Add inputs to specify a separate repository for custom actions #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pipelines | ||
| run-name: Unlock Gruntwork Pipelines | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| lock_id: | ||
| description: "The ID of the lock, usually a GUID. This is generally found in the console output when Terraform/OpenTofu command fails due to a timeout waiting to acquire a lock. (required if not running unlock_all)" | ||
| required: false | ||
| type: string | ||
| unit_path: | ||
| description: "Path to the Terragrunt Unit directory where the lock is held (everything up to but not including terragrunt.hcl - required if not running unlock_all)" | ||
| required: false | ||
| type: string | ||
| stack_path: | ||
| description: "Path to a Terragrunt Stack directory (everything up to but not including terragrunt.stack.hcl) that generates content required to run unlock in a specified Terragrunt Unit" | ||
| required: false | ||
| type: string | ||
| unlock_all: | ||
| description: "Forcibly reset all locks by deleting the dynamodb table" | ||
| required: false | ||
| type: boolean | ||
| # This field can be overriden to customize the runner used for pipelines | ||
| # workflows. | ||
| # | ||
| # IMPORTANT: To use self-hosted runners this workflow must be hosted in | ||
| # the same GitHub organization as your infra-live repository. | ||
| # See https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-self-hosted-runners | ||
| # | ||
| # The value must be an escaped JSON string that will be decoded to the | ||
| # jobs.runs-on field | ||
| # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on | ||
| # | ||
| # For example: | ||
| # - A simple github runner: "\"ubuntu-22.04\"" | ||
| # - A list of labels: "[\"self-hosted\", \"linux\"]" | ||
| # - A map: "{group: \"ubuntu-runners\", labels: \"ubuntu-20.04-16core\"}" | ||
| runner: | ||
| type: string | ||
| default: '"ubuntu-latest"' | ||
| api_base_url: | ||
| type: string | ||
| default: "https://api.prod.app.gruntwork.io/api/v1" | ||
| pipelines_binary_url: | ||
| type: string | ||
| default: "" | ||
| description: "Override where we fetch pipelines from, used for internal testing" | ||
| pipelines_cli_version: | ||
| type: string | ||
| <<<<<<< HEAD | ||
| default: "v0.49.1" | ||
| ======= | ||
| default: "v0.50.0" | ||
| >>>>>>> 6699a9b (Add job and account_names inputs to custom actions) | ||
| description: "For Gruntwork internal testing - the version of the pipelines CLI to use" | ||
| pipelines_actions_repo: | ||
| type: string | ||
| default: "gruntwork-io/pipelines-actions" | ||
| description: "Repository to fetch pipelines actions from (e.g. use your org/repo for self-hosted)" | ||
| pipelines_actions_ref: | ||
| type: string | ||
| <<<<<<< HEAD | ||
| default: "v4.5.2" | ||
| ======= | ||
| default: "v4.6.0" | ||
| >>>>>>> 6699a9b (Add job and account_names inputs to custom actions) | ||
| description: "For Gruntwork internal testing - the ref of the pipelines actions to use" | ||
| pipelines_credentials_repo: | ||
| type: string | ||
| default: "gruntwork-io/pipelines-credentials" | ||
| description: "Repository to fetch pipelines credentials from (e.g. use your org/repo for self-hosted)" | ||
| pipelines_credentials_ref: | ||
| type: string | ||
| default: "v2.0.0" | ||
| description: "For Gruntwork internal testing - the ref of the pipelines credentials to use" | ||
| secrets: | ||
| PIPELINES_READ_TOKEN: | ||
| required: false | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: | ||
| required: false | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: | ||
| required: false | ||
| env: | ||
| PIPELINES_CLI_VERSION: ${{ inputs.pipelines_cli_version }} | ||
| PIPELINES_ACTIONS_REPO: ${{ inputs.pipelines_actions_repo }} | ||
| PIPELINES_ACTIONS_REF: ${{ inputs.pipelines_actions_ref }} | ||
| PIPELINES_CREDENTIALS_REPO: ${{ inputs.pipelines_credentials_repo }} | ||
| PIPELINES_CREDENTIALS_REF: ${{ inputs.pipelines_credentials_ref }} | ||
| jobs: | ||
| unlock_one: | ||
| name: Unlock a single TF State | ||
| if: ${{ !inputs.unlock_all }} | ||
| runs-on: ${{ fromJSON(inputs.runner) }} | ||
| steps: | ||
| - name: Record workflow env vars | ||
| env: | ||
| PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }} | ||
| run: | | ||
| time_now=$(date -u +"%s") | ||
| echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV | ||
| echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV | ||
| - name: Checkout Pipelines Credentials | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: pipelines-credentials | ||
| repository: ${{ env.PIPELINES_CREDENTIALS_REPO }} | ||
| ref: ${{ env.PIPELINES_CREDENTIALS_REF }} | ||
| - name: Fetch Pipeline Tokens | ||
| id: pipelines-tokens | ||
| uses: ./pipelines-credentials | ||
| env: | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }} | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }} | ||
| with: | ||
| token_requests: | | ||
| [ | ||
| {"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"}, | ||
| {"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"} | ||
| ] | ||
| api_base_url: ${{ inputs.api_base_url }} | ||
| - name: Checkout Pipelines Actions | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: pipelines-actions | ||
| repository: ${{ env.PIPELINES_ACTIONS_REPO }} | ||
| ref: ${{ env.PIPELINES_ACTIONS_REF }} | ||
| token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read || fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Check out repo code | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: infra-live-repo | ||
| fetch-depth: 0 | ||
| token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Install Mise | ||
| id: mise-toml | ||
| uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 | ||
| with: | ||
| install: true | ||
| cache: true | ||
| version: 2026.4.11 | ||
| working_directory: "./infra-live-repo" | ||
| - name: Test Terraform, OpenTofu and Terragrunt | ||
| shell: bash | ||
| working-directory: "./infra-live-repo" | ||
| run: | | ||
| tofu --version || true | ||
| terraform --version || true | ||
| terragrunt --version | ||
| - name: Install Pipelines CLI | ||
| uses: ./pipelines-actions/.github/actions/pipelines-install | ||
| with: | ||
| version: ${{ env.PIPELINES_CLI_VERSION }} | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }} | ||
| - name: Configure code auth | ||
| uses: ./pipelines-actions/.github/actions/pipelines-code-auth | ||
| with: | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }} | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Pipelines Unlock Unit | ||
| shell: bash | ||
| working-directory: "./infra-live-repo" | ||
| env: | ||
| UNLOCK_UNIT_PATH: ${{ inputs.unit_path }} | ||
| UNLOCK_UNIT_LOCK_ID: ${{ inputs.lock_id }} | ||
| UNLOCK_UNIT_STACK_PATH: ${{ inputs.stack_path }} | ||
| GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| run: | | ||
| pipelines unlock unit \ | ||
| --unit-path "$UNLOCK_UNIT_PATH" \ | ||
| --lock-id "$UNLOCK_UNIT_LOCK_ID" \ | ||
| --stack-path "$UNLOCK_UNIT_STACK_PATH" \ | ||
| --working-directory . | ||
| unlock_all: | ||
| name: Unlock all TF State files | ||
| if: ${{ inputs.unlock_all }} | ||
| runs-on: ${{ fromJSON(inputs.runner) }} | ||
| steps: | ||
| - name: Record workflow env vars | ||
| env: | ||
| PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }} | ||
| run: | | ||
| time_now=$(date -u +"%s") | ||
| echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV | ||
| echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV | ||
| - name: Checkout Pipelines Credentials | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: pipelines-credentials | ||
| repository: ${{ env.PIPELINES_CREDENTIALS_REPO }} | ||
| ref: ${{ env.PIPELINES_CREDENTIALS_REF }} | ||
| - name: Fetch Pipeline Tokens | ||
| id: pipelines-tokens | ||
| uses: ./pipelines-credentials | ||
| env: | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }} | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }} | ||
| with: | ||
| token_requests: | | ||
| [ | ||
| {"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"}, | ||
| {"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"} | ||
| ] | ||
| api_base_url: ${{ inputs.api_base_url }} | ||
| - name: Checkout Pipelines Actions | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: pipelines-actions | ||
| repository: ${{ env.PIPELINES_ACTIONS_REPO }} | ||
| ref: ${{ env.PIPELINES_ACTIONS_REF }} | ||
| token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read || fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Check out repo code | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: infra-live-repo | ||
| fetch-depth: 0 | ||
