Create authenticator apigateway

.github/workflows/terraform.yml

@@ -10,6 +10,12 @@ on:
         description: "Manual deploy"
         default: "Manual deploy"
 
+env:
+  TF_CLOUD_ORGANIZATION: "${{ vars.BMB_TF_ORGANIZATION }}"
+  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
+  TF_WORKSPACE: "${{ vars.TF_WORKSPACE }}"
+  CONFIG_DIRECTORY: "./"
+
 permissions:
   contents: read
 
@@ -29,7 +35,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
+      uses: hashicorp/setup-terraform@v3
       with:
         cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
 
@@ -40,34 +46,120 @@ jobs:
       if: github.event_name == 'push'
       run: terraform test
 
-  terraform:
-    needs: test
-    name: 'Plan'
+
+  terraform-plan:
+    environment: dev
+    name: "Terraform Plan"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create .auto.tfvars file
+        run: |
+          cat <<EOF > auth.auto.tfvars
+          api_name = "${{ vars.BMB_AUTH_API_NAME }}"
+          eks_vpc_name = "${{ vars.BMB_EKS_CLUSTER_VPC }}"
+          nlb_name = "${{ vars.BMB_INTERNAL_LB_NAME }}"
+          user_pool_name = "${{ vars.BMB_USER_POOL_NAME }}"
+          jwt_secret = "${{ secrets.BMB_JWT_SECRET_KEY }}"
+          EOF
+
+      - name: Upload Configuration
+        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
+        id: plan-upload
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          directory: ${{ env.CONFIG_DIRECTORY }}
+          speculative: true
+
+      - name: Create Plan Run
+        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
+        id: plan-run
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
+          plan_only: true
+
+      - name: Get Plan Output
+        uses: hashicorp/tfc-workflows-github/actions/plan-output@v1.3.1
+        id: plan-output
+        with:
+          plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}
+
+      - name: Update PR
+        uses: actions/github-script@v7
+        id: plan-comment
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            // 1. Retrieve existing bot comments for the PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const botComment = comments.find(comment => {
+              return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
+            });
+            const output = `#### Terraform Cloud Plan Output
+                \`\`\`
+                Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
+                \`\`\`
+                [Terraform Cloud Plan](${{ steps.plan-run.outputs.run_link }})
+                `;
+            // 3. Delete previous comment so PR timeline makes sense
+            if (botComment) {
+              github.rest.issues.deleteComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+              });
+            }
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            });
+
+  deploy:
+    needs: [test]
+    if: github.ref == 'refs/heads/main'
+    name: "Terraform Apply"
     runs-on: ubuntu-latest
     environment: dev
-
-    defaults:
-      run:
-        shell: bash
-
+    permissions:
+      contents: read
     steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v1
-      with:
-        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
-
-    - name: Terraform Init
-      run: terraform init -upgrade
-
-    - name: Terraform Format
-      run: terraform fmt -check
-
-    - name: Terraform Plan
-      run: terraform plan -input=false
-
-    - name: Terraform Apply
-      if: github.ref == 'refs/heads/"main"'
-      run: terraform apply -input=false
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create .auto.tfvars file
+        run: |
+          cat <<EOF > auth.auto.tfvars
+          api_name = "${{ vars.BMB_AUTH_API_NAME }}"
+          eks_vpc_name = "${{ vars.BMB_EKS_CLUSTER_VPC }}"
+          nlb_name = "${{ vars.BMB_INTERNAL_LB_NAME }}"
+          user_pool_name = "${{ vars.BMB_USER_POOL_NAME }}"
+          jwt_secret = "${{ secrets.BMB_JWT_SECRET_KEY }}"
+          EOF
+
+      - name: Upload Configuration
+        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
+        id: apply-upload
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          directory: ${{ env.CONFIG_DIRECTORY }}
+
+
+      - name: Create Apply Run
+        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
+        id: apply-run
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
+          message: "Create Run from GitHub Actions CI ${{ github.sha }}"

.gitignore

@@ -1,3 +1,5 @@
+**/node_modules/*
+
 # Local .terraform directories
 **/.terraform/*