pipelines-root.yml

name: Pipelines
run-name: Run Gruntwork Pipelines
on:
  workflow_call:
    inputs:
      # This field can be overriden to customize the runner used for pipelines
      # workflows.
      #
      # IMPORTANT: To use self-hosted runners this workflow must be hosted in
      # the same GitHub organization as your infra-live repository.
      # See https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-self-hosted-runners
      #
      # The value must be an escaped JSON string that will be decoded to the
      # jobs.runs-on field
      # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on
      #
      # For example:
      # - A simple github runner: "\"ubuntu-22.04\""
      # - A list of labels: "[\"self-hosted\", \"linux\"]"
      # - A map: "{group: \"ubuntu-runners\", labels: \"ubuntu-20.04-16core\"}"
      runner:
        type: string
        default: '"ubuntu-latest"'
      api_base_url:
        type: string
        default: "https://api.prod.app.gruntwork.io/api/v1"
      pipelines_binary_url:
        type: string
        default: ""
        description: "Override where we fetch pipelines from, used for internal testing"
      pipelines_cli_version:
        type: string
        default: "v0.40.2"
        description: "For Gruntwork internal testing - the version of the pipelines CLI to use"
      pipelines_actions_ref:
        type: string
        default: "v4.1.0"
        description: "For Gruntwork internal testing - the ref of the pipelines actions to use"
      pipelines_credentials_ref:
        type: string
        default: "v1.0.4"
        description: "For Gruntwork internal testing - the ref of the pipelines credentials to use"

    secrets:
      PIPELINES_READ_TOKEN:
        required: false
      INFRA_ROOT_WRITE_TOKEN:
        required: false
      ORG_REPO_ADMIN_TOKEN:
        required: false

env:
  PIPELINES_CLI_VERSION: ${{ inputs.pipelines_cli_version }}
  PIPELINES_ACTIONS_REF: ${{ inputs.pipelines_actions_ref }}
  PIPELINES_CREDENTIALS_REF: ${{ inputs.pipelines_credentials_ref }}
  BOILERPLATE_VERSION: v0.5.16
  GRUNTWORK_INSTALLER_VERSION: v0.0.40

  # Disables all executions of terragrunt. This is useful for debugging
  # specifics of pipelines actions/workflows and bypassing the (usually time consuming)
  # actual IaC execution.
  SKIP_TERRAGRUNT: false

  # GitHub Actions tends to hit resource exhaustion and kill running jobs
  # if we leave parallelism unbounded, so we set the max to 10 for a sane default.
  TG_PARALLELISM: 10

jobs:
  pipelines_orchestrate:
    name: Detect Infrastructure Changes
    runs-on: ${{ fromJSON(inputs.runner) }}
    env:
      JOB_NAME: "Detect Infrastructure Changes"
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV

      - name: Checkout Pipelines Credentials
        uses: actions/checkout@v4
        with:
          path: pipelines-credentials
          repository: gruntwork-io/pipelines-credentials
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Gruntwork Read Token
        id: pipelines-gruntwork-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Read Token
        id: pipelines-customer-org-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Create PR Token
        id: pipelines-propose-infra-change-token
        uses: gruntwork-io/pipelines-credentials@v1
        with:
          PIPELINES_TOKEN_PATH: propose-infra-change/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Infra Root Write Token
        id: pipelines-infra-root-write-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: infra-root-write/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Repo Admin Token
        id: pipelines-org-repo-admin-token
        uses: ./pipelines-credentials
        continue-on-error: true
        with:
          PIPELINES_TOKEN_PATH: org-repo-admin/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.ORG_REPO_ADMIN_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        id: checkout_actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Report error if token with access to gruntwork repos is invalid
        if: always() && steps.checkout_actions.conclusion != 'success'
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_ORG: ${{ github.repository }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        shell: bash
        run: |
          logs_url="https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
          msg=$(printf "<h2>❌ Plan for $PR_HEAD_SHA</h2>❌ Gruntwork Pipelines was unable to checkout the <code>pipelines-actions</code> repository. Please ensure the <code>PIPELINES_READ_TOKEN</code> is valid and unexpired. <a href=\"https://docs.gruntwork.io/pipelines/security/machine-users#ci-read-only-user\">Learn More</a><br><br><br><a href=\"$logs_url\">View full logs</a>")
          echo "::error:: $msg" # Results in step failure but rest of logic in this step will still run
          echo "$msg" >> "$GITHUB_STEP_SUMMARY"
          pull_number=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
          gh pr comment $pull_number -b "$msg" -R $GITHUB_ORG || true # || true incase this fails on a non-PR run

