terraform.yml

name: Terraform Plan and Apply
on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'The target environment for deployment'
        required: true
        default: 'Sandbox'
        type: choice
        options:
          - Sandbox
          - Production
      apply:
        description: 'Apply the Terraform plan after creation'
        required: false
        default: false
        type: boolean

jobs:
  terraform:
    # dev is used for Sandbox deployments, main is used for Production deployments
    if: github.ref_name == 'dev' && github.event.inputs.environment == 'Sandbox' || github.ref_name == 'main' && github.event.inputs.environment == 'Production'
    permissions:
      contents: read
      id-token: write
    environment: ${{ inputs.environment }}
    runs-on: ubuntu-latest
    # workaround for "context access might be invalid warning"
    env:
      IMAGE_REPO: ghcr.io/bcgov/otp-provider
      IMAGE_TAG: dev
      TF_STATE_BUCKET_NAME:
      TF_STATE_BUCKET_KEY:
      TF_STATE_BUCKET_REGION:
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.11.0

      - name: Get latest tag
        id: tag
        run: |
          if [ "${{ github.event.inputs.environment }}" == "Production" ]; then
            echo "IMAGE_TAG=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV
          else
            echo "IMAGE_TAG=dev" >> $GITHUB_ENV
          fi

      - name: Set global environment variables
        run: |
          cat >> $GITHUB_ENV <<EOF
          TF_VAR_otp_cwlogs_group=/aws/ecs/fargate/otp-provider
          TF_STATE_BUCKET_KEY=otp-provider.tfstate
          TF_STATE_BUCKET_REGION=ca-central-1
          TF_VAR_otp_image_repo=${{ env.IMAGE_REPO }}
          TF_VAR_ches_api_url=https://ches.api.gov.bc.ca/api/v1/email
          TF_VAR_ches_token_url=https://loginproxy.gov.bc.ca/auth/realms/comsvcauth/protocol/openid-connect/token
          TF_VAR_email_provider=ches
          EOF
      - name: Set sandbox environment variables
        if: github.event.inputs.environment == 'Sandbox'
        run: |
          cat >> $GITHUB_ENV <<EOF
          TF_STATE_BUCKET_NAME=otp-provider-tf-sandbox
          TF_VAR_otp_image_tag=${{ env.IMAGE_TAG }}
          TF_VAR_subnet_a=Dev-App-A
          TF_VAR_subnet_b=Dev-App-B

          TF_VAR_dev_app_url=https://dev.sandbox.otp.loginproxy.gov.bc.ca
          TF_VAR_mail_from=no-reply-sso@gov.bc.ca
          TF_VAR_dev_custom_domain_name=dev.sandbox.otp.loginproxy.gov.bc.ca
          TF_VAR_dev_cors_origins=https://dev.sandbox.loginproxy.gov.bc.ca
          TF_VAR_dev_task_cpu=256
          TF_VAR_dev_task_memory=512
          TF_VAR_dev_task_container_cpu=256
          TF_VAR_dev_task_container_memory=512
          TF_VAR_dev_task_container_port=3000
          TF_VAR_dev_rds_min_capacity=0
          TF_VAR_dev_rds_max_capacity=2
          TF_VAR_dev_rds_scale_down_time=3600

          TF_VAR_test_app_url=https://test.sandbox.otp.loginproxy.gov.bc.ca
          TF_VAR_test_custom_domain_name=test.sandbox.otp.loginproxy.gov.bc.ca
          TF_VAR_test_cors_origins=https://test.sandbox.loginproxy.gov.bc.ca
          TF_VAR_test_task_cpu=256
          TF_VAR_test_task_memory=512
          TF_VAR_test_task_container_cpu=256
          TF_VAR_test_task_container_memory=512
          TF_VAR_test_task_container_port=3000
          TF_VAR_test_rds_min_capacity=0
          TF_VAR_test_rds_max_capacity=2
          TF_VAR_test_rds_scale_down_time=3600

          TF_VAR_prod_app_url=https://sandbox.otp.loginproxy.gov.bc.ca
          TF_VAR_prod_custom_domain_name=sandbox.otp.loginproxy.gov.bc.ca
          TF_VAR_prod_cors_origins=https://sandbox.loginproxy.gov.bc.ca
          TF_VAR_prod_task_cpu=256
          TF_VAR_prod_task_memory=512
          TF_VAR_prod_task_container_cpu=256
          TF_VAR_prod_task_container_memory=512
          TF_VAR_prod_task_container_port=3000
          TF_VAR_prod_rds_min_capacity=0
          TF_VAR_prod_rds_max_capacity=2
          TF_VAR_prod_rds_scale_down_time=3600
          TF_VAR_enable_grafana=true
          TF_VAR_grafana_kc_url=${{ vars.GRAFANA_OAUTH_BASE_URL }}
          TF_VAR_grafana_kc_client_id=${{ secrets.GRAFANA_OAUTH_CLIENT_ID }}
          TF_VAR_grafana_kc_client_secret=${{ secrets.GRAFANA_OAUTH_CLIENT_SECRET }}

