deploy_production.yml

on:
  pull_request:
    branches:
      - main
      - tf-actions
    #paths:
    #  - 'tf/environments/production/**'
env:
  tf_actions_working_dir: "./tf/environments/production"
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  ansible:
    needs: terraform
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir }}/ansible
    permissions:
      pull-requests: write
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v2
      with:
        python-version: '3.11'
    - name: Install Ansible
      run: pip install ansible

    - name: Write devops ssh key to .ssh
      run: |
        mkdir -p ~/.ssh/
        chmod 700 ~/.ssh/
        echo "{{ $secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
        chmod 600 ~/.ssh/ooni-devops-prod.pem

    - name: Run Ansible Playbook
      id: playbook
      env:
        # TODO(art): write a known_hosts file from terraform to avoid this
        ANSIBLE_HOST_KEY_CHECKING: "False"
      run: |
        echo "ansible_playbook<<EOF" >> "$GITHUB_OUTPUT"
        echo "\$ ansible-playbook playbook.yml -i inventory.ini" >> "$GITHUB_OUTPUT"
        ansible-playbook playbook.yml -i inventory.ini --key-file ~/.ssh/ooni-devops-prod.pem 2>&1 | tee -a "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"
      continue-on-error: true

    - name: Setup tmate session
      uses: mxschmitt/action-tmate@v3

    - uses: actions/github-script@v6
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const script = require('./scripts/comment-on-pr.js');
          const commentTitle = "Ansible Run Output";
          const commentBody = `
          #### Ansible playbook output 📖\`${{ steps.apply.outcome }}\`

          <details><summary>Show Apply</summary>

          \`\`\`\n
          ${{ steps.playbook.outputs.ansible_playbook}}
          \`\`\`

          </details>

          |                   |                                   |
          |-------------------|-----------------------------------|
          | Pusher            | @${{ github.actor }}              |
          | Action            | ${{ github.event_name }}          |
          | Working Directory | ${{ env.tf_actions_working_dir }} |
          | Workflow          | ${{ github.workflow }}            |
          | Last updated      | ${(new Date()).toUTCString()}     |
          `;
          await script({github, context, core, commentTitle, commentBody});

  terraform:
    runs-on: ubuntu-latest
    if: ${{ !startsWith(github.event.head_commit.message, 'skip-terraform:') }}
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir }}
    permissions:
      contents: write
      pull-requests: write
    env:
      TF_VAR_aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      TF_VAR_aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY}}

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 2

    - uses: hashicorp/setup-terraform@v3
      with:
        terraform_wrapper: false

    - name: Terraform fmt
      id: fmt
      run: terraform fmt -check
      continue-on-error: true

    - name: Terraform Init
      id: init
      run: terraform init

    - name: Terraform Validate
      id: validate
      run: |
        {
          echo "terraform_validate<<EOF"
          terraform validate -no-color
          echo "EOF"
        } >> "$GITHUB_OUTPUT"

    - name: Terraform Plan
      id: plan
      run: |
        {
          echo "terraform_plan<<EOF"
          echo "$ terraform plan"
          terraform plan -no-color
          echo "EOF"
        } >> "$GITHUB_OUTPUT"
      continue-on-error: true

    - name: Terraform Apply
      id: apply
      run: |
        {
          echo "terraform_apply<<EOF"
          echo "$ terraform apply -auto-approve"
          terraform apply -auto-approve -no-color
          echo "EOF"
        } >> "$GITHUB_OUTPUT"
      continue-on-error: true

    # TODO(art): this should only run on master merge
    #- name: Commit and Push Terraform Outputs
    #  id: commit
    #  run: |
    #    {
    #      echo "git_commit<<EOF"
    #      git config --global user.email "nothuman@ooni.org"
    #      git config --global user.name "OONI Github Actions Bot"
    #      git add .
    #      git commit -m "skip-terraform: autoupdate terraform outputs" || echo "No changes to commit"
    #      git push origin HEAD:${{ github.event.pull_request && github.head_ref || github.ref_name }}
    #      echo "EOF"
    #    } >> "$GITHUB_OUTPUT"
    #  env:
    #    GITHUB_REF: ${{ github.ref }}
    #    GITHUB_HEAD_REF: ${{ github.head_ref }}
    #  continue-on-error: true

    - uses: actions/github-script@v6
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const script = require('./scripts/comment-on-pr.js');
          const commentTitle = "Terraform Run Output";
          const commentBody = `
          #### Format and Style 🖌\`${{ steps.fmt.outcome }}\`
          #### Initialization ⚙️\`${{ steps.init.outcome }}\`
          #### Validation 🤖${{ steps.validate.outcome }}\`
          <details><summary>Validation Output</summary>

          \`\`\`\n
          ${{ steps.validate.outputs.terraform_validate }}
          \`\`\`

          </details>

          #### Plan 📖\`${{ steps.plan.outcome }}\`

          <details><summary>Show Plan</summary>

          \`\`\`\n
          ${{ steps.plan.outputs.terraform_plan }}
          \`\`\`

          </details>

          #### Apply 📖\`${{ steps.apply.outcome }}\`

          <details><summary>Show Apply</summary>

          \`\`\`\n
          ${{ steps.apply.outputs.terraform_apply }}
          \`\`\`

          </details>

          |                   |                                   |
          |-------------------|-----------------------------------|
          | Pusher            | @${{ github.actor }}              |
          | Action            | ${{ github.event_name }}          |
          | Working Directory | ${{ env.tf_actions_working_dir }} |
          | Workflow          | ${{ github.workflow }}            |
          | Last updated      | ${(new Date()).toUTCString()}     |
          `;
          await script({github, context, core, commentTitle, commentBody});