engiflow/.github/workflows/teardown.yml at main · emanuellcs/engiflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
name: Teardown EngiFlow AWS

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

env:
  AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
  TF_WORKING_DIR: infra/terraform
  TF_STATE_KEY: ${{ vars.TF_STATE_KEY || 'engiflow/prod.tfstate' }}
  TF_VAR_api_image_tag: latest
  TF_VAR_web_image_tag: latest
  TF_VAR_frontend_public_base_url: ${{ vars.FRONTEND_PUBLIC_BASE_URL }}
  TF_VAR_budget_alert_email: ${{ vars.BUDGET_ALERT_EMAIL }}
  TF_VAR_ses_smtp_username: ${{ secrets.SES_SMTP_USERNAME }}
  TF_VAR_ses_smtp_password: ${{ secrets.SES_SMTP_PASSWORD }}

jobs:
  destroy:
    name: Emergency Destroy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Configure AWS credentials with OIDC
        uses: aws-actions/configure-aws-credentials@v6.1.1
        with:
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false

      - name: Terraform init
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: |
          terraform init \
            -backend-config="bucket=${{ vars.TF_STATE_BUCKET }}" \
            -backend-config="key=${{ env.TF_STATE_KEY }}" \
            -backend-config="region=${{ env.AWS_REGION }}" \
            -backend-config="dynamodb_table=${{ vars.TF_STATE_LOCK_TABLE }}" \
            -backend-config="encrypt=true"

      - name: Terraform destroy
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform destroy -auto-approve