-
Notifications
You must be signed in to change notification settings - Fork 4
94 lines (81 loc) · 3.22 KB
/
workflow_destroy_on_merge.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: "[Workflow] Destroy ephemeral environment"
permissions:
contents: read
security-events: none
pull-requests: read
actions: none
checks: none
deployments: none
issues: none
packages: none
repository-projects: none
statuses: none
defaults:
run:
shell: bash
on:
pull_request:
branches:
- main
types:
- closed
paths:
- "service-*/**"
- "terraform/**"
- "scripts/**"
- ".github/workflows/**"
jobs:
workspace_name:
uses: ministryofjustice/opg-github-workflows/.github/workflows/data-parse-workspace.yml@383650d409aad063a69ce6cc3a013ac538cc1508
if: github.event.pull_request.merged == true
cleanup_workspace:
if: github.event.pull_request.merged == true
runs-on: ubuntu-latest
needs:
- workspace_name
steps:
- name: Checkout
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Set terraform version
id: set-terraform-version
uses: ministryofjustice/opg-github-actions/.github/actions/[email protected]
with:
terraform_directory: "./terraform/environment"
terraform_versions_file: ".terraform-version"
simple_file: true
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
with:
terraform_version: ${{ steps.set-terraform-version.outputs.version }}
terraform_wrapper: false
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
with:
ssh-private-key: ${{ secrets.USE_AN_LPA_DEPLOY_KEY_PRIVATE_KEY }}
- name: configure AWS credentials for getting pagerduty token
uses: aws-actions/configure-aws-credentials@a70163716ac95dea0bf269be9aff669ad6a933c5 # [email protected]
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_ACTIONS }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_ACTIONS }}
role-to-assume: arn:aws:iam::367815980639:role/opg-use-an-lpa-ci
aws-region: eu-west-1
role-duration-seconds: 1800
role-session-name: OPGUseAnLPADevAssumeGithubAction
- name: set pagerduty token
run: |
export TF_VAR_pagerduty_token=$(aws secretsmanager get-secret-value --secret-id \
pagerduty_api_key --region eu-west-1 | jq -r '.SecretString' 2>/dev/null)
echo "::add-mask::$TF_VAR_pagerduty_token"
echo TF_VAR_pagerduty_token=$TF_VAR_pagerduty_token >> $GITHUB_ENV
- name: configure AWS credentials for terraform
uses: aws-actions/configure-aws-credentials@a70163716ac95dea0bf269be9aff669ad6a933c5 # [email protected]
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_ACTIONS }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_ACTIONS }}
aws-region: eu-west-1
role-duration-seconds: 3600
role-session-name: OPGUseAnLPATerraformGithubAction
- name: Run workspace cleanup
working-directory: ./terraform/environment
env:
TF_VAR_pagerduty_token: ${{ env.TF_VAR_pagerduty_token }}
run: |
../../scripts/pipeline/workspace_cleanup/destroy_workspace.sh ${{ needs.workspace_name.outputs.name }}