          TF_VAR_dev_desired_tasks=1
          TF_VAR_dev_enable_autoscale=true
          TF_VAR_test_desired_tasks=1
          TF_VAR_test_enable_autoscale=false
          TF_VAR_prod_desired_tasks=1
          TF_VAR_prod_enable_autoscale=false

          TF_VAR_cpu_target_use=15
          TF_VAR_autoscale_max_capacity=2
          TF_VAR_autoscale_min_capacity=1

          EOF

      - name: Set production environment variables
        if: github.event.inputs.environment == 'Production'
        run: |
          cat >> $GITHUB_ENV <<EOF
          TF_STATE_BUCKET_NAME=otp-provider-tf-production
          TF_VAR_otp_image_tag=${{ env.IMAGE_TAG }}
          TF_VAR_subnet_a=Prod-App-A
          TF_VAR_subnet_b=Prod-App-B

          TF_VAR_dev_app_url=https://dev.otp.loginproxy.gov.bc.ca
          TF_VAR_mail_from=no-reply-sso@gov.bc.ca
          TF_VAR_dev_custom_domain_name=dev.otp.loginproxy.gov.bc.ca
          TF_VAR_dev_cors_origins=https://dev.loginproxy.gov.bc.ca
          TF_VAR_dev_task_cpu=256
          TF_VAR_dev_task_memory=512
          TF_VAR_dev_task_container_cpu=256
          TF_VAR_dev_task_container_memory=512
          TF_VAR_dev_task_container_port=3000
          TF_VAR_dev_rds_min_capacity=0.5
          TF_VAR_dev_rds_max_capacity=2
          TF_VAR_dev_rds_scale_down_time=36000

          TF_VAR_test_app_url=https://test.otp.loginproxy.gov.bc.ca
          TF_VAR_test_custom_domain_name=test.otp.loginproxy.gov.bc.ca
          TF_VAR_test_cors_origins=https://test.loginproxy.gov.bc.ca
          TF_VAR_test_task_cpu=256
          TF_VAR_test_task_memory=512
          TF_VAR_test_task_container_cpu=256
          TF_VAR_test_task_container_memory=512
          TF_VAR_test_task_container_port=3000
          TF_VAR_test_rds_min_capacity=0.5
          TF_VAR_test_rds_max_capacity=2
          TF_VAR_test_rds_scale_down_time=36000

          TF_VAR_prod_app_url=https://otp.loginproxy.gov.bc.ca
          TF_VAR_prod_custom_domain_name=otp.loginproxy.gov.bc.ca
          TF_VAR_prod_cors_origins=https://loginproxy.gov.bc.ca
          TF_VAR_prod_task_cpu=512
          TF_VAR_prod_task_memory=1024
          TF_VAR_prod_task_container_cpu=512
          TF_VAR_prod_task_container_memory=1024
          TF_VAR_prod_task_container_port=3000
          TF_VAR_prod_rds_min_capacity=0.5
          TF_VAR_prod_rds_max_capacity=2
          TF_VAR_prod_rds_scale_down_time=36000
          TF_VAR_enable_grafana=true
          TF_VAR_grafana_kc_url=${{ vars.GRAFANA_OAUTH_BASE_URL }}
          TF_VAR_grafana_kc_client_id=${{ secrets.GRAFANA_OAUTH_CLIENT_ID }}
          TF_VAR_grafana_kc_client_secret=${{ secrets.GRAFANA_OAUTH_CLIENT_SECRET }}

          TF_VAR_dev_desired_tasks=1
          TF_VAR_dev_enable_autoscale=false
          TF_VAR_test_desired_tasks=1
          TF_VAR_test_enable_autoscale=false
          TF_VAR_prod_desired_tasks=2
          TF_VAR_prod_enable_autoscale=true

          TF_VAR_prod_enable_alb_alarm = true
          TF_VAR_prod_enable_alerts = true
          TF_VAR_prod_alert_webhook_url = ${{ secrets.alert_webhook_url }}

          TF_VAR_cpu_target_use=15
          TF_VAR_autoscale_max_capacity=4
          TF_VAR_autoscale_min_capacity=2

          EOF

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.SSO_AWS_GH_ACTIONS_DEPLOYER }}
          aws-region: ca-central-1

      - name: Terraform Variables
        run: |
          cat >"config.tf" <<EOF
          terraform {
            backend "s3" {
              bucket         = "${{ env.TF_STATE_BUCKET_NAME }}"
              key            = "${{ env.TF_STATE_BUCKET_KEY }}"
              region         = "${{ env.TF_STATE_BUCKET_REGION }}"
              use_lockfile   = true
            }
          }
          EOF
        working-directory: ./terraform

      - name: Terraform Init
        id: init
        run: terraform init -upgrade
        working-directory: ./terraform

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color
        working-directory: ./terraform
        continue-on-error: true

      - name: Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Terraform Apply
        if: ${{ github.event.inputs.apply == 'true' }}
        run: terraform apply -auto-approve
        working-directory: ./terraform