ecs_terraform.yaml

name: Terraform Plan & Terraform Apply
run-name: Terraform plan & apply ${{ inputs.workspace }} by @${{ github.actor }}

on:
  workflow_run:
    workflows: [CD, Build Keycloak]
    types:
      - completed
  merge_group:
    types:
      - checks_requested
  workflow_dispatch:
    inputs:
      workspace:
        description: "Choose terraform workspace for deployment"
        required: true
        type: choice
        options:
          - dev
          - demo
        default: dev

concurrency:
  group: ${{ github.event.inputs.workspace }}-terraform
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  check-dependencies:
    runs-on: ubuntu-latest
    outputs:
      source_a_status: ${{ steps.check_a_status.outputs.status }}
      source_b_status: ${{ steps.check_b_status.outputs.status }}

    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Check CD Status
        id: check_a_status
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "Checking if CD has ran."
          response=$(gh run list --workflow "CD" --branch $GITHUB_REF_NAME --json status --jq '.[0]')

          if [ "$response" = "failure" ] || [ "$response" = "cancelled" ]; then
            echo "CD workflow failed or was cancelled."
            exit 1
          fi

          echo "CD workflow completed successfully."

      - name: Check Keycloak Status
        id: check_b_status
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "Checking if Keycloak has ran."
          response=$(gh run list --workflow "Build Keycloak" --branch $GITHUB_REF_NAME --json status --jq '.[0]')

          if [ "$response" = "failure" ] || [ "$response" = "cancelled" ]; then
            echo "Building Keycloak workflow failed or was cancelled."
            exit 1
          fi

          echo "Building Keycloak workflow status is $response."
  terraform:
    needs: check-dependencies
    runs-on: ubuntu-latest
    outputs:
      workspace: ${{ steps.set-workspace.outputs.workspace }}
    defaults:
      run:
        shell: bash
        working-directory: ./terraform/implementation/ecs
    if: needs.check-dependencies.outputs.source_a_status != 'failure' && needs.check-dependencies.outputs.source_b_status != 'failure'

    steps:
      - name: Check Out Changes
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3.1.2
        with:
          terraform_version: "1.9.8"

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Set workspace
        id: set-workspace
        run: |-
          echo "workspace=$(
          if [[ "${{ github.event.inputs.workspace }}" != "" ]]; then
            echo ${{ github.event.inputs.workspace}}
          else
            echo dev
          fi
          )" >> $GITHUB_OUTPUT

      - name: Set URL format
        id: set-url-format
        run: |
          if [[ "${{ steps.set-workspace.outputs.workspace }}" == "dev" ]]; then
            echo "base_url=https://${{ secrets.ECS_HOSTNAME }}" >> $GITHUB_OUTPUT
          else
            echo "base_url=https://${{ steps.set-workspace.outputs.workspace }}.${{ secrets.ECS_HOSTNAME }}" >> $GITHUB_OUTPUT
          fi

      - name: Terraform
        env:
          BUCKET: ${{ secrets.TFSTATE_BUCKET }}
          DYNAMODB_TABLE: ${{ secrets.TFSTATE_DYNAMODB_TABLE }}
          REGION: ${{ vars.region }}
          WORKSPACE: ${{ steps.set-workspace.outputs.workspace }}
          TF_VAR_umls_api_key: ${{ secrets.UMLS_API_KEY }}
          TF_VAR_ersd_api_key: ${{ secrets.ERSD_API_KEY}}
          TF_VAR_qc_tls_cert: ${{ secrets.TLS_CERT}}
          TF_VAR_qc_tls_key: ${{ secrets.TLS_KEY}}
          TF_VAR_auth_secret: ${{ secrets.AUTH_SECRET }}
          TF_VAR_keycloak_client_id: ${{ secrets.KEYCLOAK_CLIENT_ID }}
          TF_VAR_keycloak_client_secret: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
          TF_VAR_auth_keycloak_issuer: ${{ steps.set-url-format.outputs.base_url }}/keycloak
          TF_VAR_auth_url: ${{ steps.set-url-format.outputs.base_url }}
          TF_VAR_aidbox_base_url: ${{ steps.set-url-format.outputs.base_url }}/aidboxone
          TF_VAR_aidbox_client_secret: ${{ secrets.AIDBOX_CLIENT_SECRET }}
          TF_VAR_aidbox_admin_password: ${{ secrets.AIDBOX_ADMIN_PASSWORD }}
          TF_VAR_aidbox_license: ${{ secrets.AIDBOX_LICENSE }}
          TF_VAR_bastion_public_key: ${{ secrets.BASTION_PUBLIC_KEY }}
          TF_VAR_bastion_private_key: ${{ secrets.BASTION_PRIVATE_KEY }}
          TF_VAR_bastion_allowed_ips: ${{ secrets.BASTION_ALLOWED_IPS }}
        shell: bash
        run: |
          rm -rf .terraform .terraform.lock.hcl
          terraform init \
            -var-file="$WORKSPACE.tfvars" \
            -backend-config "bucket=$BUCKET" \
            -backend-config "dynamodb_table=$DYNAMODB_TABLE" \
            -backend-config "region=$REGION" \
            || (echo "terraform init failed, exiting..." && exit 1)
          terraform workspace select "$WORKSPACE"
          terraform apply -auto-approve -target=aws_acm_certificate.cloudflare_cert \
            -var-file="$WORKSPACE.tfvars"
          terraform plan \
            -var-file="$WORKSPACE.tfvars"
          terraform apply -auto-approve \
            -replace="module.ecs.dockerless_remote_image.dibbs[\"query-connector\"]" \
            -replace="module.ecs.dockerless_remote_image.dibbs[\"keycloak\"]" \
            -var-file="$WORKSPACE.tfvars"