fix: workflow adjustments

furiousme · Sep 30, 2024 · 1015698 · 1015698
1 parent 5fef889
commit 1015698
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 25 deletions.
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
@@ -1,6 +1,13 @@
 name: Terraform Workflow
 
+permissions:
+  id-token: write
+  contents: read
+
 on:
+  push:
+    branches:
+      - main
   pull_request:
     branches:
       - main
@@ -9,32 +16,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_version: 1.9.6
+        uses: actions/checkout@v4
 
-      - name: Terraform Format Check
-        run: terraform fmt -check
-  terraform-plan:
-    runs-on: ubuntu-latest
-    needs: terraform-check
-    permissions:
-      id-token: write
-      contents: read
-    steps:
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v2
         with:
           terraform_version: 1.9.6
-
+      
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/GithubActionsRole
           aws-region: us-east-1
+          role-duration-seconds: 1200
 
       - name: Terraform Init
         run: terraform init
@@ -43,21 +37,17 @@ jobs:
         run: terraform plan
   terraform-apply:
     runs-on: ubuntu-latest
-    needs: terraform-plan
-    permissions:
-      id-token: write
-      contents: read
-    if: github.ref == 'refs/heads/main'
     steps:
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.9.6
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/GithubActionsRole
+          role-duration-seconds: 1200
           aws-region: us-east-1
 
       - name: Terraform Init

diff --git a/main.tf b/main.tf
@@ -11,9 +11,11 @@ resource "aws_iam_role" "github_actions_role" {
           Federated : "arn:aws:iam::${var.account_id}:oidc-provider/token.actions.githubusercontent.com"
         },
         Condition = {
-          StringEquals = {
-            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com",
-            "token.actions.githubusercontent.com:sub" : "repo:${var.gh_username}/rsschool-devops-course-tasks:ref:refs/heads/main"
+          StringLike : {
+            "token.actions.githubusercontent.com:sub" : "repo:${var.gh_username}/rsschool-devops-course-tasks:*"
+          },
+          StringEquals : {
+            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
           }
         }
       },