actions-template/.github/workflows/iac-secrets.yml at 9223a8e6885ba38c9be07e2bdc0de27f5b62d450 · signalwire/actions-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
name: 'Secrets GitHub Actions'
on:
  workflow_call:
    inputs:
      TELEPORT_PROXY_URL:
        required: false
        type: string
        default: ''
        description: Default Teleport URL
      GCP_WIP:
        required: false
        type: string
        default: ''
        description: GCP Workload Identity Provider
      PROJECT_ID:
        required: false
        type: string
        default: ''
        description: GCP Project ID
      WORKING_DIR:
        required: true
        type: string
        default: 'secrets'
        description: Working directory
    secrets:
      TELEPORT_TOKEN:
        required: false
        description: Teleport Token name
      VAULT_TOKEN:
        required: false
        description: A Vault token in case vault is required
      PAT_GIT:
        required: false
        description: A PAT token to clone the repository

jobs:
  terragrunt:
    name: 'Terraform Vault Secrets'
    runs-on: ubuntu-latest

    permissions: write-all

    steps:
      - name: Install dependencies
        run: |
          sudo apt update
          sudo apt install unzip git -yq

      - name: cleanup old checkout
        run: chmod +w -R ${GITHUB_WORKSPACE}; rm -rf ${GITHUB_WORKSPACE}/*;

      - name: 'Checkout'
        uses: actions/checkout@v4

      - name: Checkout actions
        uses: actions/checkout@v4
        with:
          repository: signalwire/actions-template
          ref: main
          path: actions

      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@v2.1.13'
        with:
          workload_identity_provider: ${{ inputs.GCP_WIP }}
          project_id: ${{ inputs.PROJECT_ID }}

      - name: Sops Binary Installer
        uses: mdgreenwald/mozilla-sops-action@v1.6.0
        with:
          version: 3.7.3

      - name: Authenticate against Teleport to use Vault
        id: teleportapp
        uses: ./actions/.github/actions/teleport
        env:
          TOKEN: ${{ secrets.TELEPORT_TOKEN }}
          PROXY_URL: ${{ inputs.TELEPORT_PROXY_URL }}
        with:
          TELEPORT_APP: vault

      - name: Configure Vault
        run: |
          echo VAULT_ADDR=https://${{ inputs.TELEPORT_PROXY_URL }} >> $GITHUB_ENV
          #echo VAULT_API_ADDR=https://${{ inputs.TELEPORT_PROXY_URL }} >> $GITHUB_ENV
          echo VAULT_CLIENT_TIMEOUT=120s >> $GITHUB_ENV
          cp ${{ steps.teleportapp.outputs.certificate-file }} ${{github.workspace}}/certificate-file
          echo VAULT_CLIENT_CERT=${{github.workspace}}/certificate-file >> $GITHUB_ENV
          cp ${{ steps.teleportapp.outputs.key-file }} ${{github.workspace}}/key-file
          echo VAULT_CLIENT_KEY=${{github.workspace}}/key-file >> $GITHUB_ENV
          echo VAULT_TOKEN=$VAULT_TOKEN >> $GITHUB_ENV
        env:
          VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}

      - uses: opentofu/setup-opentofu@main

      - name: Init
        id: init
        working-directory: ${{ inputs.WORKING_DIR }}
        run: |
          git config --global url."https://user:${{secrets.PAT_GIT}}@github.com".insteadOf "https://github.com"
          tofu init

      - name: Validate
        id: validate
        working-directory: ${{ inputs.WORKING_DIR }}
        run: |
          tofu validate -no-color

      - name: Plan
        id: plan
        continue-on-error: true
        working-directory: ${{ inputs.WORKING_DIR }}
        run: |
          tofu plan -no-color

      - uses: actions/github-script@v7
        if: github.event_name == 'pull_request'
        env:
          PLAN: "tofu\n${{ steps.plan.outputs.stdout }}"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### OpenTofu Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### OpenTofu Validation 🤖\`${{ steps.validate.outcome }}\`
            <details><summary>Validation Output</summary>

            \`\`\`\n
            ${{ steps.validate.outputs.stdout }}
            \`\`\`

            </details>

            #### OpenTofu Plan 📖\`${{ steps.plan.outcome }}\`

            <details><summary>Show Plan</summary>

            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`

            </details>

            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ inputs.WORKING_DIR }}\`, Workflow: \`${{ github.workflow }}\`*`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

      - name: Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        working-directory: ${{ inputs.WORKING_DIR }}
        id: apply
        run: |
          tofu apply --auto-approve

      - run: sudo chmod -R 777 /home/runner/_work/${{ github.event.repository.name }}
        continue-on-error: true