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Preflight Checks
        uses: ./pipelines-actions/.github/actions/pipelines-preflight-action
        with:
          PIPELINES_READ_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          INFRA_ROOT_WRITE_TOKEN: ${{ steps.pipelines-infra-root-write-token.outputs.PIPELINES_TOKEN }}
          ORG_REPO_ADMIN_TOKEN: ${{ steps.pipelines-org-repo-admin-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}

      - name: Pipelines Orchestrate
        id: orchestrate
        uses: ./pipelines-actions/.github/actions/pipelines-orchestrate
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-infra-root-write-token.outputs.PIPELINES_TOKEN }}

    outputs:
      pipelines_jobs: ${{ steps.orchestrate.outputs.jobs }}

  pipelines_execute:
    env:
      JOB_NAME: ${{ contains(matrix.jobs.Action.Command, 'plan') && 'Plan' || 'Apply' }} - ${{ matrix.jobs.ChangeType }} - ${{ matrix.jobs.WorkingDirectory }}
    name: ${{ contains(matrix.jobs.Action.Command, 'plan') && 'Plan' || 'Apply' }} - ${{ matrix.jobs.ChangeType }} - ${{ matrix.jobs.WorkingDirectory }}
    needs: [pipelines_orchestrate]
    runs-on: ${{ fromJSON(inputs.runner) }}
    # GHA can't check for length, so we just check if there is an item in the 0 index
    if: fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0] != null
    strategy:
      fail-fast: false
      matrix:
        jobs: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs) }}
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV

      - name: Checkout Pipelines Credentials
        uses: actions/checkout@v4
        with:
          path: pipelines-credentials
          repository: gruntwork-io/pipelines-credentials
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Gruntwork Read Token
        id: pipelines-gruntwork-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Read Token
        id: pipelines-customer-org-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Infra Root Write Token
        id: pipelines-infra-root-write-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: infra-root-write/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Propose Infra Change Token
        id: pipelines-propose-infra-change-token
        uses: gruntwork-io/pipelines-credentials@v1
        with:
          PIPELINES_TOKEN_PATH: propose-infra-change/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Mise
        id: mise-toml
        uses: jdx/mise-action@v2
        with:
          install: true
          cache: true
          version: 2025.10.0
          working_directory: "./infra-live-repo"

      - name: Configure code auth
        uses: ./pipelines-actions/.github/actions/pipelines-code-auth
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      # To learn more about customizing Pipelines see our documentation at https://docs.gruntwork.io/pipelines/maintain/extending/
      - name: "[Baseline]: Pre Provision New Account Custom Action"
        uses: ./pipelines-actions/.github/custom-actions/pre-provision-new-account
        if: ${{ matrix.jobs.ChangeType == 'AccountsRequested' }}
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          INFRA_ROOT_WRITE_TOKEN: ${{ steps.pipelines-infra-root-write-token.outputs.PIPELINES_TOKEN }}

      - name: "[ProvisionAccount]: Provision New Account"
        id: provision_new_account
        if: ${{ matrix.jobs.ChangeType == 'AccountsRequested' }}
        uses: ./pipelines-actions/.github/actions/pipelines-provision-account-action
        env:
          TERRAGRUNT_AUTH_PROVIDER_CMD: "pipelines auth terragrunt-credentials --ci github-actions --cloud aws --wd . --disk-cache-duration-minutes 10"
        with:
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}
          job: ${{ toJson(matrix.jobs) }}
          workflow_job_name: ${{ env.JOB_NAME }}

      - name: "[ProvisionAccount]: Post Provision New Account Custom Action"
        uses: ./pipelines-actions/.github/custom-actions/post-provision-new-account
        if: ${{ matrix.jobs.ChangeType == 'AccountsRequested' }}
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          INFRA_ROOT_WRITE_TOKEN: ${{ steps.pipelines-infra-root-write-token.outputs.PIPELINES_TOKEN }}
          baseline_path: ${{ steps.provision_new_account.outputs.baseline_path }}

