infrastructure/.github/workflows/provision.yml at develop · opencrvs/infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: 01. Provision Infrastructure
run-name: "Provision ${{ inputs.environment }} (tag: ${{ inputs.tags }})"
on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Infrastructure to provision'
        required: true
        default: 'dev'
        type: choice
        options:
          - ""
      tags:
        description: 'Tags to apply to the provisioned resources'
        required: true
        default: all
        type: choice
        options:
          - all
          - checks
          - updates
          - users
          - backup
          - application
          - tools
          - fail2ban
          - data-partition
          - decrypt-on-boot
          - containerd-setup
          - k8s
          - system-preparation
jobs:
  approve:
    environment: ${{ inputs.environment }}
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - name: Waiting for manual approval
        if: ${{ (vars.APPROVAL_REQUIRED || 'false') == 'true' }}
        uses: trstringer/manual-approval@v1
        with:
          secret: ${{ github.TOKEN }}
          approvers: ${{ vars.GH_APPROVERS }}
          minimum-approvals: 1
          issue-title: "Provision ${{ inputs.environment }} (tag: ${{ inputs.tags }})"
          issue-body: >
            Please approve or deny ${{ inputs.environment }} environment provisioning
            initiated from GitHub Actions by @${{ github.actor }}.

          exclude-workflow-initiator-as-approver: false

  provision:
    needs: approve
    runs-on:
      - self-hosted
      - ${{ inputs.environment }}
      - node
    environment: ${{ inputs.environment }}
    steps:
      - name: Set variables for ansible
        id: ansible-variables
        run: |
          echo '${{ toJSON(env) }}' > tmp_vars.json
          JSON_WITHOUT_EMPTY=$(jq -c 'with_entries(select(.value | type == "string" and length > 0))' tmp_vars.json | jq -R )
          echo "EXTRA_VARS=$JSON_WITHOUT_EMPTY" >> $GITHUB_OUTPUT
        env:
          encrypted_disk_size: ${{ vars.DISK_SPACE }}
          disk_encryption_key: ${{ secrets.ENCRYPTION_KEY }}
          k8s_runner_token: ${{ secrets.GH_TOKEN }}
          repository: ${{ github.repository }}
          k8s_cluster_env: ${{ inputs.environment }}
          smtp_host: ${{ secrets.SMTP_HOST }}
          smtp_port: ${{ secrets.SMTP_PORT }}
          smtp_user: ${{ secrets.SMTP_USERNAME }}
          smtp_secure: ${{ secrets.SMTP_SECURE }}
          smtp_from: ${{ secrets.SENDER_EMAIL_ADDRESS}}
          smtp_password: ${{ secrets.SMTP_PASSWORD }}
          alert_email: ${{ secrets.ALERT_EMAIL }}
          backup_host_public_key: ${{ secrets.BACKUP_HOST_PUBLIC_KEY }}
      - name: checkout repository
        uses: actions/checkout@v6
      - name: Run Ansible Playbook
        uses: dawidd6/action-ansible-playbook@v4
        env:
          ANSIBLE_PERSISTENT_COMMAND_TIMEOUT: 10
          ANSIBLE_SSH_TIMEOUT: 10
          ANSIBLE_SSH_RETRIES: 5
        with:
          requirements: galaxy-requirements.yml
          playbook: playbook.yml
          directory: ./infrastructure/server-setup
          # Add --verbose to get more output
          options: |-
            --inventory inventory/${{ inputs.environment }}.yml
            ${{ inputs.tags != 'all' && format('--tags={0}', inputs.tags) || '' }}
            --extra-vars ""${{ steps.ansible-variables.outputs.EXTRA_VARS }}""