github-organization-as-code/.github/workflows/terraform.yaml at dd8ff01b45d53a578be4d1262d216ac44cb8c2bd · bruzit/github-organization-as-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
---
name: Terraform

on:
  push:
    branches:
      - main
  workflow_call:
    inputs:
      aws_endpoint_url_s3:
        type: string
        required: true
      gh_owner:
        type: string
        required: true
      gh_app_id:
        type: string
        required: true
      gh_app_installation_id:
        type: string
        required: true
      path:
        type: string
        required: true
    secrets:
      aws_access_key_id:
        required: true
      aws_secret_access_key:
        required: true
      gh_app_pem_file:
        required: true

env:
  # S3 backend configuration
  AWS_ENDPOINT_URL_S3: ${{ inputs.aws_endpoint_url_s3 || vars.AWS_ENDPOINT_URL_S3 }}
  AWS_ACCESS_KEY_ID: ${{ secrets.aws_access_key_id || secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.aws_secret_access_key || secrets.AWS_SECRET_ACCESS_KEY }}
  # GitHub App configuration
  GITHUB_OWNER: ${{ inputs.gh_owner || vars.GH_TF_OWNER }}
  GITHUB_APP_ID: ${{ inputs.gh_app_id || vars.GH_TF_APP_ID }}
  GITHUB_APP_INSTALLATION_ID: ${{ inputs.gh_app_installation_id || vars.GH_TF_APP_INSTALLATION_ID }}
  GITHUB_APP_PEM_FILE: |
    ${{ secrets.gh_app_pem_file || secrets.GH_TF_APP_PEM_FILE }}
  # Terraform configuration
  TF_WORKSPACE: ${{ inputs.gh_owner || vars.GH_TF_OWNER }}
  TF_VAR_config: ${{ inputs.path && format('../config/{0}', inputs.path) || '../test.yaml' }}
  TF_IN_AUTOMATION: true

defaults:
  run:
    shell: bash

jobs:
  terraform:
    name: Terraform Apply
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the called repository
        uses: actions/checkout@v6
        with:
          repository: bruzit/github-organization-as-code
      - name: Checkout the caller repository
        if: github.repository != 'bruzit/github-organization-as-code'
        uses: actions/checkout@v6
        with:
          path: config
          sparse-checkout: ${{ inputs.path || 'test.yaml' }}
          sparse-checkout-cone-mode: false
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.14.7
      - name: Terraform init
        id: init
        run: terraform -chdir=terraform init -input=false
      - name: Terraform Apply
        run: terraform -chdir=terraform apply -auto-approve -input=false