Skip to content

Commit 70624dd

Browse files
stwalkersterstwalkerster
committed
Add CICD to run OpenTofu
1 parent 506fe80 commit 70624dd

File tree

3 files changed

+140
-9
lines changed

3 files changed

+140
-9
lines changed

‎.github/workflows/deploy.yml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Deploy to Production
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
id-token: write # required for AWS OIDC
12+
13+
jobs:
14+
apply:
15+
environment: Production
16+
timeout-minutes: 60
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout Git Repository
20+
uses: actions/checkout@v4
21+
with:
22+
fetch-depth: 0
23+
24+
- name: Setup OpenTofu
25+
uses: opentofu/setup-opentofu@v1
26+
with:
27+
tofu_version: 1.8.6
28+
29+
- name: Configure AWS Credentials
30+
uses: aws-actions/configure-aws-credentials@v4
31+
with:
32+
aws-region: us-east-1
33+
role-to-assume: ${{ secrets.BACKEND_ROLE }}
34+
35+
- name: OpenTofu init
36+
run: |
37+
tofu init \
38+
-backend-config="bucket=${{ secrets.BACKEND_BUCKET }}" \
39+
-backend-config="dynamodb_table=${{ secrets.BACKEND_DDB_TABLE }}"
40+
41+
- name: OpenTofu validate
42+
run: tofu validate
43+
44+
- name: OpenTofu plan
45+
env:
46+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
47+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
48+
# Legacy, pending new provider version
49+
TF_VAR_application_credential_id: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
50+
TF_VAR_application_credential_secret: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
51+
run: tofu plan -out tfplan
52+
53+
# - name: OpenTofu apply
54+
# env:
55+
# OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
56+
# OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
57+
# # Legacy, pending new provider version
58+
# TF_VAR_application_credential_id: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
59+
# TF_VAR_application_credential_secret: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
60+
# run: tofu apply tfplan

‎.github/workflows/pr.yml

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: Run plan for PR
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- master
7+
8+
permissions:
9+
contents: read
10+
id-token: write # required for AWS OIDC
11+
pull-requests: write # required for writing the PR comment
12+
13+
jobs:
14+
plan:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 15
17+
steps:
18+
- name: Checkout Git Repository
19+
uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0
22+
23+
- name: Setup OpenTofu
24+
uses: opentofu/setup-opentofu@v1
25+
with:
26+
tofu_version: 1.8.6
27+
28+
- name: Configure AWS Credentials
29+
uses: aws-actions/configure-aws-credentials@v4
30+
with:
31+
aws-region: us-east-1
32+
role-to-assume: ${{ secrets.BACKEND_ROLE }}
33+
34+
- name: OpenTofu init
35+
run: |
36+
tofu init \
37+
-backend-config="bucket=${{ secrets.BACKEND_BUCKET }}" \
38+
-backend-config="dynamodb_table=${{ secrets.BACKEND_DDB_TABLE }}"
39+
40+
- name: OpenTofu validate
41+
run: tofu validate
42+
43+
- name: OpenTofu plan
44+
env:
45+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
46+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
47+
# Legacy, pending new provider version
48+
TF_VAR_application_credential_id: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
49+
TF_VAR_application_credential_secret: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
50+
run: tofu plan -out tfplan
51+
52+
- name: Get plan output for PR comment
53+
id: plan
54+
run: tofu show -no-color tfplan
55+
56+
- name: Update Pull Request
57+
uses: actions/github-script@v7
58+
with:
59+
github-token: ${{ secrets.GITHUB_TOKEN }}
60+
script: |
61+
const output = `<details><summary>Show OpenTofu Plan</summary>
62+
63+
\`\`\`\n
64+
${{ steps.plan.outputs.stdout }}
65+
\`\`\`
66+
67+
</details>
68+
69+
*Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;
70+
71+
github.rest.issues.createComment({
72+
issue_number: context.issue.number,
73+
owner: context.repo.owner,
74+
repo: context.repo.repo,
75+
body: output
76+
})

‎oauth.tf

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,7 @@ resource "openstack_dns_recordset_v2" "prod_instance" {
2626
}
2727

2828
module "bluegreen" {
29-
source = "app.terraform.io/enwikipedia-acc/bluegreen/openstack"
30-
version = "0.2.0"
29+
source = "github.com/enwikipedia-acc/terraform-openstack-bluegreen?ref=0.2.0"
3130

3231
blue_dns_name = "${local.blue_resource_prefix}.${data.openstack_dns_zone_v2.rootzone.name}"
3332
green_dns_name = "${local.green_resource_prefix}.${data.openstack_dns_zone_v2.rootzone.name}"
@@ -36,10 +35,8 @@ module "bluegreen" {
3635
}
3736

3837
module "oauth-server-blue" {
39-
source = "app.terraform.io/enwikipedia-acc/mediawiki-oauth/openstack"
40-
version = "0.13.0"
41-
#source = "github.com/enwikipedia-acc/terraform-openstack-mediawiki-oauth"
42-
38+
source = "github.com/enwikipedia-acc/terraform-openstack-mediawiki-oauth?ref=0.13.0"
39+
4340
environment = "b"
4441
count = module.bluegreen.blue_count
4542

@@ -64,9 +61,7 @@ module "oauth-server-blue" {
6461
}
6562

6663
module "oauth-server-green" {
67-
source = "app.terraform.io/enwikipedia-acc/mediawiki-oauth/openstack"
68-
version = "0.15.0"
69-
#source = "github.com/enwikipedia-acc/terraform-openstack-mediawiki-oauth"
64+
source = "github.com/enwikipedia-acc/terraform-openstack-mediawiki-oauth?ref=0.15.0"
7065

7166
environment = "g"
7267
count = module.bluegreen.green_count

0 commit comments

Comments
 (0)