terraform.yml

name: 'Terraform'

on:
  pull_request:
    paths:
      - 'k8s-training/**'
      - 'wireguard/**'
      - 'dsvm/**'
      - 'bastion/**'
      - 'modules/**'
#  schedule:
#    - cron: '30 * * * *'

permissions:
  contents: write

env:
  TF_VAR_parent_id: project-e00pjzzrtk1fs3yavy
  TF_VAR_tenant_id: tenant-e00f3wdfzwfjgbcyfv

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      solutions: ${{ steps.parse-changed-files.outputs.solutions }}
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: List changed files
        id: changed-files
        uses: tj-actions/changed-files@v46.0.5
        with:
          files_ignore: |
            .github/**
            .assets/**
            docs/**

      - name: Match changed files
        id: parse-changed-files
        env:
          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
        run: |
          pattern='^(k8s-training|wireguard|bastion|dsvm)$'
          matched=()

          for file in ${ALL_CHANGED_FILES[@]}; do
            solution=$(echo "$file" | cut -d "/" -f1)
            if [[ $solution =~ $pattern ]]; then
                matched+=("$solution")
            elif [[ $solution == "modules" ]]; then
              matched=("k8s-training wireguard bastion dsvm")
            fi
          done
          unique=$(echo "${matched[@]}" | tr ' ' '\n' | uniq);
          json=$(printf '%s\n' "${unique[@]}" | jq -R . | jq -s -c .)
          echo "solutions=$json" >> $GITHUB_OUTPUT
    
  terraform-format:
    needs: detect-changes
    runs-on: ubuntu-latest
    name: 'Terraform Format Check'

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: "v1.11.4"

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Format
      run: terraform fmt -check -recursive . ../modules

  approve_terraform:
    needs: terraform-format
    name: 'Terraform ${{ matrix.solution }}'
    environment:
      name: project-e00pjzzrtk1fs3yavy
    concurrency:
      group: project-e00pjzzrtk1fs3yavy
    runs-on: ubuntu-latest

    steps:
    - name: Print the input name to STDOUT
      run: | 
        echo The username is ${{ inputs.username }} created PR ${{ github.event.number }} which triggers the pipeline, and requries approval

  terraform:
    needs: [approve_terraform, detect-changes]
    name: 'Terraform ${{ matrix.solution }}'
    environment:
      name: project-e00pjzzrtk1fs3yavy
    runs-on: ubuntu-latest
    continue-on-error: true
    strategy:
      max-parallel: 4
      matrix:
        solution: ${{ fromJson(needs.detect-changes.outputs.solutions) }}

    defaults:
      run:
        shell: bash
        working-directory: ${{ matrix.solution }}

    env:
      TF_VAR_subnet_id: vpcsubnet-e00dgdntmhgkeej1z3
      TF_VAR_region: eu-north1
      TF_VAR_loki_access_key_id: ${{ secrets.SA_ACCESS_KEY_ID }}
      TF_VAR_loki_secret_key: ${{ secrets.SA_SECRET_KEY }}

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v4

    - name: Setup SSH keys and agent
      run: |
        ssh-keygen -t rsa -f ~/.ssh/id_rsa -N ''
        eval $(ssh-agent)
        echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> $GITHUB_ENV
        echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> $GITHUB_ENV
        ssh-add

    - name: Setup s3cmd
      run: |
        pip3 install s3cmd --no-cache --quiet
        s3cmd --configure --dump-config \
        --access_key="${{ secrets.SA_ACCESS_KEY_ID }}" \
        --secret_key="${{ secrets.SA_SECRET_KEY }}" \
        --host="storage.eu-north1.nebius.cloud:443" \
        --host-bucket="%(bucket)s.storage.eu-north1.nebius.cloud" \
        > ~/.s3cfg
        mkdir -p tests/reports

    - name: Install XMLStarlet
      run: sudo apt install -y xmlstarlet

    - name: Install Nebius CLI
      run: |
        curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash
        echo "${HOME}/.nebius/bin" >> $GITHUB_PATH

    - name: Nebius CLI init
      run: |
        cat << EOF > /tmp/sa.pem
        ${{ secrets.TERRAFORM_SA_PRIVATE_KEY }}
        EOF
        nebius profile create ${{ vars.TERRAFORM_SA_ID }} --skip-auth \
          --endpoint api.eu.nebius.cloud \
          --service-account-id ${{ vars.TERRAFORM_SA_ID }} \
          --public-key-id ${{ secrets.TERRAFORM_SA_PUBLIC_KEY_ID }} \
          --parent-id ${{ env.TF_VAR_parent_id }} \
          --private-key-file /tmp/sa.pem
        export NEBIUS_IAM_TOKEN=$(nebius iam get-access-token)
        echo "::add-mask::$NEBIUS_IAM_TOKEN"
        export TF_VAR_iam_token=$NEBIUS_IAM_TOKEN
        echo "NEBIUS_IAM_TOKEN=$NEBIUS_IAM_TOKEN" >> $GITHUB_ENV
        echo "TF_VAR_iam_token=$TF_VAR_iam_token" >> $GITHUB_ENV

    # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: "v1.11.4"

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init

    # Validate terraform code
    - name: Terraform Validate
      run: terraform validate

    # Generates an execution plan for Terraform
    - name: Terraform Plan
      run: terraform plan -input=false

    # Run Terraform Tests
    - name: Terraform Test
      run: terraform test -junit-xml=tests/reports/TEST-result-${{ github.run_id }}.xml

    - name: Set date in report
      run: |
        xmlstarlet ed \
        --inplace \
        -i '/testsuites' -t attr -n timestamp -v $(date --iso-8601=seconds) \
        -i '/testsuites/testsuite[*]' -t attr -n timestamp -v $(date --iso-8601=seconds) \
        -i '/testsuites/testsuite[*]/testcase' -t attr -n timestamp -v $(date --iso-8601=seconds) \
        tests/reports/TEST-result-${{ github.run_id }}.xml

    - name: Upload test results
      run: s3cmd sync tests/reports s3://terraform-test-reports/${{ matrix.solution.name }}/
      if: always()

    - name: Load test report history
      uses: actions/checkout@v4
      if: always()
      continue-on-error: true
      with:
        ref: gh-pages
        path: gh-pages

    - name: Build test report
      uses: simple-elf/allure-report-action@v1.13
      if: always()
      with:
        gh_pages: gh-pages
        keep_reports: 100
        subfolder: ${{ matrix.solution }}
        allure_results: ${{ matrix.solution }}/tests/reports

    - name: Publish test report
      uses: peaceiris/actions-gh-pages@v4
      if: always()
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        publish_branch: gh-pages
        publish_dir: allure-history
        keep_files: true

  cleanup-infra:
    name: 'Cleanup Infra'
    environment:
      name: project-e00pjzzrtk1fs3yavy
    concurrency:
      group: project-e00pjzzrtk1fs3yavy
    runs-on: ubuntu-latest
    needs: terraform
    if: always() && needs.terraform.result
    steps:
    - name: Status of the tf tests
      run: echo TF Matrix Job result is ${{ needs.terraform.result }}

    - name: Install Nebius CLI
      run: |
        curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash
        echo "${HOME}/.nebius/bin" >> $GITHUB_PATH

    - name: Nebius CLI init
      run: |
        cat << EOF > /tmp/sa.pem
        ${{ secrets.TERRAFORM_SA_PRIVATE_KEY }}
        EOF
        nebius profile create ${{ vars.TERRAFORM_SA_ID }} --skip-auth \
          --endpoint api.eu.nebius.cloud \
          --service-account-id ${{ vars.TERRAFORM_SA_ID }} \
          --public-key-id ${{ secrets.TERRAFORM_SA_PUBLIC_KEY_ID }} \
          --parent-id ${{ env.TF_VAR_parent_id }} \
          --private-key-file /tmp/sa.pem
    
    - name: Setup s3cmd
      run: |
        pip3 install s3cmd --no-cache --quiet
        s3cmd --configure --dump-config \
        --access_key="${{ secrets.SA_ACCESS_KEY_ID }}" \
        --secret_key="${{ secrets.SA_SECRET_KEY }}" \
        --host="storage.eu-north1.nebius.cloud:443" \
        --host-bucket="%(bucket)s.storage.eu-north1.nebius.cloud" \
        > ~/.s3cfg
    
    - name: Cleanup buckets
      continue-on-error: true
      run: |
        for resource in \
          "storage bucket" \
        ; do
        echo Cleaning up buckets $resource 
        eval nebius --format json $resource list \
          | jq -r 'try .items[] | select(.metadata.name!="terraform-test-reports") | .metadata.name' \
          | eval xargs -r -t -n 1 -I {} s3cmd del --force --recursive s3://{}
        done

    - name: Perform forced cleanup
      run: |
        for resource in \
          "mk8s v1 cluster" \
          "compute v1 instance" \
          "compute v1 filesystem" \
          "compute v1 disk" \
          "compute v1 gpu-cluster" \
          "vpc v1alpha1 allocation" \
          "storage bucket" \
        ; do
          echo Deleting all $resource
          eval nebius --format json $resource list \
          | jq -r 'try .items[] | select(.metadata.name!="terraform-test-reports") | .metadata.id' \
          | eval xargs -r -n 1 nebius $resource delete --id
        done