pipelines-drift-detection.yml

name: Pipelines
run-name: Drift Detection
on:
  workflow_call:
    inputs:
      # This field can be overriden to customize the runner used for pipelines
      # workflows.
      #
      # IMPORTANT: To use self-hosted runners this workflow must be hosted in
      # the same GitHub organization as your infra-live repository.
      # See https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-self-hosted-runners
      #
      # The value must be an escaped JSON string that will be decoded to the
      # jobs.runs-on field
      # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on
      #
      # For example:
      # - A simple github runner: "\"ubuntu-22.04\""
      # - A list of labels: "[\"self-hosted\", \"linux\"]"
      # - A map: "{group: \"ubuntu-runners\", labels: \"ubuntu-20.04-16core\"}"
      runner:
        type: string
        default: '"ubuntu-latest"'
      pipelines_drift_detection_filter:
        type: string
        default: ""
      pipelines_drift_detection_branch:
        type: string
        default: "drift-detection"
      api_base_url:
        type: string
        default: "https://api.prod.app.gruntwork.io/api/v1"
      pipelines_binary_url:
        type: string
        default: ""
        description: "Override where we fetch pipelines from, used for internal testing"
      pipelines_cli_version:
        type: string
        default: "v0.50.0"
        description: "For Gruntwork internal testing - the version of the pipelines CLI to use"
      pipelines_actions_repo:
        type: string
        default: "gruntwork-io/pipelines-actions"
        description: "Repository to fetch pipelines actions from (e.g. use your org/repo for self-hosted)"
      pipelines_actions_ref:
        type: string
        default: "v4.7.0"
        description: "For Gruntwork internal testing - the ref of the pipelines actions to use"
      pipelines_credentials_repo:
        type: string
        default: "gruntwork-io/pipelines-credentials"
        description: "Repository to fetch pipelines credentials from (e.g. use your org/repo for self-hosted)"
      pipelines_credentials_ref:
        type: string
        default: "v2.0.0"
        description: "For Gruntwork internal testing - the ref of the pipelines credentials to use"

    secrets:
      PIPELINES_READ_TOKEN:
        required: false
      PIPELINES_GRUNTWORK_READ_TOKEN:
        required: false
      PIPELINES_CUSTOMER_ORG_READ_TOKEN:
        required: false
      PR_CREATE_TOKEN:
        required: false
env:
  PIPELINES_CLI_VERSION: ${{ inputs.pipelines_cli_version }}
  PIPELINES_ACTIONS_REPO: ${{ inputs.pipelines_actions_repo }}
  PIPELINES_ACTIONS_REF: ${{ inputs.pipelines_actions_ref }}
  PIPELINES_CREDENTIALS_REPO: ${{ inputs.pipelines_credentials_repo }}
  PIPELINES_CREDENTIALS_REF: ${{ inputs.pipelines_credentials_ref }}
  BOILERPLATE_VERSION: v0.5.16
  GRUNTWORK_INSTALLER_VERSION: v0.0.40

jobs:
  determine_units:
    name: Detect Infrastructure Drift
    runs-on: ${{ fromJSON(inputs.runner) }}
    outputs:
      units: ${{ steps.determine-units.outputs.pipelines_units }}
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV
      - name: Checkout Pipelines Credentials
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: pipelines-credentials
          repository: ${{ env.PIPELINES_CREDENTIALS_REPO }}
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Pipeline Tokens
        id: pipelines-tokens
        uses: ./pipelines-credentials
        env:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }}
        with:
          token_requests: |
            [
              {"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"},
              {"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"}
            ]
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: pipelines-actions
          repository: ${{ env.PIPELINES_ACTIONS_REPO }}
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read || fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Check out repo code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Install Mise
        id: mise-toml
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        with:
          install: true
          cache: true
          version: 2026.4.11
          working_directory: "./infra-live-repo"

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}

      - name: Configure code auth
        uses: ./pipelines-actions/.github/actions/pipelines-code-auth
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Determine Units
        id: determine-units
        shell: bash
        env:
          DRIFT_DETECTION_FILTER: ${{ inputs.pipelines_drift_detection_filter }}
        run: |
          pipelines drift-detection determine-units --working-directory ./infra-live-repo --filter "$DRIFT_DETECTION_FILTER"

  pipelines_drift_detection:
    if: ${{ fromJSON(needs.determine_units.outputs.units)[0] != null }}
    runs-on: ${{ fromJSON(inputs.runner) }}
    needs: determine_units
    strategy:
      fail-fast: false
      max-parallel: 18
      matrix:
        unit: ${{ fromJSON(needs.determine_units.outputs.units) }}
    name: Detect Drift in ${{ matrix.unit.path }}
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV
      - name: Checkout Pipelines Credentials
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: pipelines-credentials
          repository: ${{ env.PIPELINES_CREDENTIALS_REPO }}
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Pipeline Tokens
        id: pipelines-tokens
        uses: ./pipelines-credentials
        env:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }}
        with:
          token_requests: |
            [
              {"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"},
              {"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"}
            ]
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: pipelines-actions
          repository: ${{ env.PIPELINES_ACTIONS_REPO }}
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read || fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Check out repo code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Install Mise
        id: mise-toml
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        with:
          install: true
          cache: true
          version: 2026.4.11
          working_directory: "./infra-live-repo"

