Skip to content

Commit 69ef4f3

Browse files
andhreljaKernandhreljaKern
committed
perf: add tf_plan_apply_gh
1 parent bf1bfa9 commit 69ef4f3

File tree

1 file changed

+133
-0
lines changed

1 file changed

+133
-0
lines changed

‎.github/workflows/tf_plan_apply_gh.yml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: 'OpenTofu: Plan/Apply'
2+
3+
on:
4+
workflow_call:
5+
outputs:
6+
tf_plan_exit_code:
7+
description: 'OpenTofu Plan exit code'
8+
value: ${{ jobs.tofu-plan.outputs.tf_plan_exit_code }}
9+
tf_destroy:
10+
description: 'Destroy flag'
11+
value: ${{ jobs.tofu-plan.outputs.tf_destroy }}
12+
13+
# Special permissions required for OIDC authentication
14+
permissions:
15+
id-token: write
16+
contents: read
17+
pull-requests: write
18+
19+
env:
20+
GH_TOKEN: ${{ secrets.GH_TOKEN }}
21+
22+
jobs:
23+
tofu-plan:
24+
name: 'OpenTofu Plan'
25+
runs-on: ubuntu-latest
26+
environment: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.ref_name }}
27+
env:
28+
ENVIRONMENT_NAME: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.ref_name }}
29+
#this is needed since we are running tofu with read-only permissions
30+
# ARM_SKIP_PROVIDER_REGISTRATION: true
31+
ARM_CLIENT_ID: "${{ secrets.AZURE_CLIENT_ID }}"
32+
ARM_SUBSCRIPTION_ID: "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
33+
ARM_TENANT_ID: "${{ secrets.AZURE_TENANT_ID }}"
34+
ARM_USE_OIDC: true
35+
TF_DESTROY: "${{ vars.TF_DESTROY }}"
36+
outputs:
37+
tf_plan_exit_code: ${{ steps.tf-plan.outputs.exitcode }}
38+
tf_destroy: ${{ steps.tf-plan.outputs.tf_destroy }}
39+
40+
steps:
41+
# Checkout the repository to the GitHub Actions runner
42+
- name: Checkout
43+
uses: actions/checkout@v4
44+
with:
45+
token: ${{ secrets.GH_TOKEN }}
46+
47+
# Install the latest version of the OpenTofu CLI
48+
- name: Setup OpenTofu
49+
uses: opentofu/setup-opentofu@v1
50+
with:
51+
tofu_wrapper: false
52+
53+
# Initialize a new or existing OpenTofu working directory by creating initial files, loading any remote state, downloading modules, etc.
54+
- name: OpenTofu Init
55+
run: |
56+
tofu init \
57+
-backend-config="resource_group_name=${{ env.ENVIRONMENT_NAME }}-tf-azure-admin" \
58+
-backend-config="storage_account_name=${{ env.ENVIRONMENT_NAME }}kernaiadmin" \
59+
-backend-config="container_name=tfstate" \
60+
-backend-config="key=${{ github.event.repository.name }}/${{ env.ENVIRONMENT_NAME }}.tfstate"
61+
62+
# Generates an execution plan for OpenTofu
63+
# An exit code of 0 indicated no changes, 1 a tofu failure, 2 there are pending changes.
64+
- name: OpenTofu Plan
65+
id: tf-plan
66+
run: |
67+
export exitcode=0
68+
69+
tofu plan ${{ env.TF_DESTROY }} \
70+
-detailed-exitcode \
71+
-var-file vars-${{ env.ENVIRONMENT_NAME }}.tfvars \
72+
-out tfplan || export exitcode=$?
73+
74+
echo "exitcode=$exitcode" >> $GITHUB_OUTPUT
75+
echo "tf_destroy=${{ env.TF_DESTROY }}" >> $GITHUB_OUTPUT
76+
77+
if [ $exitcode -eq 1 ]; then
78+
echo OpenTofu Plan Failed!
79+
exit 1
80+
else
81+
exit 0
82+
fi
83+
84+
# Save plan to artifacts
85+
- name: Publish OpenTofu Plan
86+
if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.merged }}
87+
uses: actions/upload-artifact@v4
88+
with:
89+
name: tfplan
90+
path: tfplan
91+
92+
tofu-apply:
93+
name: 'OpenTofu Apply'
94+
needs: [tofu-plan]
95+
if: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.merged) && needs.tofu-plan.outputs.tf_plan_exit_code == 2 }}
96+
runs-on: ubuntu-latest
97+
environment: ${{ github.ref_name }}
98+
env:
99+
ENVIRONMENT_NAME: ${{ github.ref_name }}
100+
#this is needed since we are running tofu with read-only permissions
101+
# ARM_SKIP_PROVIDER_REGISTRATION: true
102+
ARM_CLIENT_ID: "${{ secrets.AZURE_CLIENT_ID }}"
103+
ARM_SUBSCRIPTION_ID: "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
104+
ARM_TENANT_ID: "${{ secrets.AZURE_TENANT_ID }}"
105+
ARM_USE_OIDC: true
106+
TF_DESTROY: "${{ vars.TF_DESTROY }}"
107+
steps:
108+
# Checkout the repository to the GitHub Actions runner
109+
- name: Checkout
110+
uses: actions/checkout@v4
111+
112+
# Install the latest version of OpenTofu CLI and configure the OpenTofu CLI configuration file with a OpenTofu Cloud user API token
113+
- name: Setup OpenTofu
114+
uses: opentofu/setup-opentofu@v1
115+
116+
# Initialize a new or existing OpenTofu working directory by creating initial files, loading any remote state, downloading modules, etc.
117+
- name: OpenTofu Init
118+
run: |
119+
tofu init \
120+
-backend-config="resource_group_name=${{ env.ENVIRONMENT_NAME }}-tf-azure-admin" \
121+
-backend-config="storage_account_name=${{ env.ENVIRONMENT_NAME }}kernaiadmin" \
122+
-backend-config="container_name=tfstate" \
123+
-backend-config="key=${{ github.event.repository.name }}/${{ github.ref_name }}.tfstate"
124+
125+
# Download saved plan from artifacts
126+
- name: Download OpenTofu Plan
127+
uses: actions/download-artifact@v4
128+
with:
129+
name: tfplan
130+
131+
# OpenTofu Apply
132+
- name: OpenTofu Apply
133+
run: tofu apply ${{ env.TF_DESTROY }} -auto-approve tfplan

0 commit comments

Comments
 (0)