Feat adding manual approval before tofu apply step (#33)

major: setup actions so that we can commit to main directly and have a plan kick off that awaits approval to be applied Todo: Update docs on how to upgrade
GlueOps · Oct 19, 2024 · cc4b41b · cc4b41b
1 parent cab5d7d
commit cc4b41b
Show file tree

Hide file tree

Showing 2 changed files with 94 additions and 16 deletions.
diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # OpenTofu - Continuous Delivery
 
-Example using AWS S3 Backend state storage:
+Example:
 
 ```yaml
 env:
@@ -14,8 +14,12 @@ name: OpenTofu CD
 on:
   push:
     branches:
-      - main
+      - main # This action has defaults that assume it will only apply off of main. It will not apply unless you "approve" the github issue per manual-approval GHA.
   pull_request:
+    types: [opened, synchronize, reopened] # If you open a PR it'll run a plan and comment the plan on a PR
+  workflow_dispatch:
+  schedule:
+    - cron: '0 16 * * *' # Used for drift detection.
 
 jobs:
   terraform-action:
@@ -27,6 +31,7 @@ jobs:
       - name: OpenTofu CD              
         uses: GlueOps/github-actions-opentofu-continuous-delivery@v0.0.5
         with:
+          enable_slack_notification_for_approval: "false"
           backend_config: |
             access_key=${{ vars.TF_S3_BACKEND_AWS_ACCESS_KEY }}
             secret_key=${{ secrets.TF_S3_BACKEND_AWS_SECRET_ACCESS_KEY }}
@@ -35,7 +40,9 @@ jobs:
             key=${{ github.repository }}/terraform.tfstate
 ```
 
-This action is an opinionated wrapped around the work of Daniel Flook: https://github.com/dflook/terraform-github-actions
+This action is an opinionated wrapper around the work of Daniel Flook: https://github.com/dflook/terraform-github-actions and leverages https://github.com/trstringer/manual-approval as the approval step before applying. Slack notifications are also enabled by default.
 
 
+If you have a security issue you would like to report please use security@glueops.dev to contact us. For all other matters please submit a PR or a github issue.
+
 
diff --git a/action.yml b/action.yml
@@ -37,10 +37,6 @@ inputs:
     description: A friendly name for this plan
     required: false
     default: ""
-  auto_approve:
-    description: Automatically approve and apply plan
-    required: false
-    default: "false"
   target:
     description: List of resources to target for the apply, one per line
     required: false
@@ -53,18 +49,17 @@ inputs:
     description: Create and apply a plan to destroy all resources
     required: false
     default: "false"
-  plan_path:
-    description: Path to the plan file to apply.
-    required: false
-    default: ""
   backend_type:
     description: The backend plugin name
     required: true
   add_github_comment:
     description: Add the plan to a GitHub PR
     required: false
     default: "true"
-
+  enable_slack_notification_for_approval:
+    description: Enable or Disable slack notifications
+    required: false
+    default: "true"
 
 outputs:
   tofu:
@@ -128,7 +123,7 @@ runs:
         backend_config_file: ${{ inputs.backend_config_file }}
 
     - name: tofu plan
-      if: github.event.pull_request != null
+      id: plan
       uses: dflook/tofu-plan@830e0eb359a91f551ae9c06217ea855c0e87665b # v1.44.0
       with:
         path: ${{ inputs.path }}
@@ -144,8 +139,44 @@ runs:
         destroy: ${{ inputs.destroy }}
         add_github_comment:  ${{ inputs.add_github_comment }}
 
+
+
+    - name: Notify in Slack about Approving/Denying to continue workflow
+      if: github.ref_name == 'main' && steps.plan.outputs.changes == 'true' && inputs.enable_slack_notification_for_approval == 'true' && github.event_name != 'pull_request'
+      uses: slackapi/slack-github-action@v1.27.0
+      with:
+        payload: |
+           {
+                "attachments": [
+                    {
+                        "color": "#FFA500",
+                        "author_name": ":link: OpenTofu - ${{ github.event.repository.name }} - Job Details",
+                        "author_link": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+                        "title": "https://github.com/${{ github.repository }}",
+                        "title_link": "https://github.com/${{ github.repository }}",
+                        "text": ":raising_hand: Approval Required: https://github.com/${{ github.repository }}/issues"
+                    }
+                ]
+            }
+      env:
+        SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+
+
+    ## IMPORTANT
+    ## DO NOT REMOVE THIS MANUAL APPROVAL STEP UNLESS YOU WANT AUTO APPLY WITHOUT ANY APPROVALS.
+    - name: Approve or Deny tofu apply
+      if: github.ref_name == 'main' && steps.plan.outputs.changes == 'true'
+      uses: trstringer/manual-approval@v1
+      with:
+        secret: ${{ github.TOKEN }}
+        approvers: ${{ github.actor }}
+        minimum-approvals: 1
+        issue-title: "Approve or Deny tofu apply"
+        issue-body: "Approve or Deny tofu apply"
+        exclude-workflow-initiator-as-approver: false
+
     - name: tofu apply
-      if: github.ref_name == 'main' && github.event.pull_request.merged == true
+      if: github.ref_name == 'main' && steps.plan.outputs.changes == 'true'
       uses: dflook/tofu-apply@af009c1e6d9f60c424b495dd120f3673606b82d2 # v1.44.0
       with:
         path: ${{ inputs.path }}
@@ -156,8 +187,48 @@ runs:
         var_file: ${{ inputs.var_file }}
         parallelism: ${{ inputs.parallelism }}
         label: ${{ inputs.label }}
-        auto_approve: ${{ inputs.auto_approve }}
+        auto_approve: "true" # SET TO FALSE TO DISABLE AUTO APPLY.
         target: ${{ inputs.target }}
         replace: ${{ inputs.replace }}
         destroy: ${{ inputs.destroy }}
-        plan_path: ${{ inputs.plan_path }}
+
+    - name: Notify on Success
+      if: always() && success()
+      uses: slackapi/slack-github-action@v1.27.0
+      with:
+        payload: |
+           {
+                "attachments": [
+                    {
+                        "color": "#36a64f",
+                        "author_name": ":link: OpenTofu - ${{ github.event.repository.name }} - Job Details",
+                        "author_link": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+                        "title": "https://github.com/${{ github.repository }}",
+                        "title_link": "https://github.com/${{ github.repository }}",
+                        "text": ":large_green_circle: SUCCESS :large_green_circle:"
+                    }
+                ]
+            }
+      env:
+        SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+
+
+    - name: Notify on Failure
+      if: always() && failure()
+      uses: slackapi/slack-github-action@v1.27.0
+      with:
+        payload: |
+           {
+                "attachments": [
+                    {
+                        "color": "#FF0000",
+                        "author_name": ":link: OpenTofu - ${{ github.event.repository.name }} - Job Details",
+                        "author_link": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+                        "title": "https://github.com/${{ github.repository }}",
+                        "title_link": "https://github.com/${{ github.repository }}",
+                        "text": ":rotating_light: FAILURE :rotating_light:"
+                    }
+                ]
+            }
+      env:
+        SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK