diff --git a/.github/workflows/gitops.yml b/.github/workflows/gitops.yml new file mode 100644 index 0000000..682dfcf --- /dev/null +++ b/.github/workflows/gitops.yml @@ -0,0 +1,146 @@ +name: GitOps Implementation +on: + pull_request: + branches: + - master + push: + branches: + - master + workflow_dispatch: +defaults: + run: + working-directory: ./tf-variables/ +env: + TERRAFORM_VER: 1.8.0 + TERRAFORM_DIR: "./tf-variables/" + CLOUDSDK_VER: 480.0.0 +permissions: + pull-requests: write +jobs: + infrastructure-deployment: + name: Infrastructure Deployment + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + pull-requests: write + steps: + # Checkout the repository code + - name: Code checkout + id: code_checkout + uses: actions/checkout@v2 + + # Scan the repo for any sensitive information like secrets etc + - name: Secret Scanning + uses: trufflesecurity/trufflehog@main + with: + path: ./ # Code repository path + base: main # Start scanning from here (usually main branch). + head: HEAD # Scan commits until here (usually dev branch). + + # Static code analysis using aqua security's tfsec + - name: Run tfsec scan + id: static_code_analysis + uses: aquasecurity/tfsec-action@v1.0.3 + with: + working_directory: ${{ env.TERRAFORM_DIR }} + + # Install the latest version of Google Cloud SDK + - id: cloud_sdk_installation + name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@v0.3.0 + with: + version: ${{ env.CLOUDSDK_VER }} + + # Setup the authentication for the Google Cloud using WIF + - id: gcp_auth + name: Authenticate to GCP + uses: google-github-actions/auth@v0.3.1 + with: + create_credentials_file: 'true' + workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER_ID }} + service_account: ${{ secrets.SERVICE_ACCOUNT }} + + # Install the specified version of Terraform CLI + - id: tf_installation + name: Terraform Installation + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: ${{ env.TERRAFORM_VER }} + + # Checks that Terraform configuration files adhere to a canonical format + - name: Terraform fmt + id: tf_fmt + run: terraform fmt -check + continue-on-error: true + + # Initialize the Terraform working directory + - name: Terraform Init + id: tf_init + run: terraform init + + # Validate the terraform configuration files + - name: Terraform Validate + id: tf_validate + run: terraform validate -no-color + + # Generates an execution plan for Terraform + - name: Terraform Plan + id: tf_plan + run: terraform plan -no-color + continue-on-error: true + + # Comments the terraform plan output on pull request + - id: comment_output + name: Comment Terraform Plan Output + uses: actions/github-script@v7 + if: github.event_name == 'pull_request' + env: + PLAN: "terraform\n${{ steps.plan.outputs.stdout }}" + with: + script: | + const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\` + #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\` + #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\` +
Validation Output + + \`\`\`\n + ${{ steps.validate.outputs.stdout }} + \`\`\` + +
+ + #### Terraform Plan 📖\`${{ steps.plan.outcome }}\` + +
Show Plan + + \`\`\`\n + ${process.env.PLAN} + \`\`\` + +
+ + *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`; + + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: output + }) + + # Executes the apply operation to deploy the actual infrastructure + - name: Terraform Apply + id: tf_apply + if: github.ref == 'refs/heads/"master"' && github.event_name == 'push' + run: terraform apply -auto-approve + + - name: Notify success + if: success() # this step runs only if the previous steps succeeded. + run: echo "[SUCCESS] The build is successful without any errors." + + - name: Notify failure + if: failure() # this step runs only if any of the previous steps failed. + run: | + echo "[FAILED] This job has been failed due to earlier errors." + echo "An eamil notification can be setup later sometime." diff --git a/tf-variables/providers.tf b/tf-variables/providers.tf.bkp similarity index 100% rename from tf-variables/providers.tf rename to tf-variables/providers.tf.bkp