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}

      - name: Configure code auth
        uses: ./pipelines-actions/.github/actions/pipelines-code-auth
        with:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Determine Drift
        id: determine-drift
        shell: bash
        env:
          DRIFT_DETECTION_FILTER: ${{ inputs.pipelines_drift_detection_filter }}
          GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}
          UNIT_ID: ${{ matrix.unit.id }}
          UNIT_PATH: ${{ matrix.unit.path }}
        run: |
          pipelines drift-detection determine-unit-drift \
            --working-directory ./infra-live-repo \
            --unit-path "$UNIT_PATH" \
            --unit-id "$UNIT_ID" \
            --filter "$DRIFT_DETECTION_FILTER"

      - name: "Upload result"
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: drift-detection-unit-${{ matrix.unit.id }}
          path: infra-live-repo/drift-detection-unit-${{ matrix.unit.id }}
          if-no-files-found: ignore
          retention-days: 1
          overwrite: true

  consolidate_jobs:
    name: Consolidate Jobs
    runs-on: ${{ fromJSON(inputs.runner) }}
    needs: pipelines_drift_detection
    steps:
      - name: Record workflow env vars
        env:
          PIPELINES_BINARY_URL: ${{ inputs.pipelines_binary_url }}
        run: |
          time_now=$(date -u +"%s")
          echo "PIPELINES_JOB_START_TIME=$time_now" >> $GITHUB_ENV
          echo "PIPELINES_BINARY_URL=$PIPELINES_BINARY_URL" >> $GITHUB_ENV
      - name: Checkout Pipelines Credentials
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: pipelines-credentials
          repository: ${{ env.PIPELINES_CREDENTIALS_REPO }}
          ref: ${{ env.PIPELINES_CREDENTIALS_REF }}

      - name: Fetch Pipeline Tokens
        id: pipelines-tokens
        uses: ./pipelines-credentials
        env:
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ secrets.PIPELINES_GRUNTWORK_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }}
          PIPELINES_CUSTOMER_ORG_READ_TOKEN: ${{ secrets.PIPELINES_CUSTOMER_ORG_READ_TOKEN || secrets.PIPELINES_READ_TOKEN }}
          PR_CREATE_TOKEN: ${{ secrets.PR_CREATE_TOKEN }}
        with:
          token_requests: |
            [
              {"name": "gruntwork_read", "path": "pipelines-read/gruntwork-io", "fallback_env": "PIPELINES_GRUNTWORK_READ_TOKEN"},
              {"name": "customer_org_read", "path": "pipelines-read/${{ github.repository_owner }}", "fallback_env": "PIPELINES_CUSTOMER_ORG_READ_TOKEN"},
              {"name": "propose_infra_change", "path": "propose-infra-change/${{ github.repository_owner }}", "fallback_env": "PR_CREATE_TOKEN"}
            ]
          api_base_url: ${{ inputs.api_base_url }}

      - name: Checkout Pipelines Actions
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: pipelines-actions
          repository: ${{ env.PIPELINES_ACTIONS_REPO }}
          ref: ${{ env.PIPELINES_ACTIONS_REF }}
          token: ${{ env.PIPELINES_ACTIONS_REPO == 'gruntwork-io/pipelines-actions' && fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read || fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Check out repo code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          path: infra-live-repo
          fetch-depth: 0
          token: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).customer_org_read }}

      - name: Install Pipelines CLI
        uses: ./pipelines-actions/.github/actions/pipelines-install
        with:
          version: ${{ env.PIPELINES_CLI_VERSION }}
          PIPELINES_GRUNTWORK_READ_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).gruntwork_read }}

      - name: "Consolidate Jobs"
        id: consolidate-jobs
        shell: bash
        env:
          AUTHOR_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
          AUTHOR_NAME: ${{ github.actor }}
          DRIFT_DETECTION_BRANCH: ${{ inputs.pipelines_drift_detection_branch || 'drift-detection' }}
          DRIFT_DETECTION_FILTER: ${{ inputs.pipelines_drift_detection_filter }}
          GH_TOKEN: ${{ fromJson(steps.pipelines-tokens.outputs.tokens_json).propose_infra_change }}
        run: |
          pipelines drift-detection consolidate-jobs \
            --working-directory "./infra-live-repo" \
            --filter "$DRIFT_DETECTION_FILTER" \
            --branch-name "$DRIFT_DETECTION_BRANCH" \
            --author-name "$AUTHOR_NAME" \
            --author-email "$AUTHOR_EMAIL"