mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-28 10:18:51 +00:00
d26df944c0
To improve supply-chain security, reference all GitHub actions using the hash of the released tag. GitHub recommends to do this for third-party actions (https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions). In order to make our CI more deterministic, I opted to do it for all our actions. This means any change to our workflow configuration requires a source code change and thus passing CI on our end. Dependabot will automatically issue PRs for these actions and update the comment with the new version next to them. Resolves: #2497.
107 lines
4.5 KiB
YAML
107 lines
4.5 KiB
YAML
name: Terraform
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
plan-deploy:
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
env:
|
|
TF_CLOUD_ORGANIZATION: "firezone"
|
|
TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
|
|
TF_WORKSPACE: "staging"
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- name: Tool Versions
|
|
id: versions
|
|
uses: marocchino/tool-versions-action@18a164fa2b0db1cc1edf7305fcb17ace36d1c306 # v1.2.0
|
|
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
|
|
with:
|
|
terraform_version: ${{ steps.versions.outputs.terraform }}
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- name: Validate cloud-init
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y cloud-init
|
|
sudo cloud-init schema --config-file terraform/modules/google-cloud/apps/relay/templates/cloud-init.yaml
|
|
sudo cloud-init schema --config-file terraform/modules/google-cloud/apps/elixir/templates/cloud-init.yaml
|
|
sudo cloud-init schema --config-file terraform/modules/google-cloud/apps/gateway-region-instance-group/templates/cloud-init.yaml
|
|
- name: Check Formatting
|
|
working-directory: terraform
|
|
run: |
|
|
terraform fmt --check --recursive
|
|
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
|
|
id: changes
|
|
with:
|
|
filters: |
|
|
terraform:
|
|
- 'terraform/**'
|
|
- if: steps.changes.outputs.terraform == 'true'
|
|
name: Upload Configuration
|
|
uses: hashicorp/tfc-workflows-github/actions/upload-configuration@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
|
|
id: plan-upload
|
|
with:
|
|
workspace: ${{ env.TF_WORKSPACE }}
|
|
# Subdirectory is set in the project settings:
|
|
# https://app.terraform.io/app/firezone/workspaces/staging/settings/general
|
|
directory: "./"
|
|
speculative: true
|
|
- if: steps.changes.outputs.terraform == 'true'
|
|
name: Create Plan Run
|
|
uses: hashicorp/tfc-workflows-github/actions/create-run@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
|
|
id: plan-run
|
|
env:
|
|
TF_VAR_image_tag: '"${{ github.sha }}"'
|
|
with:
|
|
workspace: ${{ env.TF_WORKSPACE }}
|
|
configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
|
|
plan_only: true
|
|
- if: steps.changes.outputs.terraform == 'true'
|
|
name: Get Plan Output
|
|
uses: hashicorp/tfc-workflows-github/actions/plan-output@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
|
|
id: plan-output
|
|
with:
|
|
plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}
|
|
- name: Update PR
|
|
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
|
|
id: plan-comment
|
|
if: ${{ github.event_name == 'pull_request' && steps.changes.outputs.terraform == 'true' }}
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
// 1. Retrieve existing bot comments for the PR
|
|
const { data: comments } = await github.rest.issues.listComments({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: context.issue.number,
|
|
});
|
|
const botComment = comments.find(comment => {
|
|
return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
|
|
});
|
|
const output = `#### Terraform Cloud Plan Output
|
|
|
|
\`\`\`
|
|
Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
|
|
\`\`\`
|
|
|
|
[Terraform Cloud Plan](${{ steps.plan-run.outputs.run_link }})
|
|
`;
|
|
// 3. Update previous comment or create new one
|
|
if (botComment) {
|
|
github.rest.issues.updateComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
comment_id: botComment.id,
|
|
body: output
|
|
});
|
|
} else {
|
|
github.rest.issues.createComment({
|
|
issue_number: context.issue.number,
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
body: output
|
|
});
|
|
}
|