.github/workflows/pipelines-drift-detection.yml

Add inputs to specify a separate repository for custom actions #1

Workflow file for this run

.github/workflows/pipelines-drift-detection.yml at 08ba231

	name: Pipelines
	run-name: Drift Detection
	on:
	workflow_call:
	inputs:
	# This field can be overriden to customize the runner used for pipelines
	# workflows.
	#
	# IMPORTANT: To use self-hosted runners this workflow must be hosted in
	# the same GitHub organization as your infra-live repository.
	# See https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-self-hosted-runners
	#
	# The value must be an escaped JSON string that will be decoded to the
	# jobs.runs-on field
	# See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on
	#
	# For example:
	# - A simple github runner: "\"ubuntu-22.04\""
	# - A list of labels: "[\"self-hosted\", \"linux\"]"
	# - A map: "{group: \"ubuntu-runners\", labels: \"ubuntu-20.04-16core\"}"
	runner:
	type: string
	default: '"ubuntu-latest"'
	pipelines_drift_detection_filter:
	type: string
	default: ""
	pipelines_drift_detection_branch:
	type: string
	default: "drift-detection"
	api_base_url:
	type: string
	default: "https://api.prod.app.gruntwork.io/api/v1"
	pipelines_binary_url:
	type: string
	default: ""
	description: "Override where we fetch pipelines from, used for internal testing"
	pipelines_cli_version:
	type: string
	<<<<<<< HEAD
Check failure on line 39 in .github/workflows/pipelines-drift-detection.yml View workflow run for this annotation GitHub Actions / .github/workflows/pipelines-drift-detection.yml Invalid workflow file `You have an error in your yaml syntax on line 39`
	default: "v0.49.1"
	=======
	default: "v0.50.0"
	>>>>>>> 6699a9b (Add job and account_names inputs to custom actions)
	description: "For Gruntwork internal testing - the version of the pipelines CLI to use"
	pipelines_actions_repo:
	type: string
	default: "gruntwork-io/pipelines-actions"
	description: "Repository to fetch pipelines actions from (e.g. use your org/repo for self-hosted)"
	pipelines_actions_ref:
	type: string
	<<<<<<< HEAD
	default: "v4.5.2"
	=======
	default: "v4.6.0"
	>>>>>>> 6699a9b (Add job and account_names inputs to custom actions)
	description: "For Gruntwork internal testing - the ref of the pipelines actions to use"
	pipelines_credentials_repo:
	type: string
	default: "gruntwork-io/pipelines-credentials"
	description: "Repository to fetch pipelines credentials from (e.g. use your org/repo for self-hosted)"
	pipelines_credentials_ref:
	type: string
	default: "v2.0.0"
	description: "For Gruntwork internal testing - the ref of the pipelines credentials to use"

	secrets:
	PIPELINES_READ_TOKEN:
	required: false
	PIPELINES_GRUNTWORK_READ_TOKEN:
	required: false
	PIPELINES_CUSTOMER_ORG_READ_TOKEN:
	required: false
	PR_CREATE_TOKEN:
	required: false
	env:
	PIPELINES_CLI_VERSION: ${{ inputs.pipelines_cli_version }}
	PIPELINES_ACTIONS_REPO: ${{ inputs.pipelines_actions_repo }}
	PIPELINES_ACTIONS_REF: ${{ inputs.pipelines_actions_ref }}
	PIPELINES_CREDENTIALS_REPO: ${{ inputs.pipelines_credentials_repo }}
	PIPELINES_CREDENTIALS_REF: ${{ inputs.pipelines_credentials_ref }}
	BOILERPLATE_VERSION: v0.5.16
	GRUNTWORK_INSTALLER_VERSION: v0.0.40

	jobs:
	determine_units:
	name: Detect Infrastructure Drift
	runs-on: ${{ fromJSON(inputs.runner) }}
	outputs:
	units: ${{ steps.determine-units.outputs.pipelines_units }}
	steps:
	- name: Record workflow env vars
	env:
	PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
	run: \|
	time_now=$(date -u +"%s")
	echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
	echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV
	- name: Checkout Pipelines Credentials
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: pipelines-credentials
	repository: ${{ env.PIPELINES_CREDENTIALS_REPO }}
	ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

	- name: Fetch Pipeline Tokens
	id: pipelines-tokens
	uses: ./pipelines-credentials
	env:
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN \|\| secrets.PIPELINES_READ_TOKEN }}
	PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN \|\| secrets.PIPELINES_READ_TOKEN }}
	with:
	token_requests: \|
	[
	{"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"},
	{"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"}
	]
	api_base_url: ${{ inputs.api_base_url }}

	- name: Checkout Pipelines Actions
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: pipelines-actions
	repository: ${{ env.PIPELINES_ACTIONS_REPO }}
	ref: ${{ env.PIPELINES_ACTIONS_REF }}
	token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read \|\| fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Check out repo code
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: infra-live-repo
	fetch-depth: 0
	token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Install Mise
	id: mise-toml
	uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
	with:
	install: true
	cache: true
	version: 2026.4.11
	working_directory: "./infra-live-repo"

	- name: Install Pipelines CLI
	uses: ./pipelines-actions/.github/actions/pipelines-install
	with:
	version: ${{ env.PIPELINES_CLI_VERSION }}
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}

