deploy_production.yml

on:
  pull_request:
    branches:
      - main
      - tf-actions
    #paths:
    #  - 'tf/environments/production/**'
env:
  tf_actions_working_dir: "./tf/environments/production"
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  ansible:
    needs: terraform
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir }}/ansible
    permissions:
      pull-requests: write
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v2
      with:
        python-version: '3.11'
    - name: Install Ansible
      run: pip install ansible

    - name: Write devops ssh key to .ssh
      run: |
        mkdir -p ~/.ssh/
        chmod 700 ~/.ssh/
        echo "{{ $secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
        chmod 600 ~/.ssh/ooni-devops-prod.pem

    - name: Run Ansible Playbook
      id: playbook
      run: |
        {
          echo "ansible_playbook<<EOF"
          echo "$ anisble-playbook playbook.yml -i inventory.ini"
          ansible-playbook playbook.yml -i inventory.ini --key-file ~/.ssh/ooni-devops-prod.pem
          echo "EOF"
        } >> "$GITHUB_OUTPUT"
      continue-on-error: true

    - uses: actions/github-script@v6
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const body = `### Ansible Run Output 🤖
          #### Ansible playbook output 📖\`${{ steps.apply.outcome }}\`

          <details><summary>Show Apply</summary>

          \`\`\`\n
          ${{ steps.playbook.outputs.ansible_playbook}}
          \`\`\`

          </details>

          |                   |                                   |
          |-------------------|-----------------------------------|
          | Pusher            | @${{ github.actor }}              |
          | Action            | ${{ github.event_name }}          |
          | Working Directory | ${{ env.tf_actions_working_dir }} |
          | Workflow          | ${{ github.workflow }}            |
          | Last updated      | ${(new Date()).toUTCString()}     |
          `;

          const prNumber = context.payload.pull_request.number

          if (prNumber) {
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
            })
            const existingBotComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('### Ansible Run Output')
            })

            if (existingBotComment) {
              github.rest.issues.updateComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingBotComment.id,
                body
              })
            } else {
              github.rest.issues.createComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body
              })
            }
          }

  terraform:
    runs-on: ubuntu-latest
    if: ${{ !startsWith(github.event.head_commit.message, 'skip-terraform:') }}
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir }}
    permissions:
      contents: write
      pull-requests: write
    env:
      TF_VAR_aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      TF_VAR_aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY}}

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 2

    - uses: hashicorp/setup-terraform@v3
      with:
        terraform_wrapper: false

    - name: Terraform fmt
      id: fmt
      run: terraform fmt -check
      continue-on-error: true

    - name: Terraform Init
      id: init
      run: terraform init

    - name: Terraform Validate
      id: validate
      run: |
        {
          echo "terraform_validate<<EOF"
          terraform validate -no-color
          echo "EOF"
        } >> "$GITHUB_OUTPUT"

    - name: Terraform Plan
      id: plan
      run: |
        {
          echo "terraform_plan<<EOF"
          echo "$ terraform plan"
          terraform plan -no-color
          echo "EOF"
        } >> "$GITHUB_OUTPUT"
      continue-on-error: true

    - name: Terraform Apply
      id: apply
      run: |
        {
          echo "terraform_apply<<EOF"
          echo "$ terraform apply -auto-approve"
          terraform apply -auto-approve -no-color
          echo "EOF"
        } >> "$GITHUB_OUTPUT"
      continue-on-error: true

    # TODO(art): this should only run on master merge
    #- name: Commit and Push Terraform Outputs
    #  id: commit
    #  run: |
    #    {
    #      echo "git_commit<<EOF"
    #      git config --global user.email "nothuman@ooni.org"
    #      git config --global user.name "OONI Github Actions Bot"
    #      git add .
    #      git commit -m "skip-terraform: autoupdate terraform outputs" || echo "No changes to commit"
    #      git push origin HEAD:${{ github.event.pull_request && github.head_ref || github.ref_name }}
    #      echo "EOF"
    #    } >> "$GITHUB_OUTPUT"
    #  env:
    #    GITHUB_REF: ${{ github.ref }}
    #    GITHUB_HEAD_REF: ${{ github.head_ref }}
    #  continue-on-error: true

    - uses: actions/github-script@v6
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const body = `### Terraform Run Output 🤖
          #### Format and Style 🖌\`${{ steps.fmt.outcome }}\`
          #### Initialization ⚙️\`${{ steps.init.outcome }}\`
          #### Validation 🤖${{ steps.validate.outcome }}\`
          <details><summary>Validation Output</summary>

          \`\`\`\n
          ${{ steps.validate.outputs.terraform_validate }}
          \`\`\`

          </details>

          #### Plan 📖\`${{ steps.plan.outcome }}\`

          <details><summary>Show Plan</summary>

          \`\`\`\n
          ${{ steps.plan.outputs.terraform_plan }}
          \`\`\`

          </details>

          #### Apply 📖\`${{ steps.apply.outcome }}\`

          <details><summary>Show Apply</summary>

          \`\`\`\n
          ${{ steps.apply.outputs.terraform_apply }}
          \`\`\`

          </details>

          |                   |                                   |
          |-------------------|-----------------------------------|
          | Pusher            | @${{ github.actor }}              |
          | Action            | ${{ github.event_name }}          |
          | Working Directory | ${{ env.tf_actions_working_dir }} |
          | Workflow          | ${{ github.workflow }}            |
          | Last updated      | ${(new Date()).toUTCString()}     |
          `;

          const prNumber = context.payload.pull_request.number

          if (prNumber) {
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
            })
            const existingBotComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('### Terraform Run Output')
            })

            if (existingBotComment) {
              github.rest.issues.updateComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingBotComment.id,
                body
              })
            } else {
              github.rest.issues.createComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body
              })
            }
          }