main.yml

defaults:
  run:
    shell: bash
    working-directory: infrastructure
name: Deploy
on: [push, pull_request]
permissions:
  id-token: write
  contents: read
  pull-requests: write
jobs:
  infrastructure:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3

      - name: Build & Test lambda
        run: |
          pip3 install cargo-lambda
          rustup update stable && rustup default stable
          cargo lambda build --arm64 --release
          cargo test --verbose
        working-directory: infrastructure/health

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_OIDC_ASSUME_ROLE_ARN }}
          aws-region: eu-central-1
          role-session-name: GitHub-OIDC-TF

      - name: Terraform Init
        id: init
        env:
          AWS_BUCKET_NAME: ${{ secrets.AWS_STATE_BUCKET_NAME }}
        run: terraform init --backend-config="bucket=${AWS_BUCKET_NAME}"
      
      - name: Terraform Validation
        id: validate
        run: terraform validate

      - name: Terraform Plan
        id: plan
        if: github.event_name == 'pull_request'
        run: terraform plan
      
      - name: Terraform Apply
        id: apply
        if: github.ref == 'refs/head/main' && github.event_name == 'push'
        run: terraform apply -auto-approve