workflow_destroy_on_merge.yml

name: "[Workflow] Destroy ephemeral environment"

permissions:
  contents: read
  security-events: none
  pull-requests: read
  actions: none
  checks: none
  deployments: none
  issues: none
  packages: none
  repository-projects: none
  statuses: none

defaults:
  run:
    shell: bash

on:
  pull_request:
    branches:
      - main
    types:
      - closed
    paths:
      - "service-*/**"
      - "terraform/**"
      - "scripts/**"
      - ".github/workflows/**"

jobs:
  workspace_name:
    uses: ministryofjustice/opg-github-workflows/.github/workflows/data-parse-workspace.yml@bd6ac6106a4adda64cecefa3632fb64ab0ddab4b # v1.36.0
    if: github.event.pull_request.merged == true

  cleanup_workspace:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    needs:
      - workspace_name
    steps:
      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Get terraform version
        id: set-terraform-version
        uses: ministryofjustice/opg-github-actions/.github/actions/terraform-version@v2.7.3
        with:
          terraform_directory: "./terraform/environment"

      - uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # tag=v2.0.3
        with:
          terraform_version: ${{ steps.set-terraform-version.outputs.version }}
          terraform_wrapper: false

      - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
        with:
          ssh-private-key: ${{ secrets.USE_AN_LPA_DEPLOY_KEY_PRIVATE_KEY }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_ACTIONS }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_ACTIONS }}
          aws-region: eu-west-1
          role-duration-seconds: 900
          role-session-name: OPGLPADestroyEphemeralEnvironment

      - name: set pagerduty token
        run: |
          export TF_VAR_pagerduty_token=$(aws secretsmanager get-secret-value --secret-id \
            pagerduty_api_key --region eu-west-1 | jq -r '.SecretString' 2>/dev/null)
          echo "::add-mask::$TF_VAR_pagerduty_token"
          echo TF_VAR_pagerduty_token=$TF_VAR_pagerduty_token >> $GITHUB_ENV

      - name: Run workspace cleanup
        working-directory: ./terraform/environment
        env:
          TF_VAR_pagerduty_token: ${{ env.TF_VAR_pagerduty_token }}
        run: |
          ../../scripts/pipeline/workspace_cleanup/destroy_workspace.sh ${{ needs.workspace_name.outputs.name }}