Skip to content
.github/workflows/deploy_production.yml

Terraform + Ansible Github Actions #41

Sign in to view logs

Terraform + Ansible Github Actions

Terraform + Ansible Github Actions #41

Workflow file for this run

.github/workflows/deploy_production.yml at 7c94ff0
on:
pull_request:
branches:
- main
- tf-actions
#paths:
# - 'tf/environments/production/**'
env:
tf_actions_working_dir: "./tf/environments/production"
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
jobs:
ansible:
needs: terraform
runs-on: ubuntu-latest
defaults:
run:
working-directory: ${{ env.tf_actions_working_dir }}/ansible
permissions:
pull-requests: write
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: '3.11'
- name: Install Ansible
run: pip install ansible
- name: Write devops ssh key to .ssh
run: |
mkdir -p ~/.ssh/
chmod 700 ~/.ssh/
echo "${{ secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
chmod 600 ~/.ssh/ooni-devops-prod.pem
- name: Run Ansible Playbook
id: playbook
env:
# TODO(art): write a known_hosts file from terraform to avoid this
ANSIBLE_HOST_KEY_CHECKING: "False"
run: |
echo "ansible_playbook<<EOF" >> "$GITHUB_OUTPUT"
echo "\$ ansible-playbook playbook.yml -i inventory.ini" >> "$GITHUB_OUTPUT"
ansible-playbook playbook.yml -i inventory.ini --key-file ~/.ssh/ooni-devops-prod.pem 2>&1 | tee -a "$GITHUB_OUTPUT"
echo "EOF" >> "$GITHUB_OUTPUT"
continue-on-error: true
#- name: Setup tmate session
# uses: mxschmitt/action-tmate@v3
- uses: actions/github-script@v6
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const script = require('./scripts/ghactions/comment-on-pr.js');
const commentTitle = "Ansible Run Output";
const commentBody = `
#### Ansible playbook output 📖\`${{ steps.apply.outcome }}\`
<details><summary>Show Apply</summary>
\`\`\`\n
${{ steps.playbook.outputs.ansible_playbook}}
\`\`\`
</details>
| | |
|-------------------|-----------------------------------|
| Pusher | @${{ github.actor }} |
| Action | ${{ github.event_name }} |
| Working Directory | ${{ env.tf_actions_working_dir }} |
| Workflow | ${{ github.workflow }} |
| Last updated | ${(new Date()).toUTCString()} |
`;
await script({github, context, core, commentTitle, commentBody});
terraform:
runs-on: ubuntu-latest
if: ${{ !startsWith(github.event.head_commit.message, 'skip-terraform:') }}
defaults:
run:
working-directory: ${{ env.tf_actions_working_dir }}
permissions:
contents: write
pull-requests: write
env:
TF_VAR_aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
TF_VAR_aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY}}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- uses: hashicorp/setup-terraform@v3
with:
terraform_wrapper: false
- name: Terraform fmt
id: fmt
run: terraform fmt -check
continue-on-error: true
- name: Terraform Init
id: init
run: terraform init
- name: Terraform Validate
id: validate
run: |
{
echo "terraform_validate<<EOF"
terraform validate -no-color
echo "EOF"
} >> "$GITHUB_OUTPUT"
- name: Terraform Plan
id: plan
run: |
{
echo "terraform_plan<<EOF"
echo "$ terraform plan"
terraform plan -no-color
echo "EOF"
} >> "$GITHUB_OUTPUT"
continue-on-error: true
- name: Terraform Apply
id: apply
run: |
{
echo "terraform_apply<<EOF"
echo "$ terraform apply -auto-approve"
terraform apply -auto-approve -no-color
echo "EOF"
} >> "$GITHUB_OUTPUT"
continue-on-error: true
# TODO(art): this should only run on master merge
#- name: Commit and Push Terraform Outputs
# id: commit
# run: |
# {
# echo "git_commit<<EOF"
# git config --global user.email "[email protected]"
# git config --global user.name "OONI Github Actions Bot"
# git add .
# git commit -m "skip-terraform: autoupdate terraform outputs" || echo "No changes to commit"
# git push origin HEAD:${{ github.event.pull_request && github.head_ref || github.ref_name }}
# echo "EOF"
# } >> "$GITHUB_OUTPUT"
# env:
# GITHUB_REF: ${{ github.ref }}
# GITHUB_HEAD_REF: ${{ github.head_ref }}
# continue-on-error: true
- uses: actions/github-script@v6
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const script = require('./scripts/ghactions/comment-on-pr.js');
const commentTitle = "Terraform Run Output";
const commentBody = `
#### Format and Style 🖌\`${{ steps.fmt.outcome }}\`
#### Initialization ⚙️\`${{ steps.init.outcome }}\`
#### Validation 🤖${{ steps.validate.outcome }}\`
<details><summary>Validation Output</summary>
\`\`\`\n
${{ steps.validate.outputs.terraform_validate }}
\`\`\`
</details>
#### Plan 📖\`${{ steps.plan.outcome }}\`
<details><summary>Show Plan</summary>
\`\`\`\n
${{ steps.plan.outputs.terraform_plan }}
\`\`\`
</details>
#### Apply 📖\`${{ steps.apply.outcome }}\`
<details><summary>Show Apply</summary>
\`\`\`\n
${{ steps.apply.outputs.terraform_apply }}
\`\`\`
</details>
| | |
|-------------------|-----------------------------------|
| Pusher | @${{ github.actor }} |
| Action | ${{ github.event_name }} |
| Working Directory | ${{ env.tf_actions_working_dir }} |
| Workflow | ${{ github.workflow }} |
| Last updated | ${(new Date()).toUTCString()} |
`;
await script({github, context, core, commentTitle, commentBody});