Terraform + Ansible Github Actions #59

Workflow file for this run

.github/workflows/deploy_production.yml at b05181a

	on:
	pull_request:
	branches:
	- main
	- staging
	#paths:
	# - 'tf/environments/production/**'
	env:
	tf_actions_working_dir: "./tf/environments/production"
	AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

	jobs:
	ansible:
	needs: terraform
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: ${{ env.tf_actions_working_dir }}/ansible
	permissions:
	pull-requests: write
	steps:
	- uses: actions/checkout@v4
	- name: Set up Python
	uses: actions/setup-python@v2
	with:
	python-version: "3.11"
	- name: Install Ansible
	run: pip install ansible

	- name: Write devops ssh key to .ssh
	run: \|
	mkdir -p ~/.ssh/
	chmod 700 ~/.ssh/
	echo "${{ secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
	chmod 600 ~/.ssh/ooni-devops-prod.pem

	- name: Run Ansible Playbook
	id: playbook
	env:
	ANSIBLE_SSH_ARGS: "-o UserKnownHostsFile=known_hosts"
	run: \|
	echo "ansible_playbook<<EOF" >> "$GITHUB_OUTPUT"
	echo "\$ ansible-playbook playbook.yml -i inventory.ini" >> "$GITHUB_OUTPUT"
	ansible-playbook playbook.yml -i inventory.ini --key-file ~/.ssh/ooni-devops-prod.pem 2>&1 \| tee -a "$GITHUB_OUTPUT"
	echo "EOF" >> "$GITHUB_OUTPUT"
	continue-on-error: true

	# This can be uncommmented to make it possible to ssh into the container to debug the run
	#- name: Setup tmate session
	# uses: mxschmitt/action-tmate@v3

	- uses: actions/github-script@v6
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const commentTitle = "Ansible Run Output";
	const ansiblePlaybookOutput = `${{ steps.playbook.outputs.ansible_playbook}}`;
	const parts = ansiblePlaybookOutput.split(/PLAY RECAP \*+/);
	const ansiblePlaybookRecap = parts.length > 1 ? parts[1].trim() : '';

	const commentBody = `
	#### Ansible Playbook Recap 🔍

	\`\`\`\n
	${ansiblePlaybookRecap}
	\`\`\`

	#### Ansible playbook output 📖\`${{ steps.playbook.outcome }}\`

	<details><summary>Show Execution</summary>

	\`\`\`\n
	${ansiblePlaybookOutput}
	\`\`\`

	</details>

	\| \| \|
	\|-------------------\|------------------------------------\|
	\| Pusher \| @${{ github.actor }} \|
	\| Action \| ${{ github.event_name }} \|
	\| Working Directory \| ${{ env.tf_actions_working_dir }} \|
	\| Workflow \| ${{ github.workflow }} \|
	\| Last updated \| ${(new Date()).toUTCString()} \|
	`;

	// Call the script to write the comment
	const script = require('./scripts/ghactions/comment-on-pr.js');
	await script({github, context, core, commentTitle, commentBody});

	terraform:
	runs-on: ubuntu-latest
	if: ${{ !startsWith(github.event.head_commit.message, 'skip-terraform:') }}
	defaults:
	run:
	working-directory: ${{ env.tf_actions_working_dir }}
	permissions:
	contents: write
	pull-requests: write
	env:
	TF_VAR_aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
	TF_VAR_aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY}}

	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 2

	- uses: hashicorp/setup-terraform@v3
	with:
	terraform_wrapper: false

	- name: Terraform fmt
	id: fmt
	run: terraform fmt -check
	continue-on-error: true

	- name: Terraform Init
	id: init
	run: terraform init

	- name: Terraform Validate
	id: validate
	run: \|
	echo "terraform_validate<<EOF" >> "$GITHUB_OUTPUT"
	echo "\$ terraform validate" >> "$GITHUB_OUTPUT"
	terraform validate -no-color \| tee -a "$GITHUB_OUTPUT"
	echo "EOF" >> "$GITHUB_OUTPUT"

	- name: Terraform Plan
	id: plan
	run: \|
	echo "terraform_plan<<EOF" >> "$GITHUB_OUTPUT"
	echo "\$ terraform plan" >> "$GITHUB_OUTPUT"
	terraform plan -no-color \| tee -a "$GITHUB_OUTPUT"
	echo "EOF" >> "$GITHUB_OUTPUT"
	continue-on-error: true

	- name: Terraform Apply
	id: apply
	run: \|
	echo "terraform_apply<<EOF" >> "$GITHUB_OUTPUT"
	echo "\$ terraform apply -auto-approve" >> "$GITHUB_OUTPUT"
	terraform apply -auto-approve -no-color \| tee -a "$GITHUB_OUTPUT"
	echo "EOF" >> "$GITHUB_OUTPUT"
	continue-on-error: true

	- uses: actions/github-script@v6
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const terraformPlanOutput = `${{ steps.plan.outputs.terraform_plan }}`;
	const terraformApplyOutput = `${{ steps.apply.outputs.terraform_apply }}`;

	const terraformPlanPlanLine = terraformPlanOutput.split('\n').find(line => line.startsWith('Plan:'));
	const terraformApplyPlanLine = terraformApplyOutput.split('\n').find(line => line.startsWith('Plan:'));
	const terraformApplyApplyLine = terraformApplyOutput.split('\n').find(line => line.startsWith('Apply complete!'));

	const commentTitle = "Terraform Run Output";
	const commentBody = `
	#### Format and Style 🖌\`${{ steps.fmt.outcome }}\`
	#### Initialization ⚙️\`${{ steps.init.outcome }}\`
	#### Validation 🤖\`${{ steps.validate.outcome }}\`
	<details><summary>Validation Output</summary>

	\`\`\`\n
	${{ steps.validate.outputs.terraform_validate }}
	\`\`\`

	</details>

	#### Plan 📖\`${{ steps.plan.outcome }}\`
	* ${terraformPlanPlanLine}

	<details><summary>Show Plan</summary>

	\`\`\`\n
	${terraformPlanOutput}
	\`\`\`

	</details>

	#### Apply 📖\`${{ steps.apply.outcome }}\`
	* ${terraformApplyPlanLine}
	* ${terraformApplyApplyLine}

	<details><summary>Show Apply</summary>

	\`\`\`\n
	${terraformApplyOutput}
	\`\`\`

	</details>

	\| \| \|
	\|-------------------\|------------------------------------\|
	\| Pusher \| @${{ github.actor }} \|
	\| Action \| ${{ github.event_name }} \|
	\| Working Directory \| ${{ env.tf_actions_working_dir }} \|
	\| Workflow \| ${{ github.workflow }} \|
	\| Last updated \| ${ (new Date()).toUTCString() } \|
	`;

	// Call the script to write the comment
	const script = require('./scripts/ghactions/comment-on-pr.js');
	await script({github, context, core, commentTitle, commentBody});

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Terraform + Ansible Github Actions #59

Workflow file

Terraform + Ansible Github Actions #59

Jobs

Run details

Workflow file for this run