scenario1.terraform.hub.yml

name: 'Scenario 1: Terraform HUB Multi-tenant Secure Baseline'

on:
  workflow_dispatch:
    inputs:
      destroy:
        description: 'Destroy resources?'
        required: true
        type: boolean
        default: false

  push:
    branches:
      - main
    paths:
      - '.github/workflows/terraform.scenario1.hub.yml'
      - '.github/workflows/_template.terraform.yml'
      - 'scenarios/secure-baseline-multitenant/terraform/solutions/hub/**'
      - '!scenarios/secure-baseline-multitenant/terraform/solutions/hub/**.md'

  pull_request:
    branches:
      - main
      - feature/*
    paths:
      - '.github/workflows/terraform.scenario1.hub.yml'
      - '.github/workflows/_template.terraform.yml'
      - 'scenarios/secure-baseline-multitenant/terraform/solutions/hub/**'
      - '!scenarios/secure-baseline-multitenant/terraform/solutions/hub/**.md'

permissions:
  id-token: write
  contents: read
  pull-requests: write

env:
  modulePath: 'scenarios/secure-baseline-multitenant/terraform/solutions/hub'
  terraformVersion: 1.3.9 # must be greater than or equal to 1.2 for OIDC
  backendStateKey: 'scenario1.hub.tfstate'
  tfvarPath: 'Parameters/uat.tfvars'

jobs:
  prepare-environment:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout the code
      uses: actions/checkout@main
    outputs:
      modulePath: ${{ env.modulePath }}
      terraformVersion: ${{ env.terraformVersion }}
      backendStateKey: ${{ env.backendStateKey }}
      tfvarPath: ${{ env.tfvarPath }}

  call-workflow-passing-data:
    name: 'Terraform CICD'
    needs: 
    - prepare-environment
    uses: ./.github/workflows/.template.terraform.yml
    with:
      modulePath: ${{ needs.prepare-environment.outputs.modulePath }}
      terraformVersion: ${{ needs.prepare-environment.outputs.terraformVersion }}
      backendStateKey: ${{ needs.prepare-environment.outputs.backendStateKey }}
      tfvarPath: ${{ needs.prepare-environment.outputs.tfvarPath }}
      # Ensure this value is a boolean
      destroy: ${{ github.event.inputs.destroy == 'true' }}
    secrets: inherit