destroy.yaml

name: Destroy

on:
  workflow_call:
    inputs:
      resources_prefix:
        description: 'Resources name prefix used to avoid naming conflicts between resources of different DataSpaces.'
        required: true
        type: string

  workflow_dispatch:
    inputs:
      resources_prefix:
        description: 'Resources name prefix used to avoid naming conflicts between resources of different DataSpaces.'
        required: true
        type: string

# Grant permissions to obtain federated identity credentials
# see https://docs.github.com/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure
permissions:
  id-token: write
  contents: read

env:
  RESOURCES_PREFIX: ${{ github.event.inputs.resources_prefix || inputs.resources_prefix }}

jobs:
  Matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@v2
      - id: set-matrix
        run: |
          matrix=$(jq -c . participants.json)
          echo "::set-output name=matrix::$matrix"

  # Delete deployed Azure resource groups for each dataspace participant.
  Destroy-Participants:
    needs: Matrix
    continue-on-error: true
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJson(needs.Matrix.outputs.matrix) }}

    defaults:
      run:
        working-directory: deployment/terraform/participant

    steps:
      - uses: actions/checkout@v2

      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Download tfvars file'
        run: az storage blob download --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -f terraform.tfvars -n "${{ matrix.participant }}${{ env.RESOURCES_PREFIX }}.tfvars" --auth-mode key

      - name: 'Delete terraform resources'
        run: |
          # Create backend.conf file to retrieve the remote terraform state during terraform init.
          echo '
            resource_group_name  = "${{ secrets.COMMON_RESOURCE_GROUP }}"
            storage_account_name = "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}"
            container_name       = "${{ secrets.TERRAFORM_STATE_CONTAINER }}"
            key                  = "${{ matrix.participant }}${{ env.RESOURCES_PREFIX }}.tfstate"
          ' >> backend.conf
          terraform init -backend-config=backend.conf
          terraform destroy -auto-approve
        env:
          # Authentication settings for Terraform AzureRM provider
          # See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
          ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}

          # Passing dummy variables to terraform destroy, because destroy needs input variables to be defined, but uses the state.
          TF_VAR_application_sp_client_secret: dummy

      # The Destroy job uses continue-on-error: true so that if one destroy job fails, the others don't get killed.
      # This has the side effect of making the overall job (and hence calling workflow) succeed when it should fail.
      # To solve this, we upload an extra marker blob at the end of the `Destroy-Participants` job,
      # and delete the blobs in a separate job matrix. That `Post-Destroy-Participants` job will then cause the workflow to fail
      # if a completion marker blob is not found (meaning that a Destroy job did not succeed).
      - name: 'Completion marker blob'
        run: az storage blob upload --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -f /dev/null -n "${{ matrix.participant }}${{ env.RESOURCES_PREFIX }}.completed" --auth-mode key

  # Delete shared deployed Azure resources.
  Destroy-Dataspace:
    continue-on-error: true
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: deployment/terraform/dataspace

    steps:
      - uses: actions/checkout@v2

      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Download tfvars file'
        run: az storage blob download --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -f terraform.tfvars -n "${{ env.RESOURCES_PREFIX }}.tfvars" --auth-mode key

      - name: 'Delete terraform resources'
        run: |
          # Create backend.conf file to retrieve the remote terraform state during terraform init.
          echo '
            resource_group_name  = "${{ secrets.COMMON_RESOURCE_GROUP }}"
            storage_account_name = "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}"
            container_name       = "${{ secrets.TERRAFORM_STATE_CONTAINER }}"
            key                  = "${{ env.RESOURCES_PREFIX }}.tfstate"
          ' >> backend.conf
          terraform init -backend-config=backend.conf
          terraform destroy -auto-approve
        env:
          # Authentication settings for Terraform AzureRM provider
          # See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
          ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}

      # See Destroy-Participants job for explanation about the completion marker blob
      - name: 'Completion marker blob'
        run: az storage blob upload --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -f /dev/null -n "${{ env.RESOURCES_PREFIX }}.completed" --auth-mode key

  # Post-Destroy jos must wait for all Destroy jobs to complete, so that their failure does not interrupt in-progress Destroy jobs

  Post-Destroy-Participants:
    needs:
      - Matrix
      - Destroy-Participants
      - Destroy-Dataspace
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJson(needs.Matrix.outputs.matrix) }}

    steps:
      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Delete state, tfvars and completion marker blobs'
        run: |
          for extension in tfvars tfstate completed
          do
            az storage blob delete --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -n "${{ matrix.participant }}${{ env.RESOURCES_PREFIX }}.$extension" --auth-mode key
          done

  Post-Destroy-Dataspace:
    needs:
      - Matrix
      - Destroy-Participants
      - Destroy-Dataspace
    runs-on: ubuntu-latest

    steps:
      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Delete state, tfvars and completion marker blobs'
        run: |
          for extension in tfvars tfstate completed
          do
            az storage blob delete --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -n "${{ env.RESOURCES_PREFIX }}.$extension" --auth-mode key
          done