Skip to content

Commit f3cc535

Browse files
eddalmond1eddalmond1
committed
eli-445 adding bootstrap workflow for github actions
1 parent 63af80b commit f3cc535

1 file changed

Lines changed: 231 additions & 0 deletions

File tree

‎.github/workflows/iam-bootstrap-deploy.yaml‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
name: "IAM Bootstrap | Deploy IAM Roles"
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- "infrastructure/stacks/iams-developer-roles/**"
9+
workflow_dispatch:
10+
inputs:
11+
environment:
12+
description: "Environment to deploy (leave blank for all)"
13+
required: false
14+
type: choice
15+
options:
16+
- all
17+
- dev
18+
- test
19+
- preprod
20+
- prod
21+
workflow_call:
22+
inputs:
23+
environment:
24+
description: "Environment to deploy"
25+
required: false
26+
type: string
27+
default: "all"
28+
29+
concurrency:
30+
group: iam-bootstrap-deploy
31+
cancel-in-progress: false
32+
33+
permissions:
34+
contents: read
35+
id-token: write
36+
37+
jobs:
38+
metadata:
39+
name: "Resolve CI/CD metadata"
40+
runs-on: ubuntu-latest
41+
timeout-minutes: 2
42+
outputs:
43+
terraform_version: ${{ steps.vars.outputs.terraform_version }}
44+
target_env: ${{ steps.vars.outputs.target_env }}
45+
steps:
46+
- name: "Checkout code"
47+
uses: actions/checkout@v6
48+
49+
- name: "Set variables"
50+
id: vars
51+
run: |
52+
echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
53+
54+
# Determine which environment(s) to deploy
55+
INPUT_ENV="${{ inputs.environment || 'all' }}"
56+
echo "target_env=$INPUT_ENV" >> $GITHUB_OUTPUT
57+
echo "Target environment: $INPUT_ENV"
58+
59+
deploy-dev:
60+
name: "Deploy IAM roles → dev"
61+
needs: metadata
62+
if: >-
63+
needs.metadata.outputs.target_env == 'all' ||
64+
needs.metadata.outputs.target_env == 'dev'
65+
runs-on: ubuntu-latest
66+
timeout-minutes: 15
67+
environment: dev
68+
steps:
69+
- name: "Checkout code"
70+
uses: actions/checkout@v6
71+
72+
- name: "Setup Terraform"
73+
uses: hashicorp/setup-terraform@v3
74+
with:
75+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
76+
77+
- name: "Configure AWS Credentials (IAM Bootstrap Role)"
78+
uses: aws-actions/configure-aws-credentials@v6
79+
with:
80+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
81+
aws-region: eu-west-2
82+
83+
- name: "Terraform Init"
84+
working-directory: ./infrastructure
85+
run: |
86+
make terraform-init env=dev stack=iams-developer-roles
87+
88+
- name: "Terraform Plan"
89+
working-directory: ./infrastructure/stacks/iams-developer-roles
90+
run: |
91+
terraform plan -var="environment=dev" -out=tfplan
92+
echo "### Dev IAM Plan" >> $GITHUB_STEP_SUMMARY
93+
echo '```' >> $GITHUB_STEP_SUMMARY
94+
terraform show -no-color tfplan >> $GITHUB_STEP_SUMMARY
95+
echo '```' >> $GITHUB_STEP_SUMMARY
96+
97+
- name: "Terraform Apply"
98+
working-directory: ./infrastructure/stacks/iams-developer-roles
99+
run: terraform apply -auto-approve tfplan
100+
101+
deploy-test:
102+
name: "Deploy IAM roles → test (approval required)"
103+
needs: [metadata, deploy-dev]
104+
if: >-
105+
always() &&
106+
(needs.deploy-dev.result == 'success' || needs.deploy-dev.result == 'skipped') &&
107+
(needs.metadata.outputs.target_env == 'all' ||
108+
needs.metadata.outputs.target_env == 'test')
109+
runs-on: ubuntu-latest
110+
timeout-minutes: 15
111+
environment: test
112+
steps:
113+
- name: "Checkout code"
114+
uses: actions/checkout@v6
115+
116+
- name: "Setup Terraform"
117+
uses: hashicorp/setup-terraform@v3
118+
with:
119+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
120+
121+
- name: "Configure AWS Credentials (IAM Bootstrap Role)"
122+
uses: aws-actions/configure-aws-credentials@v6
123+
with:
124+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
125+
aws-region: eu-west-2
