Update Javascript #1512
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform Pull Request | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, closed] | |
| jobs: | |
| fmt: | |
| runs-on: ubuntu-latest | |
| if: github.event.action != 'closed' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: hashicorp/setup-terraform@v4 | |
| - name: Terraform fmt | |
| id: fmt | |
| run: terraform fmt -check -diff | |
| # Disabled: not currently in use, and it adds extra runtime to every PR. | |
| # Uncomment to re-enable policy checks against the Terraform plan. | |
| # policy-checks: | |
| # runs-on: ubuntu-latest | |
| # if: github.event.action != 'closed' && github.event.pull_request.base.ref == 'main' | |
| # needs: execute | |
| # permissions: | |
| # contents: read | |
| # id-token: write | |
| # pull-requests: write | |
| # steps: | |
| # - uses: actions/checkout@v6 | |
| # | |
| # - name: Terraform Init (for policies) | |
| # uses: ./.github/actions/terraform_init/ | |
| # with: | |
| # terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }} | |
| # terraform_workspace: terraform-example | |
| # gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| # gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} | |
| # | |
| # - name: Download terraform plan | |
| # uses: actions/download-artifact@v8 | |
| # with: | |
| # name: tfplan | |
| # | |
| # - name: Convert plan to JSON | |
| # run: | | |
| # terraform show -json tfplan > tfplan.json | |
| # | |
| # - uses: overmindtech/policy-signals-action@v1 | |
| # with: | |
| # policies-path: './policies' | |
| # terraform-plan-json: './tfplan.json' | |
| # overmind-api-key: ${{ secrets.OVM_API_KEY }} | |
| # ticket-link: ${{ needs.execute.outputs.run-url }} | |
| execute: | |
| runs-on: ubuntu-latest | |
| if: github.event.pull_request.base.ref == 'main' | |
| outputs: | |
| run-url: ${{ steps.submit-plan.outputs.run-url }} | |
| permissions: | |
| contents: read # required for checkout | |
| id-token: write # mint AWS credentials through OIDC | |
| pull-requests: write # create/update a comment | |
| actions: read # access artifacts | |
| concurrency: | |
| group: tfstate | |
| # Default concurrency behavior only allows one *pending* run per group and | |
| # cancels/replaces it if another arrives - fine for a single PR, but our | |
| # demo Action opens two PRs back-to-back, and the second one was evicting | |
| # the first's still-pending execute job before it ever started. queue: max | |
| # lets pending runs queue up (in order) against the shared tfstate instead | |
| # of being dropped. | |
| queue: max | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Terraform Init | |
| uses: ./.github/actions/terraform_init/ | |
| with: | |
| terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }} | |
| terraform_workspace: terraform-example | |
| gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} | |
| - name: Terraform Validate | |
| if: github.event.action != 'closed' | |
| id: validate | |
| run: terraform validate -no-color | |
| - name: Terraform Plan | |
| if: github.event.action != 'closed' | |
| id: plan | |
| run: | | |
| set -o pipefail -ex | |
| terraform plan -compact-warnings -no-color -input=false -lock=false -out tfplan 2>&1 \ | |
| | tee terraform_log | |
| terraform show -json tfplan > tfplan.json | |
| - name: upload tfplan | |
| if: github.event.action != 'closed' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: tfplan | |
| path: tfplan | |
| - uses: overmindtech/actions/install-cli@main | |
| with: | |
| version: latest | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: overmindtech/actions/submit-plan@main | |
| if: github.event.action != 'closed' | |
| id: submit-plan | |
| with: | |
| ovm-api-key: ${{ secrets.OVM_API_KEY }} | |
| plan-json: ./tfplan.json | |
| tags: 'model=risks_v6' | |
| - name: Install prerequisites | |
| if: github.event.pull_request.merged == true | |
| shell: bash | |
| run: | | |
| sudo apt install -y netcat-traditional | |
| - uses: overmindtech/actions/start-change@main | |
| if: github.event.pull_request.merged == true | |
| with: | |
| ovm-api-key: ${{ secrets.OVM_API_KEY }} | |
| - name: "Deploy marker: Record start_time" | |
| if: github.event.pull_request.merged == true | |
| run: echo "DEPLOY_START_TIME=$(date +%s)" >> $GITHUB_ENV | |
| - name: download tfplan | |
| if: github.event.pull_request.merged == true | |
| uses: dawidd6/action-download-artifact@v19 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| name: tfplan | |
| pr: ${{ github.event.pull_request.number }} | |
| - name: Terraform Apply | |
| if: github.event.pull_request.merged == true | |
| id: apply | |
| run: terraform apply -auto-approve -no-color -input=false -lock-timeout=5m tfplan | |
| - uses: overmindtech/actions/end-change@main | |
| if: (success() || failure() || cancelled()) && github.event.pull_request.merged == true | |
| with: | |
| ovm-api-key: ${{ secrets.OVM_API_KEY }} | |
| cost-analysis: | |
| runs-on: ubuntu-latest | |
| if: github.event.action != 'closed' && github.event.pull_request.base.ref == 'main' | |
| permissions: | |
| contents: read | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Terraform Init | |
| uses: ./.github/actions/terraform_init/ | |
| with: | |
| terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }} | |
| terraform_workspace: terraform-example | |
| gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} | |
| - name: Terraform Plan for Cost Analysis | |
| id: plan-cost | |
| run: | | |
| set -o pipefail -ex | |
| terraform plan -compact-warnings -no-color -input=false -lock=false -out tfplan-cost 2>&1 | |
| terraform show -json tfplan-cost > tfplan-cost.json | |
| - uses: overmindtech/cost-signals-action@v1 | |
| with: | |
| overmind-api-key: ${{ secrets.OVM_API_KEY }} | |
| infracost-api-key: ${{ secrets.INFRACOST_API_KEY }} | |
| terraform-plan-json: ./tfplan-cost.json | |
| # Disabled: not currently in use, and it adds extra runtime to every PR. | |
| # Uncomment to re-enable auto-approval based on Overmind risk signals. | |
| # auto-approval: | |
| # runs-on: ubuntu-latest | |
| # if: github.event.action != 'closed' && github.event.pull_request.base.ref == 'main' | |
| # needs: execute | |
| # permissions: | |
| # pull-requests: write | |
| # steps: | |
| # - uses: overmindtech/approval-action@v1 | |
| # with: | |
| # github-token: ${{ secrets.GITHUB_TOKEN }} | |
| # block-on-high-risks: true | |
| # max-medium-risks: 3 |