Terragrunt Drift Detection and Reconciliation #799
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terragrunt Drift Detection and Reconciliation | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Run the drift detection every 12 hours | |
| - cron: '0 */12 * * *' | |
| jobs: | |
| drift-detection: | |
| name: Check Drift | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| permissions: | |
| id-token: write | |
| contents: read | |
| pull-requests: read | |
| checks: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| ### Check out the code | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| fetch-depth: 0 | |
| ### Install tooling | |
| - name: Install Terramate | |
| uses: terramate-io/terramate-action@v2 | |
| - name: Install asdf | |
| uses: asdf-vm/actions/setup@v3 | |
| - name: Install Terraform and Terragrunt with asdf | |
| run: | | |
| asdf plugin add terraform | |
| asdf plugin add terragrunt | |
| asdf install terraform | |
| asdf install terragrunt | |
| ### Configure cloud credentials | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v2 | |
| with: | |
| aws-region: ${{ env.AWS_REGION }} | |
| role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/github | |
| env: | |
| AWS_REGION: us-east-1 | |
| AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID }} | |
| - name: Verify AWS credentials | |
| run: aws sts get-caller-identity | |
| ### Run Dift Check | |
| - name: Run Terragrunt init on all stacks | |
| id: init | |
| run: terramate run -- terragrunt init | |
| - name: Run drift detection | |
| id: drift-detect | |
| run: | | |
| terramate run \ | |
| --parallel 5 \ | |
| --cloud-sync-drift-status \ | |
| --terraform-plan-file=drift.tfplan \ | |
| --terragrunt \ | |
| -- terragrunt plan -out drift.tfplan -detailed-exitcode -lock=false | |
| env: | |
| TF_VAR_master_password: ${{ secrets.MYSQL_PROD_MASTER_PASSWORD }} | |
| ### Optionally add a manual approval step for drift reconciliation (removed if you want to reconcile automatically) | |
| # - name: Wait for approval | |
| # uses: trstringer/manual-approval@v1 | |
| # with: | |
| # secret: ${{ github.token }} | |
| # approvers: terramate-io/engineering # Add approvers (users and teams) here | |
| # issue-title: "Recommendation: Drift Reconciliation" | |
| # minimum-approvals: 1 | |
| # Run terragrunt apply on all stacks tagged with 'reconcile' | |
| - name: Run Drift Reconciliation | |
| run: | | |
| terramate run \ | |
| --cloud-status=drifted \ | |
| --tags reconcile \ | |
| --cloud-sync-deployment \ | |
| --terraform-plan-file=drift.tfplan \ | |
| --terragrunt \ | |
| -- \ | |
| terragrunt apply -input=false -auto-approve -lock-timeout=5m drift.tfplan | |
| env: | |
| TF_VAR_master_password: ${{ secrets.MYSQL_PROD_MASTER_PASSWORD }} |