scheduled-workspace-cleanup.yml

name: "[Scheduled] Cleanup PR Workspaces"

on:
  schedule:
    # 9pm every day except Sundays
    - cron: "0 21 * * 0-6"

permissions:
  id-token: write
  contents: read
  security-events: none
  pull-requests: none
  actions: none
  checks: none
  deployments: none
  issues: none
  packages: none
  repository-projects: none
  statuses: none

jobs:
  terraform_environment_cleanup:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3b9b8c884f6b4bb4d5be2779c26374abadae0871 # pin@v3

      - id: terraform_version
        name: get terraform version
        uses: ministryofjustice/opg-github-actions/.github/actions/terraform-version@v3.1.0
        with:
          terraform_directory: terraform/environment

      - uses: hashicorp/setup-terraform@344fef46b6edc7c46ce8b3b8b0a3ece7e77e05f0 # pin@v2.0.0
        with:
          terraform_version: ${{ steps.terraform_version.outputs.version }}
          terraform_wrapper: false

      - uses: webfactory/ssh-agent@fd34b8dee206fe74b288a5e61bc95fba2f1911eb # pin@v0.5.4
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_ALLOW_LIST_REPOSITORY }}

      - name: configure AWS credentials for terraform
        uses: aws-actions/configure-aws-credentials@97834a484a5ab3c40fa9e2eb40fcf8041105a573 # pin@v1.7.0
        with:
          role-to-assume: arn:aws:iam::631181914621:role/oidc-digideps-development
          role-session-name: github-actions-terraform
          role-duration-seconds: 7400
          aws-region: eu-west-1

      - name: install workspace manager
        run: |
          wget https://github.com/ministryofjustice/opg-terraform-workspace-manager/releases/download/v0.3.2/opg-terraform-workspace-manager_Linux_x86_64.tar.gz -O $HOME/terraform-workspace-manager.tar.gz
          sudo tar -xvf $HOME/terraform-workspace-manager.tar.gz -C /usr/local/bin
          sudo chmod +x /usr/local/bin/terraform-workspace-manager

      - name: terraform init
        run: terraform init -input=false
        working-directory: terraform/environment

      - name: clean up ephemeral environments
        run: |
          unset TF_WORKSPACE
          ./scripts/workspace_cleanup.sh $(terraform-workspace-manager -protected-workspaces=true -aws-account-id=248804316466 -aws-iam-role=digideps-ci)
        working-directory: terraform/environment

      - name: install python
        uses: actions/setup-python@55aad42e4674b58b2b2fb7d8e7552402d922b4e7 # pin@v4.2.0
        with:
          python-version: "3.10"
          cache: "pip"

      - name: clean up old task definitions
        env:
          REGION: eu-west-1
        run: |
          pip install -r requirements.txt
          python cleanup_task_definitions.py
        working-directory: scripts/pipeline/cleanup_task_definitions

  slack_notify_failure:
    name: notify of failure
    uses: ./.github/workflows/_slack-notification.yml
    if: ${{ failure() }}
    needs:
      - terraform_environment_cleanup
    with:
      success: no
      branch: main
      account: 454262938596
      scheduled_task: "Environment Cleanup"
    secrets: inherit