deploy_production.yml

on:
  pull_request:
    branches:
      - main
      - tf-actions
    #paths:
    #  - 'tf/environments/production/**'
env:
  tf_actions_working_dir: "./tf/environments/production"
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  ansible:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir }}
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v2
      with:
        python-version: '3.11'
    - name: Install Ansible
      run: pip install ansible
    # TODO(art): need to finish setting it up so that the SSH keys are
    # provisioned to the host
    #- name: Run Ansible Playbook
    #  run: ansible-playbook ansible/playbook.yml -i inventory.ini

  terraform:
    runs-on: ubuntu-latest
    if: ${{ !startsWith(github.event.head_commit.message, 'skip-terraform:') }}
    defaults:
      run:
        working-directory: ${{ env.tf_actions_working_dir }}

    permissions:
      contents: write
      pull-requests: write
    env:
      TF_VAR_aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      TF_VAR_aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY}}

    steps:
    - uses: actions/checkout@v4
    - uses: hashicorp/setup-terraform@v3
      with:
        terraform_wrapper: false

    - name: Terraform fmt
      id: fmt
      run: terraform fmt -check
      continue-on-error: true

    - name: Terraform Init
      id: init
      run: terraform init

    - name: Terraform Validate
      id: validate
      run: |
        echo "terraform_validate<<EOF" >> "$GITHUB_OUTPUT"
        terraform validate -no-color >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"

    - name: Terraform Plan
      id: plan
      run: |
        echo "terraform_plan<<EOF" >> "$GITHUB_OUTPUT"
        echo "$ terraform plan" >> "$GITHUB_OUTPUT"
        terraform plan -no-color >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"
      continue-on-error: true

    - name: Terraform Apply
      id: apply
      run: |
        echo "terraform_apply<<EOF" >> "$GITHUB_OUTPUT"
        echo "$ terraform apply -auto-approve" >> "$GITHUB_OUTPUT"
        terraform apply -auto-approve -no-color >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"
      continue-on-error: true

    - name: Commit and Push Terraform Outputs
      id: commit
      run: |
        echo "git_commit<<EOF" >> "$GITHUB_OUTPUT"
        git config --global user.email "nothuman@ooni.org"
        git config --global user.name "OONI Github Actions Bot"
        git add . >> "$GITHUB_OUTPUT"
        git commit -m "skip-terraform: autoupdate terraform outputs" || echo "No changes to commit" >> "$GITHUB_OUTPUT"
        BRANCH_NAME="${GITHUB_REF#refs/heads/}"
        git push -u origin "${BRANCH_NAME}" >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"
      env:
        GITHUB_REF: ${{ github.ref }}
        GITHUB_HEAD_REF: ${{ github.head_ref }}
      continue-on-error: true

    - uses: actions/github-script@v6
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const body = `### Terraform Run Output 🤖
          #### Format and Style 🖌\`${{ steps.fmt.outcome }}\`
          #### Initialization ⚙️\`${{ steps.init.outcome }}\`
          #### Validation 🤖${{ steps.validate.outcome }}\`
          <details><summary>Validation Output</summary>

          \`\`\`\n
          ${{ steps.validate.outputs.terraform_validate }}
          \`\`\`

          </details>

          #### Plan 📖\`${{ steps.plan.outcome }}\`

          <details><summary>Show Plan</summary>

          \`\`\`\n
          ${{ steps.plan.outputs.terraform_plan }}
          \`\`\`

          </details>

          #### Apply 📖\`${{ steps.apply.outcome }}\`

          <details><summary>Show Apply</summary>

          \`\`\`\n
          ${{ steps.apply.outputs.terraform_apply }}
          \`\`\`

          </details>

          #### Commit \`${{ steps.apply.outcome }}\`

          <details><summary>Show Commit</summary>

          \`\`\`\n
          ${{ steps.commit.outputs.git_commit }}
          \`\`\`

          </details>

          |                   |                                   |
          |-------------------|-----------------------------------|
          | Pusher            | @${{ github.actor }}              |
          | Action            | ${{ github.event_name }}          |
          | Working Directory | ${{ env.tf_actions_working_dir }} |
          | Workflow          | ${{ github.workflow }}            |
          | Last updated      | ${(new Date()).toUTCString()}     |
          `;

          const prNumber = context.payload.pull_request.number

          if (prNumber) {
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
            })
            const existingBotComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('### Terraform Run Output')
            })

            if (existingBotComment) {
              github.rest.issues.updateComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingBotComment.id,
                body
              })
            } else {
              github.rest.issues.createComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body
              })
            }
          }