| token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Install Mise | ||
| id: mise-toml | ||
| uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 | ||
| with: | ||
| install: true | ||
| cache: true | ||
| version: 2026.4.11 | ||
| working_directory: "./infra-live-repo" | ||
| - name: Test Terraform, OpenTofu and Terragrunt | ||
| shell: bash | ||
| working-directory: "./infra-live-repo" | ||
| run: | | ||
| tofu --version || true | ||
| terraform --version || true | ||
| terragrunt --version | ||
| - name: Install Pipelines CLI | ||
| uses: ./pipelines-actions/.github/actions/pipelines-install | ||
| with: | ||
| version: ${{ env.PIPELINES_CLI_VERSION }} | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }} | ||
| - name: Configure code auth | ||
| uses: ./pipelines-actions/.github/actions/pipelines-code-auth | ||
| with: | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }} | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Unlock All | ||
| id: unlock_tables | ||
| shell: bash | ||
| working-directory: "./infra-live-repo" | ||
| env: | ||
| GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| run: | | ||
| pipelines unlock all --working-directory . | ||
| outputs: | ||
| reinit_unit_paths: ${{ steps.unlock_tables.outputs.pipelines_units_to_init }} | ||
| pipelines_reinit: | ||
| name: "Rerun init in ${{ matrix.unit_path }}" | ||
| needs: [unlock_all] | ||
| runs-on: ${{ fromJSON(inputs.runner) }} | ||
| if: ${{ inputs.unlock_all }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| unit_path: ${{ fromJson(needs.unlock_all.outputs.reinit_unit_paths) }} | ||
| steps: | ||
| - name: Record workflow env vars | ||
| env: | ||
| PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }} | ||
| run: | | ||
| time_now=$(date -u +"%s") | ||
| echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV | ||
| echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV | ||
| - name: Checkout Pipelines Credentials | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: pipelines-credentials | ||
| repository: ${{ env.PIPELINES_CREDENTIALS_REPO }} | ||
| ref: ${{ env.PIPELINES_CREDENTIALS_REF }} | ||
| - name: Fetch Pipeline Tokens | ||
| id: pipelines-tokens | ||
| uses: ./pipelines-credentials | ||
| env: | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }} | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }} | ||
| with: | ||
| token_requests: | | ||
| [ | ||
| {"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"}, | ||
| {"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"} | ||
| ] | ||
| api_base_url: ${{ inputs.api_base_url }} | ||
| - name: Checkout Pipelines Actions | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: pipelines-actions | ||
| repository: ${{ env.PIPELINES_ACTIONS_REPO }} | ||
| ref: ${{ env.PIPELINES_ACTIONS_REF }} | ||
| token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read || fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Check out repo code | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| path: infra-live-repo | ||
| fetch-depth: 0 | ||
| token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Install Mise | ||
| id: mise-toml | ||
| uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 | ||
| with: | ||
| install: true | ||
| cache: true | ||
| version: 2026.4.11 | ||
| working_directory: "./infra-live-repo" | ||
| - name: Test Terraform, OpenTofu and Terragrunt | ||
| shell: bash | ||
| working-directory: "./infra-live-repo" | ||
| run: | | ||
| tofu --version || true | ||
| terraform --version || true | ||
| terragrunt --version | ||
| - name: Install Pipelines CLI | ||
| uses: ./pipelines-actions/.github/actions/pipelines-install | ||
| with: | ||
| version: ${{ env.PIPELINES_CLI_VERSION }} | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }} | ||
| - name: Configure code auth | ||
| uses: ./pipelines-actions/.github/actions/pipelines-code-auth | ||
| with: | ||
| PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }} | ||
| PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| - name: Pipelines Reinit Unit | ||
| shell: bash | ||
| working-directory: "./infra-live-repo" | ||
| env: | ||
| UNIT_PATH: ${{ matrix.unit_path }} | ||
| GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }} | ||
| run: | | ||
| pipelines unlock reinit --unit-path "$UNIT_PATH" --working-directory . | ||
