Skip to content

Commit 3b35ff2

Browse files
linoy-zoaretz1linoy-zoaretz1
authored
Merge pull request #1 from imperva/PP-12736-tf-workflow
[PP-12736] TF workflow: Accroding to https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#issue_comment the workflow must exists in the default branch in order to be triggered by issue comments
2 parents edfbfd8 + 807a073 commit 3b35ff2

File tree

3 files changed

+131
-0
lines changed

3 files changed

+131
-0
lines changed

‎.github/workflows/terraform-apply.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
on:
2+
issue_comment:
3+
types: [edited, created]
4+
5+
permissions:
6+
contents: read
7+
pull-requests: read
8+
9+
jobs:
10+
terraform:
11+
name: 'Terraform Apply'
12+
runs-on: self-hosted
13+
if: github.event.issue.pull_request && (contains(github.event.comment.body, '/test') || contains(github.event.comment.body, '/rc_test'))
14+
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v3
18+
19+
- name: Set Workspace Paths
20+
id: paths
21+
run: |
22+
REPO_NAME="${{ github.event.repository.name }}"
23+
PR_NUMBER="${{ github.event.pull_request.number }}"
24+
RUN_NUMBER="${{ github.run_number }}"
25+
26+
STATE_DIR="/home/ubuntu/terraform/state/${REPO_NAME}/pr-${PR_NUMBER}-run-${RUN_NUMBER}"
27+
OUTPUT_DIR="/home/ubuntu/terraform/outputs/${REPO_NAME}/pr-${PR_NUMBER}-run-${RUN_NUMBER}"
28+
29+
mkdir -p "$STATE_DIR"
30+
mkdir -p "$OUTPUT_DIR"
31+
32+
echo "state_file=$STATE_DIR/terraform.tfstate" >> $GITHUB_OUTPUT
33+
echo "output_file=$OUTPUT_DIR/terraform_outputs.json" >> $GITHUB_OUTPUT
34+
35+
- name: Terraform Init
36+
run: terraform init
37+
env:
38+
GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
39+
40+
- name: Terraform Apply
41+
run: |
42+
terraform apply \
43+
-auto-approve \
44+
-input=false \
45+
-state="${{ steps.paths.outputs.state_file }}"
46+
env:
47+
GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
48+
TF_VAR_project_id: ${{ vars.PROJECT_ID }}
49+
TF_VAR_region: ${{ vars.REGION }}
50+
TF_VAR_mx_password: ${{ secrets.MX_PASSWORD }}
51+
TF_VAR_vpc_network: ${{ vars.VPC_NETWORK }}
52+
TF_VAR_subnet_name: ${{ vars.SUBNET_NAME }}
53+
TF_VAR_zone: ${{ vars.ZONE }}
54+
TF_VAR_instance_type: ${{ vars.INSTANCE_TYPE }}
55+
TF_VAR_waf_version: ${{ vars.WAF_VERSION }}
56+
TF_VAR_timezone: ${{ vars.TIMEZONE }}
57+
TF_VAR_ssh_access_source_ranges: ${{ vars.SSH_ACCESS_SOURCE_RANGES }}
58+
TF_VAR_ui_access_source_ranges: ${{ vars.UI_ACCESS_SOURCE_RANGES }}
59+
TF_VAR_deployment_name: "gh-${{ github.event.pull_request.number }}-${{ github.run_number }}"
60+
TF_VAR_instance_name: ${{ vars.INSTANCE_NAME }}
61+
62+
- name: Save Terraform Outputs
63+
run: |
64+
terraform output \
65+
-state="${{ steps.paths.outputs.state_file }}" \
66+
-json \
67+
| jq 'to_entries | map({(.key): .value.value}) | add' \
68+
> "${{ steps.paths.outputs.output_file }}"
69+
echo "--- Saved outputs ---"
70+
cat "${{ steps.paths.outputs.output_file }}"
71+
72+
- name: Terraform Destroy
73+
run: |
74+
terraform destroy \
75+
-auto-approve \
76+
-input=false \
77+
-state="${{ steps.paths.outputs.state_file }}"
78+
if: github.event.issue.pull_request && contains(github.event.comment.body, '/test')
79+
env:
80+
GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
81+
TF_VAR_project_id: ${{ vars.PROJECT_ID }}
82+
TF_VAR_region: ${{ vars.REGION }}
83+
TF_VAR_mx_password: ${{ secrets.MX_PASSWORD }}
84+
TF_VAR_vpc_network: ${{ vars.VPC_NETWORK }}
85+
TF_VAR_subnet_name: ${{ vars.SUBNET_NAME }}
86+
TF_VAR_zone: ${{ vars.ZONE }}
87+
TF_VAR_instance_type: ${{ vars.INSTANCE_TYPE }}
88+
TF_VAR_waf_version: ${{ vars.WAF_VERSION }}
89+
TF_VAR_timezone: ${{ vars.TIMEZONE }}
90+
TF_VAR_ssh_access_source_ranges: ${{ vars.SSH_ACCESS_SOURCE_RANGES }}
91+
TF_VAR_ui_access_source_ranges: ${{ vars.UI_ACCESS_SOURCE_RANGES }}
92+
TF_VAR_deployment_name: "gh-${{ github.event.pull_request.number }}-${{ github.run_number }}"
93+
TF_VAR_instance_name: ${{ vars.INSTANCE_NAME }}
94+
95+
## Note: if workflow is cancelled, destroy. TO BE TESTED
96+
# - name: Terraform Destroy on Cancel
97+
# if: cancelled()
98+
# run: |
99+
# terraform destroy \
100+
# -auto-approve \
101+
# -input=false \
102+
# -state="${{ steps.paths.outputs.state_file }}"
103+
# env:
104+
# GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
105+
# TF_VAR_project_id: ${{ vars.PROJECT_ID }}
106+
# TF_VAR_region: ${{ vars.REGION }}
107+
# TF_VAR_mx_password: ${{ secrets.MX_PASSWORD }}
108+
# TF_VAR_vpc_network: ${{ vars.VPC_NETWORK }}
109+
# TF_VAR_subnet_name: ${{ vars.SUBNET_NAME }}
110+
# TF_VAR_zone: ${{ vars.ZONE }}
111+
# TF_VAR_instance_type: ${{ vars.INSTANCE_TYPE }}
112+
# TF_VAR_waf_version: ${{ vars.WAF_VERSION }}
113+
# TF_VAR_timezone: ${{ vars.TIMEZONE }}
114+
# TF_VAR_ssh_access_source_ranges: ${{ vars.SSH_ACCESS_SOURCE_RANGES }}
115+
# TF_VAR_ui_access_source_ranges: ${{ vars.UI_ACCESS_SOURCE_RANGES }}
116+
# TF_VAR_deployment_name: "gh-${{ github.event.pull_request.number }}-${{ github.run_number }}"
117+
# TF_VAR_instance_name: ${{ vars.INSTANCE_NAME }}

‎provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "google" {
2+
project = var.project_id
3+
region = var.region
4+
}

‎variables.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
variable "project_id" {
2+
type = string
3+
description = "The GCP project ID."
4+
}
5+
6+
variable "region" {
7+
type = string
8+
description = "The GCP region where resources will be deployed."
9+
}
10+
111
variable "deployment_name" {
212
type = string
313
description = "A unique prefix for all deployed resources. If not provided, a random prefix will be generated."

0 commit comments

Comments
 (0)