terraform.yaml

name: 'Terraform build'

on:
  push:
    branches: [ "main" ]
  pull_request:

env:
  TF_CLOUD_ORGANIZATION: "${{ vars.BMB_TF_ORGANIZATION }}"
  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
  TF_WORKSPACE: "${{ vars.TF_WORKSPACE }}"
  CONFIG_DIRECTORY: "./"

permissions:
  contents: read

jobs:

  terraform-settings:
    name: "Terraform Settings"
    runs-on: ubuntu-latest
    
    steps:
    - name: Config
      run: |
        cat <<EOF > db.auto.tfvars
        cluster_name = "${{ vars.BMB_MYSQL_CLUSTER }}"
        database_name = "${{ vars.BMB_MYSQL_DATABASE }}"
        vpc_name = "${{ vars.BMB_EKS_CLUSTER_VPC }}"
        username = "${{ secrets.BMB_MYSQL_USER }}"
        password = "${{ secrets.BMB_MYSQL_PASSWORD }}"
        EOF

    - name: Upload Configuration
      uses: actions/upload-artifact@v4
      with:
        name: database-config
        path: db.auto.tfvars

  test:
    name: 'Test'
    runs-on: ubuntu-latest
    environment: dev

    defaults:
      run:
        shell: bash

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

    - name: Terraform Init
      run: terraform init -upgrade

    - name: Terraform Test
      if: github.event_name == 'push'
      run: terraform test

  sonarcloud:
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
    name: SonarCloud
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  terraform-plan:
    # needs: [test, terraform-settings]
    if: github.event_name == 'pull_request'
    environment: dev
    name: "Terraform Plan"
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        if: false  
        uses: actions/checkout@v4

      - name: Download Configuration
        if: false  
        uses: actions/download-artifact@v4
        with:
          name: database-config

      - name: Upload Configuration
        if: false  
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
        id: plan-upload
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          directory: ${{ env.CONFIG_DIRECTORY }}
          speculative: true

      - name: Create Plan Run
        if: false  
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
        id: plan-run
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
          plan_only: true

      - name: Get Plan Output
        if: false  
        uses: hashicorp/tfc-workflows-github/actions/plan-output@v1.3.1
        id: plan-output
        with:
          plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}

      - name: Update PR
        if: false
        uses: actions/github-script@v7
        id: plan-comment
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Cloud Plan Output')
            });
            const output = `#### Terraform Cloud Plan Output
                \`\`\`
                Plan: ${{ steps.plan-output.outputs.add }} to add, ${{ steps.plan-output.outputs.change }} to change, ${{ steps.plan-output.outputs.destroy }} to destroy.
                \`\`\`
                [Terraform Cloud Plan](${{ steps.plan-run.outputs.run_link }})
                `;
            // 3. Delete previous comment so PR timeline makes sense
            if (botComment) {
              github.rest.issues.deleteComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
              });
            }
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            });

      - name: Get output
        uses: hashicorp/tfc-workflows-github/actions/workspace-output@v1.3.1
        id: output
        with:
          workspace: ${{ env.TF_WORKSPACE }}
      
      # - name: "asdasdasd"
      #   continue-on-error: true
      #   run: |
      #     echo "Latest Run Status: "${{ steps.output.outputs.outputs }}""
      
      # - name: "v2"
      #   continue-on-error: true
      #   run: |
      #     vpc_id=$(echo ${{ steps.output.outputs.outputs }} | jq -r '.[] | select(.name == "vpc_id") | .value')
      #     echo "$vpc_id"
      
      # - name: "v3"
      #   continue-on-error: true
      #   run: |
      #     vpc_id2=$(echo ${{ toJson(steps.output.outputs.outputs) }} | jq -r '.[] | select(.name == "vpc_id") | .value')
      #     echo "$vpc_id2"

      # - name: "v4"
      #   continue-on-error: true
      #   run: |
      #     echo "{ \"name\": \"John\" }" | jq -r 'select(.name == "John") | .name'
          