      - name: "[ProvisionAccount]: Create New Account Pull Request Action"
        if: ${{ matrix.jobs.ChangeType == 'AccountsRequested' && contains(matrix.jobs.Action.Command , 'apply')}}
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}
          JOB: ${{ toJson(matrix.jobs) }}
          AUTHOR_NAME: ${{ github.actor }}
          AUTHOR_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
        run: |
          pipelines account-factory propose-baseline-infra-change \
            --working-directory ./infra-live-repo \
            --author-name "$AUTHOR_NAME" \
            --author-email "$AUTHOR_EMAIL" \
            --job "$JOB"

      - name: "[Baseline]: Pre Baseline Core Account Action"
        uses: ./pipelines-actions/.github/custom-actions/pre-baseline-core-accounts
        if: ${{ matrix.jobs.ChangeType == 'AccountsAdded' }}
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      # Run the core accounts baselines(shared, logs, security, etc. to ensure the account is setup correctly)
      - name: "Run core accounts baselines"
        id: core_accounts_baselines
        if: ${{ matrix.jobs.ChangeType == 'AccountsAdded' }}
        env:
          TG_AUTH_PROVIDER_CMD: "pipelines auth terragrunt-credentials --ci github-actions --cloud aws --wd . --disk-cache-duration-minutes 10"
        # TODO: Rename this as pipelines-apply-core-baselines or something similar
        uses: ./pipelines-actions/.github/actions/pipelines-baseline-account-action
        with:
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}
          job: ${{ toJson(matrix.jobs) }}
          workflow_job_name: ${{ env.JOB_NAME }}

      - name: "[Baseline]: Post Baseline Core Account Action"
        uses: ./pipelines-actions/.github/custom-actions/post-baseline-core-accounts
        if: ${{ matrix.jobs.ChangeType == 'AccountsAdded' }}
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      - name: "[TerragruntExecute]: Run terragrunt ${{ matrix.jobs.Action.Command }} in ${{ matrix.jobs.WorkingDirectory }}"
        id: terragrunt
        if: ${{ (matrix.jobs.ChangeType != 'AccountsRequested') && (matrix.jobs.ChangeType != 'AccountsAdded') }}
        uses: ./pipelines-actions/.github/actions/pipelines-execute
        env:
          TG_AUTH_PROVIDER_CMD: "pipelines auth terragrunt-credentials --ci github-actions --cloud aws --wd . --disk-cache-duration-minutes 10"
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          working_directory: ${{ matrix.jobs.WorkingDirectory }}
          terragrunt_command: ${{ matrix.jobs.Action.Command }} ${{ matrix.jobs.Action.Args }}
          infra_live_repo_branch: ${{ matrix.jobs.Ref }}
          infra_live_repo: "."
          infra_live_directory: "."
          stack_paths: ${{ toJson(matrix.jobs.StackPaths) }}

      - name: Update comment
        if: always() && (matrix.jobs.ChangeType != 'AccountsRequested') && (matrix.jobs.ChangeType != 'AccountsAdded')
        uses: ./pipelines-actions/.github/actions/pipelines-comment-job-update
        with:
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}
          step_name: ${{ matrix.jobs.ChangeType }}
          step_working_directory: ${{ matrix.jobs.WorkingDirectory }}
          step_terragrunt_command: ${{ matrix.jobs.Action.Command }} ${{ matrix.jobs.Action.Args }}
          step_status: ${{ (steps.terragrunt.conclusion == 'success' || steps.core_accounts_baselines.conclusion == 'success') && 'success' || 'failure' }}
          plan_apply_log_file_path: ${{ steps.terragrunt.outputs.plan_folder }}
          extended_log_file_path: ${{ steps.terragrunt.outputs.execute_stdout_log }}
          job_name: ${{ env.JOB_NAME }}

