Skip to content

Commit 55c06e4

Browse files
DaMandal0rianDaMandal0rian
committed
Add CI/CD workflows for terraform automation
- add transcrypt script - workflow changes to terraform
1 parent 2002836 commit 55c06e4

8 files changed

+1917
-23
lines changed

‎.github/workflows/devnet_main_deploy.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Main CD for Devnet Deployment
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
branches:
7+
- main
8+
push:
9+
paths:
10+
- "aws/devnet/**"
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: false
15+
16+
jobs:
17+
deploy:
18+
uses: ./.github/workflows/terraform_template_deploy.yml
19+
with:
20+
project: aws
21+
resource: devnet
22+
tf_workspace_name: devnet-aws
23+
tf_version: 1.5.7
24+
tf_organization: subspace
25+
secrets:
26+
TRANSCRYPT: ${{ secrets.TRANSCRYPT }}
27+
TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}

‎.github/workflows/ephemeral_devnet_aws_deploy.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Main CD for Ephememeral Devnet Deployment
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
branches:
7+
- main
8+
push:
9+
branches:
10+
- "!main"
11+
paths:
12+
- "testing-framework/ec2/network/**"
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: false
17+
18+
jobs:
19+
deploy:
20+
uses: ./.github/workflows/terraform_template_ephemeral_deploy.yml
21+
with:
22+
project: testing-framework
23+
instance: ec2
24+
resource: network
25+
tf_workspace_name: ephemeral-devnet
26+
tf_version: 1.5.7
27+
tf_organization: subspace
28+
secrets:
29+
TRANSCRYPT: ${{ secrets.TRANSCRYPT }}
30+
TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}

‎.github/workflows/ephemeral_devnet_hetzner_deploy.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Main CD for Ephememeral Devnet Deployment
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
branches:
7+
- main
8+
push:
9+
branches:
10+
- "!main"
11+
paths:
12+
- "testing-framework/hetzner/network/**"
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: false
17+
18+
jobs:
19+
deploy:
20+
uses: ./.github/workflows/terraform_template_ephemeral_deploy.yml
21+
with:
22+
project: testing-framework
23+
instance: hetzner
24+
resource: network
25+
tf_workspace_name: ephemeral-devnet-hetzner
26+
tf_version: 1.5.7
27+
tf_organization: subspace
28+
secrets:
29+
TRANSCRYPT: ${{ secrets.TRANSCRYPT }}
30+
TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}

‎.github/workflows/gemini_3f_main_deploy.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Main CD for Gemini Deployment
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
branches:
7+
- main
8+
push:
9+
branches:
10+
- "!main"
11+
paths:
12+
- "aws/gemini-3f/**"
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: false
17+
18+
jobs:
19+
deploy:
20+
uses: ./.github/workflows/terraform_template_deploy.yml
21+
with:
22+
project: aws
23+
resource: gemini-3f
24+
tf_workspace_name: gemini-3f
25+
tf_version: 1.5.7
26+
tf_organization: subspace
27+
secrets:
28+
TRANSCRYPT: ${{ secrets.TRANSCRYPT }}
29+
TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}

‎.github/workflows/terraform_gh_runner.yml‎

Lines changed: 32 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,18 @@
1-
name: Terraform Workflow
1+
name: Terraform GH Runner Deployment
22

33
on:
4-
push:
4+
workflow_dispatch:
5+
pull_request:
56
branches:
67
- main
78
paths:
8-
- './github-runners/terraform/base/**'
9-
workflow_dispatch:
9+
- "./github-runners/terraform/base/**"
1010

1111
jobs:
1212
terraform_gh_runner:
1313
runs-on: ubuntu-latest
14+
env:
15+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1416

1517
steps:
1618
- name: Checkout repository
@@ -19,40 +21,47 @@ jobs:
1921
- name: Set up Terraform
2022
uses: hashicorp/setup-terraform@v1
2123
with:
22-
terraform_version: "1.4.2"
24+
terraform_version: "1.5.7"
2325
cli_config_credentials_token: ${{ secrets.TF_CLOUD_TOKEN }}
2426