      
      - name: "v5"
        continue-on-error: true
        run: |
          echo "vpc_id::$(echo \"${{ toJson(steps.output.outputs.outputs) }}\" | jq -r '.[] | select(.name == "vpc_id") | .value')"
          echo "${{ toJson(steps.output.outputs.outputs) }}" | jq -r '.[] | select(.name == "cluster") | .value'
          echo "${{ toJson(steps.output.outputs.outputs) }}" | jq -r '.[] | select(.name == "host") | .value'
          
          

  deploy:
    needs: [test, terraform-settings]
    if: github.ref == 'refs/heads/main'
    name: "Terraform Apply"
    runs-on: ubuntu-latest
    environment: dev
    permissions:
      contents: read
    outputs:
      vpc_id: ${{ steps.apply.outputs.vpc_id }}
      host: ${{ steps.apply.outputs.host }}
      cluster: ${{ steps.apply.outputs.cluster }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download Configuration
        uses: actions/download-artifact@v4
        with:
          name: database-config

      - name: Upload Configuration
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
        id: apply-upload
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          directory: ${{ env.CONFIG_DIRECTORY }}

      - name: Create Apply Run
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
        id: apply-run
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
          message: "Plan Run from GitHub Actions CI ${{ github.sha }}"

      - name: Apply
        uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.3.1
        if: ${{ vars.TF_AUTO_APPROVE == 'true' }}
        id: apply
        with:
          run: ${{ steps.apply-run.outputs.run_id }}
          comment: "Apply Run from GitHub Actions CI ${{ github.sha }}"

      - name: Get output
        uses: hashicorp/tfc-workflows-github/actions/workspace-output@v1.3.1
        id: output
        with:
          workspace: ${{ env.TF_WORKSPACE }}
      
      - run: |
          echo "Latest Run Status: ${{ steps.output.outputs.outputs }}"
      - run: |
          echo "Latest: ${{ fromJson(steps.output.outputs.outputs) }}"

  seed-database:
    needs: [deploy]
    name: "Seed database"
    runs-on: ubuntu-latest
    environment: dev
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    
    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4
      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token

      - name: Terraform fmt
        id: fmt
        run: terraform fmt -check
        working-directory: init
        
      - name: Terraform Init
        id: init
        run: terraform init -upgrade
        working-directory: init

      - name: Terraform Validate
        id: validate
        run: terraform validate
        working-directory: init

      - name: Config
        run: |
          cat <<EOF > seed.auto.tfvars
          dbClusterIdentifier = "${{ vars.BMB_MYSQL_CLUSTER }}"
          database_name = "${{ vars.BMB_MYSQL_DATABASE }}"
          vpc_id = "${{ needs.deploy.outputs.vpc_id }}"
          username = "${{ secrets.BMB_MYSQL_USER }}"
          password = "${{ secrets.BMB_MYSQL_PASSWORD }}"
          host = "${{ needs.deploy.outputs.host }}"
          EOF

      - name: Terraform apply
        id: apply
        run: terraform apply -auto-approve
        working-directory: init

      - name: Create tables
        continue-on-error: true
        run: |
          aws rds-data execute-statement --resource-arn $CLUSTER_ARN --secret-arn $SECRET_ARN --database $DATABASE_NAME --sql "$(cat orders_table.sql)"
          aws rds-data execute-statement --resource-arn $CLUSTER_ARN --secret-arn $SECRET_ARN --database $DATABASE_NAME --sql "$(cat order_items_table.sql)"
          aws rds-data execute-statement --resource-arn $CLUSTER_ARN --secret-arn $SECRET_ARN --database $DATABASE_NAME --sql "$(cat customers_table.sql)"
          aws rds-data execute-statement --resource-arn $CLUSTER_ARN --secret-arn $SECRET_ARN --database $DATABASE_NAME --sql "$(cat products_table.sql)"
          aws rds-data execute-statement --resource-arn $CLUSTER_ARN --secret-arn $SECRET_ARN --database $DATABASE_NAME --sql "$(cat payments_table.sql)"
        env:
          AWS_DEFAULT_REGION: us-east-1
          CLUSTER_ARN: ${{ needs.deploy.outputs.cluster }}
          SECRET_ARN: ${{ steps.apply.outputs.secret_arn }}
          DATABASE_NAME: ${{ vars.BMB_MYSQL_DATABASE }}

      - name: Terraform Destroy
        id: destroy
        run: terraform apply -auto-approve
        working-directory: init