Update actions to not rely on private LF repos

.github/workflows/mega-linter.yml

@@ -30,7 +30,7 @@ jobs:
     steps:
       # Git Checkout
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -39,7 +39,7 @@ jobs:
         id: ml
         # Use "cupcake" slim flavor which supports both Terraform and
         # Javascript.
-        uses: oxsecurity/megalinter/flavors/cupcake@v7
+        uses: oxsecurity/megalinter/flavors/cupcake@bacb5f8674e3730b904ca4d20c8bd477bc51b1a7 # v7.13.0
         env:
           # All available variables are described in documentation
           # https://megalinter.io/configuration/
@@ -48,8 +48,8 @@ jobs:
           # (oxsecurity/megalinter#2699).
           TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: GITHUB_TOKEN
 
-      - name: Upload MegaLinter scan results to GitHub Security tab
-        if: success() || failure()
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'megalinter-reports/megalinter-report.sarif'
+      #- name: Upload MegaLinter scan results to GitHub Security tab
+      #  if: success() || failure()
+      #  uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
+      #  with:
+      #    sarif_file: 'megalinter-reports/megalinter-report.sarif'

.github/workflows/opentofu-apply.yml

@@ -1,37 +1,143 @@
-name: "OpenTofu Apply"
-
+name: OpenTofu Apply
 on:
-  push:
-    branches:
-      - master
-      - main
+  workflow_call:
+    inputs:
+      environment:
+        description: 'Name of the environment to use'
+        required: true
+        type: string
+      opentofu_workspace:
+        description: 'Name of the OpenTofu workspace to use'
+        required: false
+        default: ''
+        type: string
+      opentofu_variables:
+        description: 'Variables to pass to OpenTofu'
+        required: false
+        default: ''
+        type: string
+      opentofu_backend_config:
+        description: 'Backend configuration for OpenTofu'
+        required: false
+        default: ''
+        type: string
+      opentofu_plan_label:
+        description: 'Label for the OpenTofu plan output'
+        required: false
+        default: ''
+        type: string
+      opentofu_var_file:
+        description: 'List of var file paths, one per line'
+        required: false
+        default: ''
+        type: string
+      opentofu_auto_approve:
+        description: 'Automatically approve and apply plan'
+        required: false
+        default: "false"
+        type: string
+      oidc_role_arn:
+        description: 'ARN of the IAM role to assume with OIDC'
+        required: false
+        default: 'arn:aws:iam::391835788720:role/terraform-deploy-oidc'
+        type: string
+      oidc_audience:
+        description: 'OIDC audience to authenticate against'
+        required: false
+        default: 'sts.amazonaws.com'
+        type: string
+      oidc_export_variables:
+        description: 'Whether to export OIDC variables'
+        required: false
+        default: true
+        type: boolean
+      trigger_apply:
+        description: 'Whether to trigger the OpenTofu apply job'
+        required: false
+        default: true
+        type: boolean
+      env:
+        description: 'Extra environment variables'
+        required: false
+        type: string
+      secrets_manager_keys:
+        description: 'List of keys to fetch from AWS Secrets Manager'
+        required: false
+        type: string
+      artifact_name:
+        description: "The artifact name to download"
+        required: false
+        type: string
+      artifact_path:
+        description: "The artifact path to download"
+        required: false
+        type: string
+    secrets:
+      env_secret:
+        description: 'Extra secret environment variables'
+        required: false
+      opentofu_secret_variables:
+        description: 'Variables that contains secrets to pass to OpenTofu'
+        required: false
+      opentofu_http_credentials:
+        description: 'Credentials that will be used for fetching modules sources'
+        required: false
 
 permissions:
   id-token: write
   contents: read
   pull-requests: write
 
 jobs:
-  opentofu_apply_dev:
-    name: "OpenTofu Apply - Dev"
-    uses: LF-Engineering/lfx-cloudops-misc/.github/workflows/lfx-opentofu-apply.yml@main
-    with:
-      environment: dev
-      opentofu_backend_config: |
-        bucket=lfx-terraform-state-<project_name>
-        dynamodb_table=lfx-terraform-state-<project_name>
-    secrets:
-      env_secret: |
-          GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
-  opentofu_apply_prod:
-    name: "OpenTofu Apply - Prod"
-    needs: opentofu_apply_dev
-    uses: LF-Engineering/lfx-cloudops-misc/.github/workflows/lfx-opentofu-apply.yml@main
-    with:
-      environment: prod
-      opentofu_backend_config: |
-        bucket=lfx-terraform-state-<project_name>
-        dynamodb_table=lfx-terraform-state-<project_name>
-    secrets:
-      env_secret: |
-          GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+  opentofu_apply:
+    runs-on: ubuntu-latest
+    name: "OpenTofu Apply - ${{ inputs.environment }}"
+    environment: ${{ inputs.environment }}
+    if: ${{ inputs.trigger_apply }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set Environment Variables
+        id: set-env
+        run: |
+            echo -e "${{ inputs.env }}" >> "$GITHUB_ENV"
+            for val in $(echo -e "${{ secrets.env_secret }}" | cut -d'=' -f2-); do echo ::add-mask::"$val" ; done
+            for val in $(echo -e "${{ secrets.opentofu_secret_variables }}" | cut -d'=' -f2-); do echo ::add-mask::"$val" ; done
+            echo -e "${{ secrets.env_secret }}" >> "$GITHUB_ENV"
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+        with:
+          audience: ${{ inputs.oidc_audience }}
+          role-to-assume: ${{ inputs.oidc_role_arn }}
+          aws-region: us-west-2
+
+      - name: Read secrets from AWS Secrets Manager into environment variables
+        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10
+        with:
+          secret-ids: ${{ inputs.secrets_manager_keys }}
+
+      # Conditionally download the artifact if the artifact_name input is provided
+      - name: Download artifact
+        if: ${{ inputs.artifact_name != '' }}
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: ${{ inputs.artifact_path || '.' }}
+
+      - name: OpenTofu Apply
+        uses: dflook/tofu-apply@aabe748c21fba55bcd741a53211a8af90506962f # v1.49.0
+        with:
+          label: ${{ inputs.opentofu_plan_label || inputs.environment }}
+          workspace: ${{ inputs.opentofu_workspace || inputs.environment }}
+          backend_config: ${{ inputs.opentofu_backend_config }}
+          var_file: ${{ inputs.opentofu_var_file }}
+          auto_approve: ${{ inputs.opentofu_auto_approve }}
+          variables: |
+            ${{ inputs.opentofu_variables }}
+            ${{ secrets.opentofu_secret_variables }}
+        env:
+          OPENTOFU_HTTP_CREDENTIALS: ${{ secrets.opentofu_http_credentials }}
+          OPENTOFU_VERSION: 1.10.3