	- name: Configure code auth
	uses: ./pipelines-actions/.github/actions/pipelines-code-auth
	with:
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}
	PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Determine Units
	id: determine-units
	shell: bash
	env:
	DRIFT_DETECTION_FILTER: ${{ inputs.pipelines_drift_detection_filter }}
	run: \|
	pipelines drift-detection determine-units --working-directory ./infra-live-repo --filter "$DRIFT_DETECTION_FILTER"

	pipelines_drift_detection:
	if: ${{ fromJSON(needs.determine_units.outputs.units)[0] != null }}
	runs-on: ${{ fromJSON(inputs.runner) }}
	needs: determine_units
	strategy:
	fail-fast: false
	max-parallel: 18
	matrix:
	unit: ${{ fromJSON(needs.determine_units.outputs.units) }}
	name: Detect Drift in ${{ matrix.unit.path }}
	steps:
	- name: Record workflow env vars
	env:
	PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
	run: \|
	time_now=$(date -u +"%s")
	echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
	echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV
	- name: Checkout Pipelines Credentials
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: pipelines-credentials
	repository: ${{ env.PIPELINES_CREDENTIALS_REPO }}
	ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

	- name: Fetch Pipeline Tokens
	id: pipelines-tokens
	uses: ./pipelines-credentials
	env:
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN \|\| secrets.PIPELINES_READ_TOKEN }}
	PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN \|\| secrets.PIPELINES_READ_TOKEN }}
	with:
	token_requests: \|
	[
	{"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"},
	{"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"}
	]
	api_base_url: ${{ inputs.api_base_url }}

	- name: Checkout Pipelines Actions
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: pipelines-actions
	repository: ${{ env.PIPELINES_ACTIONS_REPO }}
	ref: ${{ env.PIPELINES_ACTIONS_REF }}
	token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read \|\| fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Check out repo code
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: infra-live-repo
	fetch-depth: 0
	token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Install Mise
	id: mise-toml
	uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
	with:
	install: true
	cache: true
	version: 2026.4.11
	working_directory: "./infra-live-repo"

	- name: Install Pipelines CLI
	uses: ./pipelines-actions/.github/actions/pipelines-install
	with:
	version: ${{ env.PIPELINES_CLI_VERSION }}
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}

	- name: Configure code auth
	uses: ./pipelines-actions/.github/actions/pipelines-code-auth
	with:
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}
	PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Determine Drift
	id: determine-drift
	shell: bash
	env:
	DRIFT_DETECTION_FILTER: ${{ inputs.pipelines_drift_detection_filter }}
	GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}
	UNIT_ID: ${{ matrix.unit.id }}
	UNIT_PATH: ${{ matrix.unit.path }}
	run: \|
	pipelines drift-detection determine-unit-drift \
	--working-directory ./infra-live-repo \
	--unit-path "$UNIT_PATH" \
	--unit-id "$UNIT_ID" \
	--filter "$DRIFT_DETECTION_FILTER"

	- name: "Upload result"
	uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
	with:
	name: drift-detection-unit-${{ matrix.unit.id }}
	path: infra-live-repo/drift-detection-unit-${{ matrix.unit.id }}
	if-no-files-found: ignore
	retention-days: 1
	overwrite: true

	consolidate_jobs:
	name: Consolidate Jobs
	runs-on: ${{ fromJSON(inputs.runner) }}
	needs: pipelines_drift_detection
	steps:
	- name: Record workflow env vars
	env:
	PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
	run: \|
	time_now=$(date -u +"%s")
	echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
	echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV
	- name: Checkout Pipelines Credentials
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: pipelines-credentials
	repository: ${{ env.PIPELINES_CREDENTIALS_REPO }}
	ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

	- name: Fetch Pipeline Tokens
	id: pipelines-tokens
	uses: ./pipelines-credentials
	env:
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN \|\| secrets.PIPELINES_READ_TOKEN }}
	PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN \|\| secrets.PIPELINES_READ_TOKEN }}
	PR_CREATE_TOKEN: ${{ secrets.PR_CREATE_TOKEN }}
	with:
	token_requests: \|
	[
	{"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"},
	{"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"},
	{"name": "propose_infra_change", "path": "propose-infra-change/${{ github.repository_owner }}", "fallback_env": "PR_CREATE_TOKEN"}
	]
	api_base_url: ${{ inputs.api_base_url }}

	- name: Checkout Pipelines Actions
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: pipelines-actions
	repository: ${{ env.PIPELINES_ACTIONS_REPO }}
	ref: ${{ env.PIPELINES_ACTIONS_REF }}
	token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read \|\| fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Check out repo code
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	path: infra-live-repo
	fetch-depth: 0
	token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

	- name: Install Pipelines CLI
	uses: ./pipelines-actions/.github/actions/pipelines-install
	with:
	version: ${{ env.PIPELINES_CLI_VERSION }}
	PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}

	- name: "Consolidate Jobs"
	id: consolidate-jobs
	shell: bash
	env:
	AUTHOR_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
	AUTHOR_NAME: ${{ github.actor }}
	DRIFT_DETECTION_BRANCH: ${{ inputs.pipelines_drift_detection_branch \|\| 'drift-detection' }}
	DRIFT_DETECTION_FILTER: ${{ inputs.pipelines_drift_detection_filter }}
	GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).propose_infra_change }}
	run: \|
	pipelines drift-detection consolidate-jobs \
	--working-directory "./infra-live-repo" \
	--filter "$DRIFT_DETECTION_FILTER" \
	--branch-name "$DRIFT_DETECTION_BRANCH" \
	--author-name "$AUTHOR_NAME" \
	--author-email "$AUTHOR_EMAIL"

Navigation Menu

Uh oh!

Add inputs to specify a separate repository for custom actions #1

Workflow file

Add inputs to specify a separate repository for custom actions #1

Uh oh!

Workflow file for this run

GitHub Actions / .github/workflows/pipelines-drift-detection.yml