Skip to content

Commit 4998e0e

Browse files
Marta-Panfilova-ASLMarta-Panfilova-ASL
authored
Merge pull request #4 from arvatoaws-labs/cr/new-pipeline-aspects
New pipeline aspects
2 parents 264ccd5 + 82c5552 commit 4998e0e

File tree

6 files changed

+153
-215
lines changed

6 files changed

+153
-215
lines changed

‎.github/workflows/githubaction-comment-apply.yml

Lines changed: 47 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@ on:
99
required: true
1010
type: string
1111
terraform_version:
12-
required: true
12+
required: false
1313
type: string
14+
default: latest
1415
roleArn:
1516
required: true
1617
type: string
@@ -20,15 +21,16 @@ on:
2021
github_event_number:
2122
required: true
2223
type: string
23-
github_event_issue_url:
24-
required: true
25-
type: string
2624
github_event_issue_comments_url:
2725
required: true
2826
type: string
2927
github_event_repository_url:
3028
required: true
3129
type: string
30+
stack:
31+
required: false
32+
type: string
33+
default: "."
3234

3335

3436
jobs:
@@ -81,6 +83,8 @@ jobs:
8183
uses: actions/checkout@v4
8284
with:
8385
ref: refs/pull/${{ inputs.github_event_number }}/merge
86+
- run: echo "REPOSITORY_NAME=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
87+
shell: bash
8488

8589
# Install the latest version of Terraform CLI
8690
- name: Setup Terraform
@@ -90,38 +94,63 @@ jobs:
9094

9195
# Initialize Terraform
9296
- name: Terraform Init
93-
run: terraform init -upgrade
97+
run: |
98+
cd ${{ inputs.stack }}
99+
terraform init -upgrade
94100
95-
# Checks that all Terraform configuration files adhere to a canonical format
96-
- name: Terraform Format LandingZone
97-
run: terraform fmt -check
101+
# Terraform Validation Steps
102+
- name: terraform validate ${{ inputs.stack }}
103+
uses: dflook/terraform-validate@v1
104+
with:
105+
path: ${{ inputs.stack }}
106+
env:
107+
TERRAFORM_HTTP_CREDENTIALS: |
108+
github.com/arvatoaws=oauth:${{ steps.generate-token.outputs.token }}
109+
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
110+
TERRAFORM_ACTIONS_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
111+
GITHUB_APP_ID: ${{ secrets.TERRAFORM_GITHUB_ACTION_APP_ID }}
112+
GITHUB_APP_PEM_FILE: ${{ secrets.TERRAFORM_GITHUB_ACTION_PRIVATE_KEY }}
113+
- name: terraform fmt ${{ inputs.stack }}
114+
uses: dflook/terraform-fmt-check@v1
115+
with:
116+
path: ${{ inputs.stack }}
117+
env:
118+
TERRAFORM_HTTP_CREDENTIALS: |
119+
github.com/arvatoaws=oauth:${{ steps.generate-token.outputs.token }}
120+
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
121+
TERRAFORM_ACTIONS_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
122+
GITHUB_APP_ID: ${{ secrets.TERRAFORM_GITHUB_ACTION_APP_ID }}
123+
GITHUB_APP_PEM_FILE: ${{ secrets.TERRAFORM_GITHUB_ACTION_PRIVATE_KEY }}
98124

