diff --git a/.github/workflows/opentofu-check-schedule.yml b/.github/workflows/opentofu-check.yml similarity index 67% rename from .github/workflows/opentofu-check-schedule.yml rename to .github/workflows/opentofu-check.yml index ef82a77..3e8bd34 100644 --- a/.github/workflows/opentofu-check-schedule.yml +++ b/.github/workflows/opentofu-check.yml @@ -2,7 +2,7 @@ # Copyright The Linux Foundation and each contributor. # SPDX-License-Identifier: MIT -name: "OpenTofu Check Schedule" +name: "OpenTofu Check" on: workflow_call: @@ -87,11 +87,6 @@ on: opentofu_http_credentials: description: 'Credentials that will be used for fetching modules sources' required: false - schedule: - # Runs at 9:00 AM PST every Tuesday - # Note: GitHub Actions uses UTC time - # 9:00 AM PST = 17:00 UTC (during standard time) - - cron: '0 17 * * 2' permissions: id-token: write @@ -99,61 +94,10 @@ permissions: pull-requests: write jobs: - opentofu_check_drift: - name: "OpenTofu Check - ${{ matrix.environment }}" - strategy: - matrix: - environment: - - dev - - prod - runs-on: ubuntu-latest - if: ${{ github.event_name == 'schedule' }} - - steps: - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - - name: Set Environment Variables - id: set-env - run: | - echo -e "${{ inputs.env }}" >> "$GITHUB_ENV" - for val in $(echo -e "${{ secrets.env_secret }}" | cut -d'=' -f2-); do echo ::add-mask::"$val" ; done - for val in $(echo -e "${{ secrets.opentofu_secret_variables }}" | cut -d'=' -f2-); do echo ::add-mask::"$val" ; done - echo -e "${{ secrets.env_secret }}" >> "$GITHUB_ENV" - - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 - with: - audience: sts.amazonaws.com - role-to-assume: arn:aws:iam::391835788720:role/terraform-deploy-oidc - aws-region: us-west-2 - - # This is used to fetch build time secrets from AWS Secrets Manager - - name: Read secrets from AWS Secrets Manager into environment variables - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 - if: ${{ vars.SECRETS_MANAGER_KEYS != '' }} - with: - secret-ids: ${{ vars.SECRETS_MANAGER_KEYS }} - name-transformation: none - - - name: OpenTofu Check - uses: dflook/tofu-check@906f68064a99656755c320d74959150782d42757 # v1.49.0 - with: - workspace: ${{ vars.OPENTOFU_WORKSPACE || matrix.environment }} - backend_config: ${{ vars.OPENTOFU_BACKEND_CONFIG || '' }} - var_file: ${{ vars.OPENTOFU_VAR_FILE || '' }} - path: ${{ vars.OPENTOFU_PATH || '.' }} - variables: | - ${{ vars.OPENTOFU_VARIABLES || '' }} - ${{ secrets.opentofu_secret_variables }} - env: - OPENTOFU_HTTP_CREDENTIALS: ${{ secrets.opentofu_http_credentials }} - OPENTOFU_VERSION: 1.10.3 - opentofu_check: runs-on: ubuntu-latest name: "OpenTofu Check - ${{ inputs.environment }}" - if: ${{ github.event_name == 'workflow_call' && inputs.trigger_check }} + if: ${{ inputs.trigger_check }} steps: - name: Checkout diff --git a/.github/workflows/tofu-apply.yml b/.github/workflows/tofu-apply.yml index 003d1ad..40ecd82 100644 --- a/.github/workflows/tofu-apply.yml +++ b/.github/workflows/tofu-apply.yml @@ -1,9 +1,8 @@ -name: "Terraform Apply" +name: "Tofu Apply" on: push: branches: - - master - main permissions: diff --git a/.github/workflows/tofu-check-schedule.yml b/.github/workflows/tofu-check-schedule.yml new file mode 100644 index 0000000..e8e943d --- /dev/null +++ b/.github/workflows/tofu-check-schedule.yml @@ -0,0 +1,37 @@ +--- +# Copyright The Linux Foundation and each contributor. +# SPDX-License-Identifier: MIT + +name: "OpenTofu Check Schedule" + +on: + schedule: + # Runs at 9:00 AM PST every Tuesday + # Note: GitHub Actions uses UTC time + # 9:00 AM PST = 17:00 UTC (during standard time) + - cron: '0 17 * * 2' + +permissions: + id-token: write + contents: read + pull-requests: write + +jobs: + opentofu_check_drift: + name: "OpenTofu Check - ${{ matrix.environment }}" + strategy: + matrix: + environment: + - prod + uses: ./.github/workflows/opentofu-check.yml + with: + environment: ${{ matrix.environment }} + opentofu_workspace: ${{ matrix.environment }} + oidc_role_arn: 'arn:aws:iam::391835788720:role/terraform-deploy-oidc' + oidc_audience: 'sts.amazonaws.com' + secrets: + env_secret: | + GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} + opentofu_secret_variables: | + datadog_api_key = "${{ secrets.DD_API_KEY }}" + datadog_app_key = "${{ secrets.DD_APP_KEY }}" diff --git a/.github/workflows/tofu-plan.yml b/.github/workflows/tofu-plan.yml index b27cfe2..aa22cb5 100644 --- a/.github/workflows/tofu-plan.yml +++ b/.github/workflows/tofu-plan.yml @@ -1,4 +1,4 @@ -name: "Terraform Plan" +name: "Tofu Plan" on: - pull_request