Skip to content

Commit 1953722

Browse files
marcelovbcfilhomarcelovbcfilho
authored
feat: reuse workflow, improve tf cloud usage (#11)
2 parents 5cca26b + c307144 commit 1953722

13 files changed

+86
-216
lines changed

‎.github/workflows/main.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: Terraform Apply
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
workflow_dispatch:
8+
9+
jobs:
10+
terraform_apply:
11+
name: Terraform Apply
12+
uses: soat-tech-challenge/github-workflows/.github/workflows/terraform-apply.yml@main
13+
secrets: inherit
14+
with:
15+
cloud_workspace: database-staging

‎.github/workflows/pull-request.yml‎

Lines changed: 8 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -9,128 +9,22 @@ on:
99
jobs:
1010
tflint:
1111
name: TFLint
12-
runs-on: ubuntu-latest
13-
14-
steps:
15-
- name: Checkout
16-
uses: actions/checkout@v3
17-
18-
- name: Setup TFLint
19-
uses: terraform-linters/setup-tflint@v3
20-
21-
- name: Init TFLint
22-
run: tflint --init
23-
env:
24-
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
25-
GITHUB_TOKEN: ${{ github.token }}
26-
27-
- name: Run TFLint
28-
run: tflint -f compact
12+
uses: soat-tech-challenge/github-workflows/.github/workflows/tflint.yml@main
2913

3014
tfsec:
31-
name: tfsec
32-
runs-on: ubuntu-latest
15+
uses: soat-tech-challenge/github-workflows/.github/workflows/tfsec.yml@main
3316

3417
permissions:
3518
contents: read
3619
pull-requests: write
3720

38-
steps:
39-
- name: Checkout
40-
uses: actions/checkout@v3
41-
42-
- name: tfsec
43-
uses: aquasecurity/[email protected]
44-
with:
45-
tfsec_args: --soft-fail
46-
github_token: ${{ github.token }}
47-
48-
terraform-cloud-speculative-run:
49-
name: Terraform Cloud Speculative Run
50-
runs-on: ubuntu-latest
21+
terraform-plan:
22+
name: Terraform Plan
23+
uses: soat-tech-challenge/github-workflows/.github/workflows/terraform-plan.yml@main
24+
secrets: inherit
25+
with:
26+
cloud_workspace: database-staging
5127

5228
permissions:
5329
contents: read
5430
pull-requests: write
55-
56-
env:
57-
TF_CLOUD_ORGANIZATION: ${{ vars.TF_CLOUD_ORGANIZATION }}
58-
TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
59-
TF_WORKSPACE: ${{ vars.TF_WORKSPACE }}
60-
CONFIG_DIRECTORY: ${{ vars.CONFIG_DIRECTORY }}
61-
62-
steps:
63-
- name: Checkout
64-
uses: actions/checkout@v3
65-
66-
- name: Upload Configuration
67-
uses: hashicorp/tfc-workflows-github/actions/[email protected]
68-
id: upload
69-
with:
70-
workspace: ${{ env.TF_WORKSPACE }}
71-
directory: ${{ env.CONFIG_DIRECTORY }}
72-
speculative: true
73-
74-
- name: Create Plan Run
75-
uses: hashicorp/tfc-workflows-github/actions/[email protected]
76-
id: run
77-
## run may fail, if so continue to output PR comment
78-
## step.terraform-cloud-check-run-status will fail job after pr comment is created/updated.
79-
continue-on-error: true
80-
with:
81-
workspace: ${{ env.TF_WORKSPACE }}
82-
configuration_version: ${{ steps.upload.outputs.configuration_version_id }}
83-
plan_only: true
84-
85-
- name: Get Plan Output
86-
uses: hashicorp/tfc-workflows-github/actions/[email protected]
87-
id: plan-output
88-
with:
89-
plan: ${{ steps.run.outputs.plan_id }}
90-
91-
- name: Update PR with Plan comment
92-
uses: actions/github-script@v6
93-
if: github.event_name == 'pull_request'
94-
with:
95-
github-token: ${{ secrets.GITHUB_TOKEN }}
96-
script: |
97-
// 1. Retrieve existing bot comments for the PR
98-
const { data: comments } = await github.rest.issues.listComments({
99-
owner: context.repo.owner,
100-
repo: context.repo.repo,
101-
issue_number: context.issue.number,
102-
})
103-
const botComment = comments.find(comment => {
104-
return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
105-
})
106-
const output = `#### Terraform Cloud Plan Output
107-
\`\`\`
108-
Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
109-
\`\`\`
110-
[Terraform Cloud Plan](${{ steps.run.outputs.run_link }})
111-
`
112-
// 3. If we have a comment, update it, otherwise create a new one
113-
if (botComment) {
114-
github.rest.issues.updateComment({
115-
owner: context.repo.owner,
116-
repo: context.repo.repo,
117-
comment_id: botComment.id,
118-
body: output
119-
})
120-
} else {
121-
github.rest.issues.createComment({
122-
issue_number: context.issue.number,
123-
owner: context.repo.owner,
124-
repo: context.repo.repo,
125-
body: output
126-
})
127-
}
128-
129-
## Check Run Status, if not planned_and_finished fail the job
130-
- id: terraform-cloud-check-run-status
131-
if: ${{ steps.run.outputs.run_status != 'planned_and_finished'}}
132-
run: |
133-
echo "Terraform Cloud Run Failed or Requires Further Attention"
134-
echo "Run Status: '${{ steps.run.outputs.run_status }}'"
135-
echo "${{ steps.run.outputs.run_link }}"
136-
exit 1

