[NDR-307] Build your sandbox from a single make command (#488)

Author: jameslinnell

makefile

@@ -1,30 +1,35 @@
 default: help
 
+help: ## This help message
+	@grep -E --no-filename '^[a-zA-Z-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-42s\033[0m %s\n", $$1, $$2}'
+
 .PHONY: Install
-install:
+install:	## Run NPM install 
 	cd ./infrastructure && npm install
 
 # Formatting
 .PHONY:format-all
-format-all:
+format-all:	## Format all terraform
 	terraform fmt -recursive .
 
 # Documentation
 .PHONY:generate-terraform-docs
-generate-terraform-docs:
+generate-terraform-docs: ## Generate terraform documentation
 	./scripts/run_terraform_docs.py
 
 # Installing
-
+.PHONY:build-sandbox
+build-sandbox: ## Build a sandbox using either the branch as the workspace name, sanitised, or pass in a name for the workspace e.g. make build-sandbox WORKSPACE=my-workspace . By default only a plan will run unless APPLY=true is used.
+	WORKSPACE=$(WORKSPACE) APPLY=$(APPLY) ./scripts/build_sandbox.sh
 # Linting
 
 # Testing
 
 # Bootstrap
 .PHONY: init-bootstrap
-init-bootstrap:
+init-bootstrap: ## Run Bootstrap terraform
 	cd ./bootstrap && terraform init
 
 .PHONY: apply-bootstrap
-apply-bootstrap:
+apply-bootstrap:	## Apply Bootstrap terraform
 	cd ./bootstrap && terraform apply

scripts/build_sandbox.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+set -euo pipefail
+
+required_profile="NDR-Dev-RW"
+
+if [[ "${AWS_PROFILE:-}" != "$required_profile" ]]; then
+  echo "❌ Error: AWS_PROFILE must be set to \"$required_profile\""
+  echo "👉 Example: export AWS_PROFILE=$required_profile"
+  exit 1
+fi
+
+branch="${WORKSPACE:-$(git rev-parse --abbrev-ref HEAD)}"
+branch=$(echo "$branch" | sed 's/[^a-zA-Z0-9]//g')
+branch="${branch,,}"
+apply="${APPLY:-false}"
+
+if [ ${#branch} -gt 7 ]; then
+  echo "Error: your workspace name '$branch' is longer than 7 characters, please start again and choose a workspace less than 8 characters."
+  exit 1
+fi
+
+# Forbidden branches
+forbidden_workspaces=("main" "prod" "pre-prod" "ndr-test" "ndr-dev" "preprod" "ndrtest" "ndrdev", "dev", "test")
+
+for fb in "${forbidden_workspaces[@]}"; do
+  if [[ "$branch" == "$fb" ]]; then
+    echo "❌ Error: Deployment of workspace '$fb' is not allowed. If you are trying to deploy main to your sandbox then provide a workspace name."
+    exit 1
+  fi
+done
+
+cd infrastructure/
+terraform init -backend-config=backend.conf
+terraform workspace select -or-create "$branch"
+terraform plan -input=false -var-file=dev.tfvars -out tf.plan
+
+if [[ "$apply" == "true" ]]; then
+  terraform apply -auto-approve -input=false tf.plan
+fi