2527
- name: Install dependencies
2628
run: |
2729
# Install any dependencies required by your Terraform code
2830
2931
- name: Run Bash Script
32+
env:
33+
GH_TOKEN: ${{ github.token }}
3034
run: |
31-
# GitHub repository and access token
32-
repo="subspace/infra"
33-
token=${{ secrets.PAT_TOKEN }}
35+
# GitHub repository and access token
36+
repo="subspace/infra"
37+
token=${{ secrets.PAT_TOKEN }}
3438
35-
# API endpoint
36-
url="https://api.github.com/repos/$repo/actions/runners/registration-token"
39+
# API endpoint
40+
url="https://api.github.com/repos/$repo/actions/runners/registration-token"
3741
38-
# Send POST request to get the registration token
39-
response=$(curl -X POST -H "Authorization: token $token" -s "$url")
42+
# Send POST request to get the registration token
43+
response=$(curl -X POST -H "Authorization: token $token" -s "$url")
4044
41-
# Extract the token value from the response
42-
runner_token=$(echo "$response" | jq -r '.token')
45+
# Extract the token value from the response
46+
runner_token=$(echo "$response" | jq -r '.token')
4347
44-
# Export the token as an environment variable
45-
echo "export RUNNER_TOKEN=$runner_token" >> $GITHUB_ENV
48+
# Export the token as an environment variable
49+
echo "export RUNNER_TOKEN=$runner_token" >> $GITHUB_ENV
4650
47-
# Set the runner token as an environment variable
48-
export RUNNER_TOKEN="$runner_token"
51+
# Set the runner token as an environment variable
52+
export RUNNER_TOKEN="$runner_token"
4953
50-
# Store the token as a secret in GitHub Actions
51-
gh secret set RUNNER_TOKEN -r "$repo" -b "$runner_token"
54+
# Store the token as a secret in GitHub Actions
55+
gh secret set RUNNER_TOKEN -r "$repo" -b "$runner_token"
56+
57+
- name: Fetch and write terraform.tfvars
58+
run: |
59+
echo ${{ secrets.TF_VARS_FILE }} > terraform.tfvars
60+
chmod 600 terraform.tfvars
5261
5362
- name: Run Terraform
5463
working-directory: ./github-runners/terraform/base
5564
run: |
56-
terraform init-backend-config="organization=${{ secrets.ORGANIZATION_NAME }}" -backend-config="workspaces=${{ secrets.WORKSPACE_NAME }}"
57-
terraform plan -var-file=${{ secrets.VAR_FILE }}
58-
terraform apply -auto-approve -var "gh_token=${{ secrets.RUNNER_TOKEN }}"
65+
terraform init-backend-config="organization=subspace" -backend-config="workspaces=${{ secrets.WORKSPACE_NAME }}"
66+
terraform plan -var-file=terraform.tfvars
67+
terraform apply -auto-approve -var "gh_token=${{ env.RUNNER_TOKEN }}"

‎.github/workflows/terraform_template_deploy.yml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Template Deploy
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
project:
7+
required: true
8+
type: string
9+
resource:
10+
required: true
11+
type: string
12+
tf_workspace_name:
13+
description: "Name of the workspace in terraform cloud"
14+
required: false
15+
type: string
16+
tf_version:
17+
description: "Version of the terraform"
18+
required: true
19+
type: string
20+
tf_organization:
21+
description: "Name of the TF organization"
22+
default: "subspace"
23+
type: string
24+
required: true
25+
run_apply:
26+
description: "The code needs to be deployed or not"
27+
type: string
28+
default: "no"
29+
run_destroy:
30+
description: "The resources need to be destroyed or not"
31+
type: string
32+
default: "no"
33+
secrets:
34+
TRANSCRYPT:
35+
required: true
36+
TF_API_TOKEN:
37+
required: false
38+
env:
39+
TF_CLOUD_ORGANIZATION: "${{ inputs.tf_organization }}"
40+
TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
41+
TF_VERSION: "${{ inputs.tf_version }}"
42+
43+
jobs:
44+
template-deploy:
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Checkout the repo
48+
uses: actions/checkout@v3
49+
50+
- name: Decrypt the secrets
51+
run: |
52+
chmod +x ./scripts/transcrypt
53+
scripts/transcrypt -c aes-256-cbc -p ${{ secrets.TRANSCRYPT }} -y
54+
55+
- uses: hashicorp/setup-terraform@v2
56+
with:
57+
terraform_version: ${{ env.TF_VERSION }}
58+
terraform_wrapper: false
59+
cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
60+
61+
- name: Setup Remote Config Backend
62+
run: |
63+
cat > config.remote.tfbackend <<EOT
64+
workspaces { name = "${{ inputs.tf_workspace_name }}"}
65+
hostname = "app.terraform.io"
66+
organization = "${{ inputs.tf_organization }}"
67+
EOT
68+
69+
- name: Terraform fmt
70+
working-directory: ${{ inputs.project }}/${{ inputs.resource }}
71+
run: terraform fmt -check
72+
continue-on-error: true
73+
74+
- name: Terraform Init for ${{ inputs.project }}/${{ inputs.resource }}
75+
working-directory: ${{ inputs.project }}/${{ inputs.resource }}
76+
run: |
77+
cat config.remote.tfbackend
78+
terraform init -backend-config=config.remote.tfbackend
79+
80+
- name: Terraform Validate
81+
working-directory: ${{ inputs.project }}/${{ inputs.resource }}
82+
run: terraform validate
83+
84+
- name: Fetch and write terraform.tfvars
85+
run: |
86+
echo ${{ secrets.TF_VARS_FILE }} > terraform.tfvars
87+
chmod 600 terraform.tfvars
88+
89+
- name: Terraform Plan for ${{ inputs.project }}/${{ inputs.resource }}
90+
if: ${{ (inputs.run_destroy == 'no') }}
91+
working-directory: ${{ inputs.project }}/${{ inputs.resource }}
92+
run: |
93+
terraform plan -var-file=terraform.tfvars
94+
95+
- name: Terraform Apply for ${{ inputs.project }}/${{ inputs.resource }}
96+
if: ${{ (inputs.run_apply == 'yes') && (inputs.run_destroy == 'no') }}
97+
working-directory: ${{ inputs.project }}/${{ inputs.resource }}
98+
run: |
99+
terraform apply -auto-approve -var-file=terraform.tfvars
100+
101+
- name: Terraform Destroy for ${{ inputs.project }}/${{ inputs.resource }}
102+
if: ${{ (inputs.run_destroy == 'yes') }}
103+
working-directory: ${{ inputs.project }}/${{ inputs.resource }}
104+
run: |
105+
terraform plan -destroy -var-file=terraform.tfvars
106+
terraform destroy -auto-approve -var-file=terraform.tfvars

0 commit comments

Comments
 (0)