Skip to content

Commit 0949f5d

Browse files
vara-bonthuBonthu
vara-bonthu
and
Bonthu
authored
Plan examples workflow (#53)
Co-authored-by: Bonthu <[email protected]>
1 parent 46ffad7 commit 0949f5d

File tree

4 files changed

+168
-22
lines changed

4 files changed

+168
-22
lines changed

‎.github/workflows/plan-examples.py

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
import json
2+
import glob
3+
import re
4+
5+
6+
def get_examples():
7+
"""
8+
Get all Terraform example root directories using their respective `versions.tf`;
9+
returning a string formatted json array of the example directories minus those that are excluded
10+
"""
11+
exclude = {
12+
'', # Add examples here to exclude from terraform plan
13+
}
14+
15+
projects = {
16+
x.replace('/versions.tf', '')
17+
for x in glob.glob('examples/**/versions.tf', recursive=True)
18+
if not re.match(r'^.+/_', x)
19+
}
20+
21+
print(json.dumps(list(projects.difference(exclude))))
22+
23+
24+
if __name__ == '__main__':
25+
get_examples()

‎.github/workflows/plan-examples.yml

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: plan-examples
2+
3+
on:
4+
# Review https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ and better understand the risks of using pull_request_target before making major changes to this workflow.
5+
pull_request_target:
6+
branches:
7+
- main
8+
workflow_dispatch:
9+
10+
concurrency:
11+
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
12+
cancel-in-progress: true
13+
14+
jobs:
15+
getExampleDirectories:
16+
name: Get example directories
17+
runs-on: ubuntu-latest
18+
# Do not remove environment setup without considering changes to pull_request_target and checkout of PR, as it may lead to checks running automatically against malicious code in PRs.
19+
environment: Observability Test
20+
# Skip running on forks since it won't have access to secrets
21+
if: github.repository == 'aws-observability/terraform-aws-observability-accelerator'
22+
outputs:
23+
directories: ${{ steps.dirs.outputs.directories }}
24+
steps:
25+
# Be careful not to change this to explicit checkout from PR ref/code, as below we run a python code that may change from the PR code.
26+
- name: Checkout
27+
uses: actions/checkout@v3
28+
29+
- name: Get Terraform directories for evaluation
30+
id: dirs
31+
run: |
32+
DIRS=$(python3 .github/workflows/plan-examples.py)
33+
echo "::set-output name=directories::$DIRS"
34+
35+
plan:
36+
name: Plan examples
37+
needs: getExampleDirectories
38+
runs-on: ubuntu-latest
39+
# Skip running on forks since it won't have access to secrets
40+
if: github.repository == 'aws-observability/terraform-aws-observability-accelerator'
41+
42+
# These permissions are needed to interact with GitHub's OIDC Token endpoint.
43+
permissions:
44+
id-token: write
45+
contents: read
46+
strategy:
47+
fail-fast: false
48+
matrix:
49+
directory: ${{ fromJson(needs.getExampleDirectories.outputs.directories) }}
50+
51+
steps:
52+
- name: Remove default Terraform
53+
run: rm -rf $(which terraform)
54+
55+
- name: checkout-merge
56+
if: "contains(github.event_name, 'pull_request')"
57+
uses: actions/checkout@v3
58+
with:
59+
ref: refs/pull/${{github.event.pull_request.number}}/merge
60+
61+
- name: checkout
62+
if: "!contains(github.event_name, 'pull_request')"
63+
uses: actions/checkout@v3
64+
65+
- uses: dorny/paths-filter@v2
66+
id: changes
67+
with:
68+
# Need to check not only the example directory
69+
# but also the supporting module(s) code
70+
# for plans (not for pre-commit)
71+
filters: |
72+
src:
73+
- '${{ matrix.directory }}/**/*.(tf|yml|yaml)'
74+
- 'modules/**/*.(tf|yml|yaml)'
75+
- '*.tf'
76+
77+
- name: Configure AWS credentials from Test account
78+
uses: aws-actions/configure-aws-credentials@v1
79+
if: steps.changes.outputs.src== 'true'
80+
with:
81+
role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}
82+
aws-region: us-west-2
83+
role-duration-seconds: 3600
84+
role-session-name: GithubActions-Session
85+
86+
- name: Terraform Job
87+
uses: hashicorp/setup-terraform@v2
88+
if: steps.changes.outputs.src== 'true'
89+
with:
90+
terraform_version: 1.0.0
91+
92+
- if: steps.changes.outputs.src== 'true'
93+
run: terraform version
94+
95+
- name: Terraform Init
96+
if: steps.changes.outputs.src== 'true'
97+
run: terraform init -reconfigure
98+
working-directory: ${{ matrix.directory }}
99+
100+
- name: Terraform Plan
101+
if: steps.changes.outputs.src== 'true'
102+
working-directory: ${{ matrix.directory }}
103+
run: terraform plan -no-color

