refactor: reorganize terraform roots by domain (strata-prefixed) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Apply Terraform Backend Role | |
| # Terraform GitOps for the 00-remote_state/1-iam/ root: the org-wide S3 state | |
| # access role is created/synchronised from remote. Plans on PR, applies on push | |
| # to main. Credentials come from the identity/00-ci-trust CI role assumed via | |
| # OIDC — no static AWS keys. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - '00-remote_state/1-iam/**' | |
| - '.github/workflows/iam_terraform-backend-role.yml' | |
| pull_request: | |
| paths: | |
| - '00-remote_state/1-iam/**' | |
| - '.github/workflows/iam_terraform-backend-role.yml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| terraform: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # mint the OIDC token exchanged for temporary AWS creds | |
| contents: read | |
| steps: | |
| # Fail fast and clearly if creds aren't set, instead of letting the | |
| # tooling emit a confusing assume-role error. | |
| - name: Assert credentials are present | |
| env: | |
| ROLE_ARN: ${{ vars.AWS_GITHUB_ACTIONS_ROLE_ARN }} | |
| run: | | |
| if [ -z "$ROLE_ARN" ]; then | |
| echo "::error::vars.AWS_GITHUB_ACTIONS_ROLE_ARN is not set. Set it to the github-actions-terraform role ARN (provisioned by identity/00-ci-trust/)." | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 | |
| with: | |
| # Keep in sync with mise.toml [tools] terraform version. | |
| terraform_version: "1.14" | |
| - name: Assume the CI role via OIDC | |
| uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 | |
| with: | |
| role-to-assume: ${{ vars.AWS_GITHUB_ACTIONS_ROLE_ARN }} | |
| aws-region: eu-west-3 | |
| - name: Terraform plan | |
| if: github.event_name == 'pull_request' | |
| env: | |
| TF_CHDIR: "00-remote_state/1-iam" | |
| TF_ENVIRONMENT: "00-remote-state-iam.tfvars" | |
| run: | | |
| set -euo pipefail | |
| terraform -chdir="${TF_CHDIR}" init -input=false | |
| terraform -chdir="${TF_CHDIR}" workspace select "${TF_ENVIRONMENT%.*}" | |
| terraform -chdir="${TF_CHDIR}" plan -input=false -var-file="env/${TF_ENVIRONMENT}" | |
| - name: Terraform apply | |
| if: github.event_name == 'push' | |
| env: | |
| TF_CHDIR: "00-remote_state/1-iam" | |
| TF_ENVIRONMENT: "00-remote-state-iam.tfvars" | |
| run: | | |
| set -euo pipefail | |
| terraform -chdir="${TF_CHDIR}" init -input=false | |
| terraform -chdir="${TF_CHDIR}" workspace select "${TF_ENVIRONMENT%.*}" | |
| terraform -chdir="${TF_CHDIR}" apply -auto-approve -input=false -var-file="env/${TF_ENVIRONMENT}" |