    outputs:
      account_id: ${{ matrix.jobs.AccountId }}
      branch: ${{ matrix.jobs.Ref }}
      working_directory: ${{ matrix.jobs.WorkingDirectory }}
      terragrunt_command: ${{ matrix.jobs.Action.Command }} ${{ matrix.jobs.Action.Args }}
      additional_data: ${{ toJson(matrix.jobs.AdditionalData) }}
      child_account_id: ${{ matrix.jobs.AdditionalData.ChildAccountId }}

  pipelines_apply_baselines:
    env:
      JOB_NAME: Baseline Child Account ${{ contains(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].Action.Command, 'plan') && 'Plan' || 'Apply' }} - ${{ matrix.jobs.Name }} (${{ matrix.jobs.ID }})
    name: Baseline Child Account ${{ contains(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].Action.Command, 'plan') && 'Plan' || 'Apply' }} - ${{ matrix.jobs.Name }} (${{ matrix.jobs.ID }})
    needs: [pipelines_orchestrate, pipelines_execute]
    runs-on: ${{ fromJSON(inputs.runner) }}
    # GHA can't check for length, so we just check if there is an item in the 0 index
    if: fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].NewAccounts[0] != null
    strategy:
      fail-fast: false
      matrix:
        jobs: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].NewAccounts }}
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV

      - name: Checkout Pipelines Credentials
        uses: actions/checkout@v4
        with:
          path: pipelines-credentials
          repository: gruntwork-io/pipelines-credentials
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Gruntwork Read Token
        id: pipelines-gruntwork-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Read Token
        id: pipelines-customer-org-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Create PR Token
        id: pipelines-propose-infra-change-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: propose-infra-change/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Mise
        id: mise-toml
        uses: jdx/mise-action@v2
        with:
          install: true
          cache: true
          version: 2025.10.0
          working_directory: "./infra-live-repo"

      - name: Configure code auth
        uses: ./pipelines-actions/.github/actions/pipelines-code-auth
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      # To learn more about customizing Pipelines see our documentation at https://docs.gruntwork.io/pipelines/maintain/extending/
      - name: "[Baseline]: Pre Baseline Child Account Action"
        uses: ./pipelines-actions/.github/custom-actions/pre-baseline-child-account
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          account_id: ${{ matrix.jobs.ID }}
          account_name: ${{ matrix.jobs.Name }}
          job: ${{ toJson(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0]) }}

      - name: "[Baseline]: Baseline the Child Account"
        id: baseline_child_account
        uses: ./pipelines-actions/.github/actions/pipelines-baseline-child-account-action
        with:
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}
          account_name: ${{ matrix.jobs.Name }}
          job: ${{ toJson(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0]) }}
          workflow_job_name: ${{ env.JOB_NAME }}

      - name: "[Baseline]: Post Baseline Child Account Action"
        uses: ./pipelines-actions/.github/custom-actions/post-baseline-child-account
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          account_id: ${{ matrix.jobs.ID }}
          account_name: ${{ matrix.jobs.Name }}
          job: ${{ toJson(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0]) }}

    outputs:
      delegate_management: ${{ steps.baseline_child_account.outputs.delegate_management }}

  pipelines_setup_delegated_repo:
    env:
      JOB_NAME: Setup Delegated Repo
    name: "Setup Delegated Repo"
    needs: [pipelines_orchestrate, pipelines_apply_baselines, pipelines_execute]
    runs-on: ${{ fromJSON(inputs.runner) }}
    # GHA can't check for length, so we just check if there is an item in the 0 index
    if: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].NewAccounts[0] != null && needs.pipelines_apply_baselines.outputs.delegate_management == 'true' && contains(needs.pipelines_execute.outputs.terragrunt_command, 'apply') }}
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV

      - name: Checkout Pipelines Credentials
        uses: actions/checkout@v4
        with:
          path: pipelines-credentials
          repository: gruntwork-io/pipelines-credentials
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Gruntwork Read Token
        id: pipelines-gruntwork-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Read Token
        id: pipelines-customer-org-read-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Repo Admin Token
        id: pipelines-org-repo-admin-token
        uses: ./pipelines-credentials
        with:
          PIPELINES_TOKEN_PATH: org-repo-admin/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.ORG_REPO_ADMIN_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: "Provision access control account(s) and create PR"
        id: access_control_account
        uses: ./pipelines-actions/.github/actions/pipelines-provision-access-control-action
        with:
          job: ${{ toJson(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0]) }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          ORG_REPO_ADMIN_TOKEN: ${{ steps.pipelines-org-repo-admin-token.outputs.PIPELINES_TOKEN }}