99125
# Download the plan from S3
100126
- name: Download Plan from S3
101127
run: |
102-
aws s3 cp s3://${{ inputs.s3bucketName }}/plans/tfplan ./tfplan
128+
cd ${{ inputs.stack }}
129+
aws s3 cp s3://${{ inputs.s3bucketName }}/plans/${{ github.repository }}/${{ inputs.stack }}/${{ inputs.github_event_number }}/tfplan ./tfplan
103130
104131
# Build or change infrastructure according to Terraform configuration files
105132
- name: Terraform Apply
106133
id: apply
107134
continue-on-error: true
108135
run: |
136+
cd ${{ inputs.stack }}
109137
terraform apply -input=false -no-color tfplan
110138
# Upload the plan to S3
111139
- name: Upload Plan to S3
112140
run: |
113-
aws s3 cp ./tfplan s3://${{ inputs.s3bucketName }}/plans/
141+
cd ${{ inputs.stack }}
142+
aws s3 cp ./tfplan s3://${{ inputs.s3bucketName }}/plans/${{ github.repository }}/${{ inputs.stack }}/${{ inputs.github_event_number }}/
114143
115144
# CONCLUDE
116145
# If the apply was successful, post a comment with the applied output
117146
- name: Post Plan and Apply to GitHub PR
118147
if: steps.apply.outcome == 'success'
119148
env:
120149
URL: ${{ inputs.github_event_issue_comments_url }}
121-
LABEL: ${{ inputs.github_event_issue_url }}
122150
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
123151
run: |
124-
(printf "Mode1 Apply\n\n\`\`\`" && echo -n '${{ steps.apply.outputs.stdout }}' && printf "\`\`\`\n\n") > comment.txt
152+
cd ${{ inputs.stack }}
153+
(printf "Terraform Apply\n\n\`\`\`" && echo -n '${{ steps.apply.outputs.stdout }}' && printf "\`\`\`\n\n") > comment.txt
125154
jq -R -s '.' < comment.txt > comment2.txt
126155
truncate -s -1 comment2.txt
127156
(echo -n '{ "body": ' && cat comment2.txt && echo -n ' }') > comment3.txt
@@ -133,7 +162,7 @@ jobs:
133162
-d @comment3.txt
134163
curl \
135164
-X POST \
136-
$LABEL/labels \
165+
https://api.github.com/repos/${{ github.repository }}/issues/${{ inputs.github_event_number }}/labels \
137166
-H "Content-Type: application/json" \
138167
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
139168
-d '["applied"]'
@@ -145,6 +174,7 @@ jobs:
145174
URL: ${{ inputs.github_event_repository_url }}/pulls/${{ inputs.github_event_number }}/merge
146175
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
147176
run: |
177+
cd ${{ inputs.stack }}
148178
curl \
149179
-X PUT \
150180
$URL \
@@ -155,7 +185,8 @@ jobs:
155185
# remove the organization plan from S3 whether successful or not
156186
- name: Delete Plan from S3
157187
run: |
158-
aws s3 rm s3://${{ inputs.s3bucketName }}/plans/tfplan
188+
cd ${{ inputs.stack }}
189+
aws s3 rm --recursive s3://${{ inputs.s3bucketName }}/plans/${{ github.repository }}/${{ inputs.stack }}/${{ inputs.github_event_number }}
159190
160191
# If the apply failed, post the errors
161192
- name: Post Organization Apply Failure
@@ -164,7 +195,8 @@ jobs:
164195
URL: ${{ inputs.github_event_issue_comments_url }}
165196
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
166197
run: |
167-
(printf "Apply failed for Mode1:\n\nMode1\n\n\`\`\`" && echo -n '${{ steps.apply.outputs.stderr }}' && printf "\`\`\`\n\n") > comment.txt
198+
cd ${{ inputs.stack }}
199+
(printf "Apply failed for:\n\n\`\`\`" && echo -n '${{ steps.apply.outputs.stderr }}' && printf "\`\`\`\n\n") > comment.txt
168200
jq -R -s '.' < comment.txt > comment2.txt
169201
truncate -s -1 comment2.txt
170202
(echo -n '{ "body": ' && cat comment2.txt && echo -n ' }') > comment3.txt

‎.github/workflows/githubaction-comment-plan.yml

Lines changed: 47 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@ on:
99
required: true
1010
type: string
1111
terraform_version:
12-
required: true
12+
required: false
1313
type: string
14+
default: latest
1415
roleArn:
1516
required: true
1617
type: string
@@ -20,13 +21,13 @@ on:
2021
github_event_number:
2122
required: true
2223
type: string
23-
github_event_issue_url:
24-
required: true
25-
type: string
2624
github_event_issue_comments_url:
2725
required: true
2826
type: string
29-
27+
stack:
28+
required: false
29+
type: string
30+
default: "."
3031

3132
jobs:
3233
terraform:
@@ -44,6 +45,9 @@ jobs:
4445
shell: bash
4546

4647
steps:
48+
- name: Get PR number
49+
run: echo ${{ inputs.github_event_number }}
50+
4751
# Expose and capture the job ID of the current job
4852
- uses: ReeganExE/[email protected]
4953
- name: Job ID output
@@ -78,6 +82,8 @@ jobs:
7882
uses: actions/checkout@v4
7983
with:
8084
ref: refs/pull/${{ inputs.github_event_number }}/merge
85+
- run: echo "REPOSITORY_NAME=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
86+
shell: bash
8187

8288
# Install the latest version of Terraform CLI
8389
- name: Setup Terraform
@@ -86,18 +92,41 @@ jobs:
8692
terraform_version: ${{ inputs.terraform_version }}
8793

