Terraform EC2 setup #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform Validation | |
| on: | |
| pull_request: | |
| branches: [main, staging, develop] | |
| workflow_dispatch: {} | |
| permissions: | |
| id-token: write | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| terraform-validation: | |
| name: Validate Terraform configuration | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| stack: [backend, frontend] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| - name: Terraform Format Check | |
| run: terraform fmt -check -recursive | |
| - name: Terraform Init (development env) | |
| working-directory: environments/development/${{ matrix.stack }} | |
| run: terraform init -backend=false | |
| - name: Terraform Validate | |
| working-directory: environments/development/${{ matrix.stack }} | |
| run: terraform validate | |
| - name: Terraform Lint | |
| uses: terraform-linters/setup-tflint@v6 | |
| with: | |
| tflint_version: v0.52.0 | |
| - name: Run TFLint in stack dir | |
| working-directory: environments/development/${{ matrix.stack }} | |
| run: | | |
| tflint --init | |
| tflint | |
| - name: Summary | |
| run: echo "Terraform syntax and lint checks completed successfully." | |
| terraform-plan: | |
| name: Terraform Plan (${{ matrix.stack }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| stack: [backend, frontend] | |
| needs: terraform-validation | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v5 | |
| with: | |
| role-to-assume: arn:aws:iam::${{ secrets.IAM_INFRA_ROLE_ID }}:role/flagging-infra-ci | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| - name: Terraform Init (with backend) | |
| working-directory: environments/development/${{ matrix.stack }} | |
| run: terraform init -backend-config=backend.hcl | |
| - name: Terraform Plan (${{ matrix.stack }}) | |
| id: plan | |
| working-directory: environments/development/${{ matrix.stack }} | |
| env: | |
| TF_VAR_admin_key: ${{ matrix.stack == 'backend' && secrets.ADMIN_KEY_DEV || '' }} | |
| TF_VAR_sa_password: ${{ matrix.stack == 'backend' && secrets.SA_PASSWORD_DEV || '' }} | |
| TF_VAR_redis_password: ${{ matrix.stack == 'backend' && secrets.REDIS_PASSWORD_DEV || '' }} | |
| TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }} | |
| TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }} | |
| TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }} | |
| TF_LOG: DEBUG | |
| run: terraform plan -no-color -out=tfplan | |
| - name: Save Plan Output | |
| working-directory: environments/development/${{ matrix.stack }} | |
| run: terraform show -no-color tfplan > plan-${{ matrix.stack }}.txt | |
| - name: Upload Plan as Artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: terraform-plan ${{ matrix.stack }} | |
| path: environments/development/${{ matrix.stack }}/plan-${{ matrix.stack }}.txt | |
| - name: Comment Plan on PR | |
| uses: marocchino/sticky-pull-request-comment@v2 | |
| with: | |
| header: "Terraform Plan – ${{ matrix.stack }}" | |
| path: environments/development/${{ matrix.stack }}/plan-${{ matrix.stack }}.txt | |
| - name: Force unlock on failure | |
| if: failure() | |
| working-directory: environments/development/${{ matrix.stack }} | |
| run: | | |
| echo "Attempting to remove Terraform lock..." | |
| terraform force-unlock -force $(terraform show -json | jq -r '.lock.id') || true |