      - name: "Create delegated repo and bootstrap"
        id: provision_delegated_repo
        uses: ./pipelines-actions/.github/actions/pipelines-provision-repo-action
        with:
          job: ${{ toJson(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0]) }}
          workflow_job_name: ${{ env.JOB_NAME }}
          access_control_pull_request_url: ${{ steps.access_control_account.outputs.pull_request_url }}
          new_account_name: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].NewAccounts[0].Name }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          ORG_REPO_ADMIN_TOKEN: ${{ steps.pipelines-org-repo-admin-token.outputs.PIPELINES_TOKEN }}

      # To learn more about customizing Pipelines see our documentation at https://docs.gruntwork.io/pipelines/maintain/extending/
      - name: "Post create delegated repo custom actions"
        uses: ./pipelines-actions/.github/custom-actions/post-create-delegated-repo
        with:
          access_control_pull_request_url: ${{ steps.access_control_account.outputs.pull_request_url }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}
          ORG_REPO_ADMIN_TOKEN: ${{ steps.pipelines-org-repo-admin-token.outputs.PIPELINES_TOKEN }}

      - name: "Create delegated repo pull request"
        uses: ./pipelines-actions/.github/actions/pipelines-new-pr-action
        with:
          job: ${{ toJson(fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0]) }}
          delegated_repo_path: ${{ steps.provision_delegated_repo.outputs.delegated_repo_path }}
          delegated_step_output_file_path: ${{ steps.provision_delegated_repo.outputs.step_output_file_path }}
          delegated_step_output_file_name: ${{ steps.provision_delegated_repo.outputs.step_output_file_name }}
          access_control_pr_url: ${{ steps.access_control_account.outputs.pull_request_url }}
          GH_TOKEN: ${{ steps.pipelines-org-repo-admin-token.outputs.PIPELINES_TOKEN }}

  pipelines_status_check:
    name: "Pipelines Status Check"
    runs-on: ${{ fromJSON(inputs.runner) }}
    needs:
      [
        pipelines_orchestrate,
        pipelines_execute,
        pipelines_apply_baselines,
        pipelines_setup_delegated_repo,
      ]
    if: always()
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV

      - name: Fetch Gruntwork Read Token
        id: pipelines-gruntwork-read-token
        uses: gruntwork-io/pipelines-credentials@v1
        with:
          PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Org Read Token
        id: pipelines-customer-org-read-token
        uses: gruntwork-io/pipelines-credentials@v1
        with:
          PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Fetch Create PR Token
        id: pipelines-propose-infra-change-token
        uses: gruntwork-io/pipelines-credentials@v1
        with:
          PIPELINES_TOKEN_PATH: propose-infra-change/${{ github.repository_owner }}
          FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@v4
        with:
          path: pipelines-actions
          repository: gruntwork-io/pipelines-actions
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Check out repo code
        uses: actions/checkout@v4
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ steps.pipelines-customer-org-read-token.outputs.PIPELINES_TOKEN }}

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}

      - name: Check Status
        shell: bash
        working-directory: ./infra-live-repo
        env:
          PR_COMMENT_WRITE_TOKEN: ${{ steps.pipelines-propose-infra-change-token.outputs.PIPELINES_TOKEN }}
        run: |
          GH_TOKEN="$PR_COMMENT_WRITE_TOKEN" \
            GH_ARTIFACT_TOKEN="$PR_COMMENT_WRITE_TOKEN" \
            pipelines status-update finalize \
            --working-directory . \
            --ci github-actions >/tmp/finalize-output.json

          pipeline_status=$(jq -r '.status' </tmp/finalize-output.json)

          cat /tmp/finalize-output.json

          printf '%.s─' $(seq 1 "$(tput -T dumb cols)")
          echo " "
          if [[ "$pipeline_status" == "success" ]]; then
            echo -e "✅ \033[1;32mPipeline Passed\033[0m"
            exit 0
          else
            echo -e "❌ \033[1;31mPipeline Failed\033[0m"
            exit 1
          fi