8894
# Initialize Terraform
89-
- name: Terraform Init
90-
run: terraform init -upgrade
95+
- name: Terraform Init ${{ inputs.stack }}
96+
run: |
97+
cd ${{ inputs.stack }}
98+
terraform init -upgrade
9199
92-
# Check that all Terraform configuration files adhere to a canonical format
93-
- name: Terraform Format
94-
run: terraform fmt -check -diff -recursive
100+
# Terraform Validation Steps
101+
- name: terraform validate ${{ inputs.stack }}
102+
uses: dflook/terraform-validate@v1
103+
with:
104+
path: ${{ inputs.stack }}
105+
env:
106+
TERRAFORM_HTTP_CREDENTIALS: |
107+
github.com/arvatoaws=oauth:${{ steps.generate-token.outputs.token }}
108+
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
109+
TERRAFORM_ACTIONS_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
110+
GITHUB_APP_ID: ${{ secrets.TERRAFORM_GITHUB_ACTION_APP_ID }}
111+
GITHUB_APP_PEM_FILE: ${{ secrets.TERRAFORM_GITHUB_ACTION_PRIVATE_KEY }}
112+
- name: terraform fmt ${{ inputs.stack }}
113+
uses: dflook/terraform-fmt-check@v1
114+
with:
115+
path: ${{ inputs.stack }}
116+
env:
117+
TERRAFORM_HTTP_CREDENTIALS: |
118+
github.com/arvatoaws=oauth:${{ steps.generate-token.outputs.token }}
119+
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
120+
TERRAFORM_ACTIONS_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
121+
GITHUB_APP_ID: ${{ secrets.TERRAFORM_GITHUB_ACTION_APP_ID }}
122+
GITHUB_APP_PEM_FILE: ${{ secrets.TERRAFORM_GITHUB_ACTION_PRIVATE_KEY }}
95123

96124
# Generate terraform plan
97-
- name: Terraform Plan
125+
- name: Terraform Plan ${{ inputs.stack }}
98126
id: tfplan
99127
continue-on-error: true
100128
run: |
129+
cd ${{ inputs.stack }}
101130
# Bash script to build terraform plan command dynamically
102131
COMMAND="terraform plan -input=false -no-color -out=tfplan"
103132
SECRETS_JSON='${{ toJson(secrets) }}'
@@ -115,19 +144,21 @@ jobs:
115144
eval $COMMAND && terraform show -no-color tfplan | sed 's/\x27/ /g' | sed -E 's/^([[:space:]]+)([-+])/\2\1/g' > plan.txt
116145
117146
# Upload the plan to S3
118-
- name: Upload Plan to S3
147+
- name: Upload ${{ inputs.stack }} Plan to S3
119148
run: |
120-
aws s3 cp ./tfplan s3://${{ inputs.s3bucketName }}/plans/
149+
cd ${{ inputs.stack }}
150+
aws s3 cp ./tfplan s3://${{ inputs.s3bucketName }}/plans/${{ github.repository }}/${{ inputs.stack }}/${{ inputs.github_event_number }}/
121151
122152
# CONCLUDE
123153
# Post a comment with the plan outputs and add the 'planned' label
124154
- name: Post Plan to GitHub PR
125155
env:
126156
COMMENT: ${{ inputs.github_event_issue_comments_url }}
127-
LABEL: ${{ inputs.github_event_issue_url }}
128157
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
129158
run: |
130-
(printf "Mode1 Plan\n\n\`\`\`diff" && sed '/^::/d' plan.txt) > comment.txt
159+
set -x
160+
cd ${{ inputs.stack }}
161+
(printf "Terraform Plan\n\n\`\`\`diff" && sed '/^::/d' plan.txt) > comment.txt
131162
jq -R -s '.' < comment.txt > comment2.txt
132163
truncate -s -1 comment2.txt
133164
(echo -n '{ "body": ' && cat comment2.txt && echo -n ' }') > comment3.txt
@@ -139,7 +170,7 @@ jobs:
139170
-d @comment3.txt
140171
curl \
141172
-X POST \
142-
$LABEL/labels \
173+
https://api.github.com/repos/${{ github.repository }}/issues/${{ inputs.github_event_number }}/labels \
143174
-H "Content-Type: application/json" \
144175
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
145176
-d '["planned"]'

‎.github/workflows/githubaction-mergeblock.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: 'BlockMerge'
2+
3+
on:
4+
pull_request:
5+
workflow_call:
6+
7+
jobs:
8+
terraform:
9+
name: 'Block Merge'
10+
runs-on: ubuntu-latest
11+
permissions:
12+
id-token: write
13+
contents: read
14+
pull-requests: write
15+
environment:
16+
name: production
17+
defaults:
18+
run:
19+
shell: bash
20+
steps:
21+
- name: Block Merge
22+
run: |
23+
echo "Merge is still blocked, please review the PR comments. Plan & apply has to happen first. If they have, some issue in plan or apply must have occurred and needs to be fixed first."
24+
exit 1

0 commit comments

Comments
 (0)