production.yml

name: Production

on:
  workflow_dispatch:
  workflow_run:
    workflows:
      - Non-Production
    types:
      - completed

# For reusable workflows, the permissions setting for id-token should be set to write at the
# caller workflow level or in the specific job that calls the reusable workflow.

permissions:
  id-token: write
  contents: read

jobs:
  main:
    name: Main
    uses: ./.github/workflows/plan-and-apply.yml
    if: github.event.workflow_run.conclusion == 'success'
    with:
      checkout_ref: ${{ github.ref }}
      environment: production
      github_environment: "Production: Main"
      service_account: plt-lz-testing-github@ptl-lz-terraform-tf62-prod.iam.gserviceaccount.com
      terraform_plan_args: -var-file=tfvars/production.tfvars
      terraform_state_bucket: plt-lz-testing-e194-prod
      terraform_version: ${{ vars.TERRAFORM_VERSION }}
      terraform_workspace: main-production
      working_directory: tests/plan-and-apply
      workload_identity_provider: projects/134040294660/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
    secrets:
      gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
      infracost_api_key: ${{ secrets.INFRACOST_API_KEY }}