terraform.yml

name: "Terraform"

on:
  push:
    branches: ["main"]
    tags: ["*"]
  pull_request:

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  TF_VAR_database_username: ${{ secrets.DATABASE_USERNAME }}
  TF_VAR_database_password: ${{ secrets.DATABASE_PASSWORD }}
  TF_VAR_metabase_database_username: ${{ secrets.METABASE_DATABASE_USERNAME }}
  TF_VAR_metabase_database_password: ${{ secrets.METABASE_DATABASE_PASSWORD }}
  TF_VAR_metabase_encryption_key: ${{ secrets.METABASE_ENCRYPTION_KEY }}

permissions:
  contents: read

jobs:
  terraform-checks:
    name: "Terraform Checks"
    runs-on: ubuntu-latest

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v3

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.3.3

      # Checks that all Terraform configuration files adhere to a canonical format
      - name: Terraform Format
        run: terraform fmt -check -recursive

  terraform-staging:
    name: "Terraform Staging"
    runs-on: ubuntu-latest
    environment: staging
    needs: [terraform-checks]

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v3

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.3.3

      # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
      - name: Terraform Init
        run: terraform init -backend-config="bucket=${{ secrets.S3_BUCKET }}" -backend-config="region=${{ secrets.S3_REGION }}"

      # Use corresponding workspace
      - name: Terraform Workspace Selection
        run: terraform workspace select staging

      # Generates an execution plan for Terraform
      - name: Terraform Plan
        run: terraform plan -input=false

        # On push to "main", build or change infrastructure according to Terraform configuration files
        # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud".
        # See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks
      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false

  terraform-production:
    name: "Terraform Production"
    runs-on: ubuntu-latest
    environment: production
    needs: [terraform-checks]

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v3

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.3.3

      # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
      - name: Terraform Init
        run: terraform init -backend-config="bucket=${{ secrets.S3_BUCKET }}" -backend-config="region=${{ secrets.S3_REGION }}"

      # Use corresponding workspace
      - name: Terraform Workspace Selection
        run: terraform workspace select production

      # Generates an execution plan for Terraform
      - name: Terraform Plan
        run: terraform plan -input=false

        # On push to "main", build or change infrastructure according to Terraform configuration files
        # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud".
        # See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks
      - name: Terraform Apply
        if: contains(github.ref, 'refs/tags/') && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false