
- name: Mark job skipped
if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
run: |
echo "::warning ::Terraform plan was skipped as no valid workspace was found."
terraform-apply-preprod-prod:
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
needs: [find-environments, terraform-plan]
strategy:
fail-fast: false
matrix:
environment: [preproduction, production]
environment: ${{ matrix.environment }}
env:
TF_IN_AUTOMATION: "true"
steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Set account number
run: |
ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)
echo "::add-mask::$ACCOUNT_NUMBER"
echo ACCOUNT_NUMBER=$ACCOUNT_NUMBER >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
role-session-name: githubactionsrolesession
aws-region: ${{ env.AWS_REGION }}
- name: Setup Terraform
id: setup
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: "~1"
terraform_wrapper: false
- name: Terraform init
id: init
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
echo "Running 'terraform init' in" $directory
scripts/terraform-init.sh $directory
done
- name: Terraform workspace
id: workspace
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
if terraform -chdir="$directory" workspace list | grep "$workspace"; then
terraform -chdir="$directory" workspace select "$workspace"
else
echo "Workspace '$workspace' does not exist, skipping further processing"
echo "skip_plan=true" >> $GITHUB_OUTPUT
fi
unset workspace
done
echo "Selected $(terraform -chdir="$directory" workspace show)"
- name: Terraform plan
id: plan
if: ${{ steps.workspace.outputs.skip_plan != 'true' }}
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
scripts/terraform-plan.sh $directory -out="$workspace.tfplan"
unset workspace
done
- name: Terraform apply
id: apply
if: ${{ steps.plan.conclusion == 'success' }}
run: |
export CHANGED_DIRECTORIES=$(echo "${{ needs.find-environments.outputs.directories }}" | base64 --decode)
for directory in $CHANGED_DIRECTORIES; do
workspace="$(basename $directory)-${{ matrix.environment }}"
scripts/terraform-apply.sh $directory "$workspace.tfplan"
unset workspace
done
- name: Slack failure notification
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
with:
webhook-type: incoming-webhook
payload: |
{"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
if: ${{ failure() }}
- name: Mark job skipped
if: ${{ steps.workspace.outputs.skip_plan == 'true' }}
run: |
echo "::warning ::Terraform plan was skipped as no valid workspace was found."