‎.github/workflows/pre-commit.yaml

Lines changed: 7 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,6 @@ jobs:
4444
- name: Remove default Terraform
4545
run: rm -rf $(which terraform)
4646

47-
- name: Should fail
48-
continue-on-error: true
49-
run: terraform version
50-
5147
- name: Checkout
5248
uses: actions/checkout@v3
5349

@@ -80,25 +76,22 @@ jobs:
8076
with:
8177
directory: ${{ matrix.directory }}
8278

83-
- name: Pre-commit Terraform 1.1.0 #${{ steps.minMax.outputs.minVersion }}
79+
- name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
8480
uses: clowdhaus/terraform-composite-actions/[email protected]
8581
# Run only validate pre-commit check on min version supported
8682
if: ${{ matrix.directory != '.' && steps.changes.outputs.src== 'true' }}
8783
with:
88-
terraform-version: 1.1.0 # ${{ steps.minMax.outputs.minVersion }}
84+
terraform-version: ${{ steps.minMax.outputs.minVersion }}
8985
args: 'terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*'
9086

91-
- name: Pre-commit Terraform 1.1.0 #${{ steps.minMax.outputs.minVersion }}
87+
- name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
9288
uses: clowdhaus/terraform-composite-actions/[email protected]
9389
# Run only validate pre-commit check on min version supported
9490
if: ${{ matrix.directory == '.' && steps.changes.outputs.src== 'true' }}
9591
with:
96-
terraform-version: 1.1.0 #${{ steps.minMax.outputs.minVersion }}
92+
terraform-version: ${{ steps.minMax.outputs.minVersion }}
9793
args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'
9894

99-
- if: steps.changes.outputs.src== 'true'
100-
run: terraform version
101-
10295
preCommitMaxVersion:
10396
name: Max TF pre-commit
10497
runs-on: ubuntu-latest
@@ -107,10 +100,6 @@ jobs:
107100
- name: Remove default Terraform
108101
run: rm -rf $(which terraform)
109102

110-
- name: Should fail
111-
continue-on-error: true
112-
run: terraform version
113-
114103
- name: Checkout
115104
uses: actions/checkout@v3
116105

@@ -142,14 +131,10 @@ jobs:
142131
uses: clowdhaus/[email protected]
143132
if: steps.changes.outputs.src== 'true'
144133

145-
# TODO - remove hardcoded version once optional attributes are resolved/removed
146-
- name: Pre-commit Terraform 1.2.9 # ${{ steps.minMax.outputs.maxVersion }}
134+
- name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }}
147135
uses: clowdhaus/terraform-composite-actions/[email protected]
148136
if: steps.changes.outputs.src== 'true'
149137
with:
150-
terraform-version: 1.2.9 # ${{ steps.minMax.outputs.maxVersion }}
138+
terraform-version: ${{ steps.minMax.outputs.maxVersion }}
151139
terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
152-
tflint-version: ${{ env.TFLINT_VERSION }}
153-
154-
- if: steps.changes.outputs.src== 'true'
155-
run: terraform version
140+
tflint-version: ${{ env.TFLINT_VERSION }}

‎.github/workflows/stale_issue_pr.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: 'Stale issue & PR handler'
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
- cron: '0 0 * * *'
6+
7+
jobs:
8+
stale:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
issues: write
12+
pull-requests: write
13+
steps:
14+
- uses: actions/stale@main
15+
id: stale
16+
with:
17+
ascending: true
18+
close-issue-message: 'Issue closed due to inactivity.'
19+
close-pr-message: 'Pull request closed due to inactivity.'
20+
days-before-close: 10
21+
days-before-stale: 30
22+
stale-issue-label: stale
23+
stale-pr-label: stale
24+
# Not stale if have this labels
25+
exempt-issue-labels: 'bug,enhancement'
26+
exempt-pr-labels: 'bug,enhancement'
27+
operations-per-run: 100
28+
stale-issue-message: |
29+
This issue has been automatically marked as stale because it has been open 30 days
30+
with no activity. Remove stale label or comment or this issue will be closed in 10 days
31+
stale-pr-message: |
32+
This PR has been automatically marked as stale because it has been open 30 days
33+
with no activity. Remove stale label or comment or this PR will be closed in 10 days

0 commit comments

Comments
 (0)