Update vmss-deploy.yml #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy VMSS Infrastructure | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: ['**'] | |
| paths: | |
| - 'gh-runners/**' | |
| - '.github/workflows/vmss-deploy.yml' | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| terraform: | |
| name: Deploy Azure VMSS | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Azure Login | |
| uses: azure/login@v1 | |
| with: | |
| creds: ${{ secrets.VMSS_AZURE_CREDENTIALS }} | |
| - name: Ensure resource group exists | |
| run: | | |
| if ! az group show --name dbatools-ci-runners &>/dev/null; then | |
| echo "Creating resource group dbatools-ci-runners..." | |
| az group create --name dbatools-ci-runners --location eastus | |
| else | |
| echo "Resource group dbatools-ci-runners already exists" | |
| fi | |
| - name: Extract Azure credentials for Terraform | |
| id: azure-creds | |
| run: | | |
| echo "ARM_CLIENT_ID=$(echo '${{ secrets.VMSS_AZURE_CREDENTIALS }}' | jq -r '.clientId')" >> $GITHUB_ENV | |
| echo "ARM_CLIENT_SECRET=$(echo '${{ secrets.VMSS_AZURE_CREDENTIALS }}' | jq -r '.clientSecret')" >> $GITHUB_ENV | |
| echo "ARM_SUBSCRIPTION_ID=$(echo '${{ secrets.VMSS_AZURE_CREDENTIALS }}' | jq -r '.subscriptionId')" >> $GITHUB_ENV | |
| echo "ARM_TENANT_ID=$(echo '${{ secrets.VMSS_AZURE_CREDENTIALS }}' | jq -r '.tenantId')" >> $GITHUB_ENV | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: "1.5.0" | |
| - name: Terraform Init | |
| working-directory: ./gh-runners | |
| run: terraform init | |
| - name: Terraform Validate | |
| working-directory: ./gh-runners | |
| run: terraform validate | |
| - name: Terraform Plan | |
| working-directory: ./gh-runners | |
| run: | | |
| terraform plan \ | |
| -var-file="variables.tfvars" \ | |
| -var="github_token=${{ secrets.VMSS_GH_PAT }}" \ | |
| -out=tfplan | |
| - name: Import existing resources (self-healing) | |
| if: github.event_name == 'push' | |
| continue-on-error: true | |
| working-directory: ./gh-runners | |
| run: | | |
| # Import VNet if it exists outside Terraform state | |
| terraform import azurerm_virtual_network.vnet /subscriptions/65a430fb-5a9a-49ff-969e-05d1beaa88fb/resourceGroups/dbatools-ci-runners/providers/Microsoft.Network/virtualNetworks/dbatools-runner-vmss-vnet 2>/dev/null || true | |
| # Import subnet if it exists outside Terraform state | |
| terraform import azurerm_subnet.subnet /subscriptions/65a430fb-5a9a-49ff-969e-05d1beaa88fb/resourceGroups/dbatools-ci-runners/providers/Microsoft.Network/virtualNetworks/dbatools-runner-vmss-vnet/subnets/dbatools-runner-vmss-subnet 2>/dev/null || true | |
| # Import VMSS if it exists outside Terraform state | |
| terraform import azurerm_windows_virtual_machine_scale_set.vmss /subscriptions/65a430fb-5a9a-49ff-969e-05d1beaa88fb/resourceGroups/dbatools-ci-runners/providers/Microsoft.Compute/virtualMachineScaleSets/dbatools-runner-vmss 2>/dev/null || true | |
| # Import VMSS extension if it exists outside Terraform state | |
| terraform import azurerm_virtual_machine_scale_set_extension.vmss /subscriptions/65a430fb-5a9a-49ff-969e-05d1beaa88fb/resourceGroups/dbatools-ci-runners/providers/Microsoft.Compute/virtualMachineScaleSets/dbatools-runner-vmss/extensions/CustomScriptExtension 2>/dev/null || true | |
| # Import role assignment if it exists outside Terraform state | |
| terraform import azurerm_role_assignment.vmss_kv_secrets_user /subscriptions/65a430fb-5a9a-49ff-969e-05d1beaa88fb/resourceGroups/dbatools-ci-runners/providers/Microsoft.KeyVault/vaults/dbatoolsci|Key_Vault_Secrets_User 2>/dev/null || true | |
| - name: Terraform Apply | |
| if: github.event_name == 'push' | |
| working-directory: ./gh-runners | |
| run: terraform apply -auto-approve tfplan | |
| - name: Deployment Summary | |
| if: github.event_name == 'push' | |
| working-directory: ./gh-runners | |
| run: | | |
| echo "## VMSS Deployment Complete 🚀" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "- Resource Group: dbatools-ci-runners" >> $GITHUB_STEP_SUMMARY | |
| echo "- VMSS Name: dbatools-runner-vmss" >> $GITHUB_STEP_SUMMARY | |
| echo "- Max Instances: 3" >> $GITHUB_STEP_SUMMARY | |
| echo "- Runner Group: Default (no custom group)" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "Next: Scale VMSS to 1 instance to test runner registration" >> $GITHUB_STEP_SUMMARY |