‎.github/workflows/terraform-apply.yml‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎.github/workflows/terraform-destroy.yml‎

Lines changed: 2 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -5,31 +5,5 @@ on:
55

66
jobs:
77
terraform_destroy:
8-
name: Terraform Destroy
9-
if: github.ref == 'refs/heads/main'
10-
runs-on: ubuntu-latest
11-
environment: AWS
12-
13-
steps:
14-
- name: Checkout
15-
uses: actions/checkout@v3
16-
17-
- name: Setup Terraform
18-
uses: hashicorp/setup-terraform@v2
19-
with:
20-
cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
21-
22-
- name: Terraform Init
23-
run: terraform init
24-
25-
- name: Terraform Plan
26-
run: terraform plan -destroy -input=false
27-
env:
28-
TF_VAR_AWS_ACCESS_KEY: ${{ secrets.TF_AWS_READONLY_ACCESSKEY }}
29-
TF_VAR_AWS_SECRET_KEY: ${{ secrets.TF_AWS_READONLY_SECRETKEY }}
30-
31-
- name: Terraform Destroy
32-
run: terraform destroy -auto-approve -input=false
33-
env:
34-
TF_VAR_AWS_ACCESS_KEY: ${{ secrets.TF_VAR_AWS_ACCESS_KEY }}
35-
TF_VAR_AWS_SECRET_KEY: ${{ secrets.TF_VAR_AWS_SECRET_KEY }}
8+
uses: soat-tech-challenge/github-workflows/.github/workflows/terraform-destroy.yml@main
9+
secrets: inherit

‎.terraform.lock.hcl‎

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎datasources.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,9 @@ data "aws_subnets" "private_subnets" {
1111
values = ["soat-tech-challenge-subnet-public*"]
1212
}
1313
}
14+
15+
16+
# data "tfe_outputs" "network" {
17+
# organization = "soat-tech-challenge"
18+
# workspace = "network-staging"
19+
# }

‎main.tf‎

Lines changed: 7 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,6 @@
1-
resource "aws_security_group" "soat_tc_rds_sg" {
2-
name = "soat-tc-rds-sg"
3-
vpc_id = data.aws_vpc.vpc.id
4-
5-
ingress {
6-
from_port = var.db_port
7-
to_port = var.db_port
8-
protocol = "tcp"
9-
cidr_blocks = ["0.0.0.0/0"]
10-
}
11-
}
121

13-
resource "aws_db_subnet_group" "soat_tc_rds_subnet_group" {
14-
name = "soat-tc-rds-subnet-group"
15-
subnet_ids = data.aws_subnets.private_subnets.ids
16-
}
172

18-
resource "aws_db_parameter_group" "soat_tc_rds_parameter_group" {
3+
resource "aws_db_parameter_group" "this" {
194
name = "soat-tc-rds-parameter-group"
205
family = "postgres15"
216

@@ -25,10 +10,12 @@ resource "aws_db_parameter_group" "soat_tc_rds_parameter_group" {
2510
}
2611
}
2712

28-
resource "aws_db_instance" "soat_tc_rds_db" {
13+
resource "aws_db_instance" "this" {
2914
identifier = "soat-tc-rds-db"
3015
engine = "postgres"
3116

17+
db_name = "backend-db"
18+
3219
allocated_storage = 20
3320
storage_type = "gp2"
3421
engine_version = "15.3"
@@ -44,8 +31,8 @@ resource "aws_db_instance" "soat_tc_rds_db" {
4431
ca_cert_identifier = "rds-ca-rsa2048-g1"
4532
apply_immediately = true
4633

47-
parameter_group_name = aws_db_parameter_group.soat_tc_rds_parameter_group.name
48-
db_subnet_group_name = aws_db_subnet_group.soat_tc_rds_subnet_group.name
34+
parameter_group_name = aws_db_parameter_group.this.name
35+
db_subnet_group_name = aws_db_subnet_group.this.name
4936

50-
vpc_security_group_ids = [aws_security_group.soat_tc_rds_sg.id]
37+
vpc_security_group_ids = [aws_security_group.this.id]
5138
}

‎network.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "aws_security_group" "this" {
2+
name = "soat-tc-rds-sg"
3+
vpc_id = data.aws_vpc.vpc.id
4+
5+
ingress {
6+
from_port = var.db_port
7+
to_port = var.db_port
8+
protocol = "tcp"
9+
cidr_blocks = ["0.0.0.0/0"]
10+
}
11+
}
12+
13+
resource "aws_db_subnet_group" "this" {
14+
name = "soat-tc-rds-subnet-group"
15+
subnet_ids = data.aws_subnets.private_subnets.ids
16+
}

‎outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
output "rds_instance_id" {
22
description = "The RDS instance identifier"
3-
value = aws_db_instance.soat_tc_rds_db.identifier
3+
value = aws_db_instance.this.name
44
}

‎providers.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
provider "aws" {
22
region = var.aws_region
33

4-
access_key = var.AWS_ACCESS_KEY
5-
secret_key = var.AWS_SECRET_KEY
4+
access_key = var.aws_access_key
5+
secret_key = var.aws_secret_key
66

77
default_tags {
88
tags = {
@@ -11,4 +11,3 @@ provider "aws" {
1111
}
1212
}
1313
}
14-

0 commit comments

Comments
 (0)