example.yml

---
name: example
on:
  push:
    branches:
      - main
      - feature/*
    paths:
      - 'teams/example/**'
      - '.github/workflows/example.yml'
  pull_request:
    branches:
      - main
    types: [opened, edited, reopened, synchronize]
    paths:
      - 'teams/example/**'
      - '.github/workflows/example.yml'
  workflow_dispatch:
env:
  AWS_REGION: "eu-west-2"
  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}
  TF_IN_AUTOMATION: true
defaults:
  run:
    shell: bash

permissions: {}

jobs:
  plan-example:
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read # This is required for actions/checkout
    name: Plan - example pipelines
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - name: Load and Configure Terraform
        uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
        with:
          terraform_version: 1.0.1
          terraform_wrapper: false
      - name: Terraform plan - example pipelines
        run: |
          echo "Terraform plan - ${TF_ENV}"
          bash scripts/terraform-init.sh teams/example
          terraform -chdir="teams/example" workspace select "core-shared-services-${TF_ENV}"
          bash scripts/terraform-plan.sh teams/example
        env:
          TF_ENV: production

  deploy-example:
    name: Deploy - example pipelines
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read # This is required for actions/checkout
    needs: plan-example
    runs-on: ubuntu-latest
    environment:
      name: core-shared-services
    steps:
      - name: Checkout Repository
        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}
      - name: Load and Configure Terraform
        uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
        with:
          terraform_version: 1.0.1
          terraform_wrapper: false
      - name: Terraform apply - example pipelines
        run: |
          echo "Terraform apply - ${TF_ENV}"
          bash scripts/terraform-init.sh teams/example
          terraform -chdir="teams/example" workspace select "core-shared-services-${TF_ENV}"
          bash scripts/terraform-apply.sh teams/example
        env:
          TF_ENV: production