126+
127+
- name: "Terraform Init"
128+
working-directory: ./infrastructure
129+
run: |
130+
make terraform-init env=test stack=iams-developer-roles
131+
132+
- name: "Terraform Plan"
133+
working-directory: ./infrastructure/stacks/iams-developer-roles
134+
run: |
135+
terraform plan -var="environment=test" -out=tfplan
136+
echo "### Test IAM Plan" >> $GITHUB_STEP_SUMMARY
137+
echo '```' >> $GITHUB_STEP_SUMMARY
138+
terraform show -no-color tfplan >> $GITHUB_STEP_SUMMARY
139+
echo '```' >> $GITHUB_STEP_SUMMARY
140+
141+
- name: "Terraform Apply"
142+
working-directory: ./infrastructure/stacks/iams-developer-roles
143+
run: terraform apply -auto-approve tfplan
144+
145+
deploy-preprod:
146+
name: "Deploy IAM roles → preprod (approval required)"
147+
needs: [metadata, deploy-test]
148+
if: >-
149+
always() &&
150+
(needs.deploy-test.result == 'success' || needs.deploy-test.result == 'skipped') &&
151+
(needs.metadata.outputs.target_env == 'all' ||
152+
needs.metadata.outputs.target_env == 'preprod')
153+
runs-on: ubuntu-latest
154+
timeout-minutes: 15
155+
environment: preprod
156+
steps:
157+
- name: "Checkout code"
158+
uses: actions/checkout@v6
159+
160+
- name: "Setup Terraform"
161+
uses: hashicorp/setup-terraform@v3
162+
with:
163+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
164+
165+
- name: "Configure AWS Credentials (IAM Bootstrap Role)"
166+
uses: aws-actions/configure-aws-credentials@v6
167+
with:
168+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
169+
aws-region: eu-west-2
170+
171+
- name: "Terraform Init"
172+
working-directory: ./infrastructure
173+
run: |
174+
make terraform-init env=preprod stack=iams-developer-roles
175+
176+
- name: "Terraform Plan"
177+
working-directory: ./infrastructure/stacks/iams-developer-roles
178+
run: |
179+
terraform plan -var="environment=preprod" -out=tfplan
180+
echo "### Preprod IAM Plan" >> $GITHUB_STEP_SUMMARY
181+
echo '```' >> $GITHUB_STEP_SUMMARY
182+
terraform show -no-color tfplan >> $GITHUB_STEP_SUMMARY
183+
echo '```' >> $GITHUB_STEP_SUMMARY
184+
185+
- name: "Terraform Apply"
186+
working-directory: ./infrastructure/stacks/iams-developer-roles
187+
run: terraform apply -auto-approve tfplan
188+
189+
deploy-prod:
190+
name: "Deploy IAM roles → prod (approval required)"
191+
needs: [metadata, deploy-preprod]
192+
if: >-
193+
always() &&
194+
(needs.deploy-preprod.result == 'success' || needs.deploy-preprod.result == 'skipped') &&
195+
(needs.metadata.outputs.target_env == 'all' ||
196+
needs.metadata.outputs.target_env == 'prod')
197+
runs-on: ubuntu-latest
198+
timeout-minutes: 15
199+
environment: prod
200+
steps:
201+
- name: "Checkout code"
202+
uses: actions/checkout@v6
203+
204+
- name: "Setup Terraform"
205+
uses: hashicorp/setup-terraform@v3
206+
with:
207+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
208+
209+
- name: "Configure AWS Credentials (IAM Bootstrap Role)"
210+
uses: aws-actions/configure-aws-credentials@v6
211+
with:
212+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
213+
aws-region: eu-west-2
214+
215+
- name: "Terraform Init"
216+
working-directory: ./infrastructure
217+
run: |
218+
make terraform-init env=prod stack=iams-developer-roles
219+
220+
- name: "Terraform Plan"
221+
working-directory: ./infrastructure/stacks/iams-developer-roles
222+
run: |
223+
terraform plan -var="environment=prod" -out=tfplan
224+
echo "### Prod IAM Plan" >> $GITHUB_STEP_SUMMARY
225+
echo '```' >> $GITHUB_STEP_SUMMARY
226+
terraform show -no-color tfplan >> $GITHUB_STEP_SUMMARY
227+
echo '```' >> $GITHUB_STEP_SUMMARY
228+
229+
- name: "Terraform Apply"
230+
working-directory: ./infrastructure/stacks/iams-developer-roles
231+
run: terraform apply -auto-approve tfplan

0 commit comments

Comments
 (0)