deploy.yml

name: Deploy Infrastructure

on:
  push:
    branches: [main]
    paths:
      - 'modern/terraform/**'
      - 'modern/cloud-config/**'
      - 'modern/packer/**'
      - '.github/workflows/deploy.yml'
  pull_request:
    branches: [main]
    paths:
      - 'modern/terraform/**'
      - 'modern/cloud-config/**'
      - 'modern/packer/**'

env:
  AWS_REGION: us-east-1
  TF_VERSION: "1.9.0"
  TF_WORKING_DIR: modern/terraform

permissions:
  contents: read

jobs:
  ###############################################################
  # Validate — runs on every PR and push
  ###############################################################
  validate:
    name: Validate
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Format Check
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform fmt -check -recursive

      - name: Validate cloud-config YAML
        run: |
          sudo apt-get install -y cloud-init
          cloud-init schema --config-file modern/cloud-config/cloud-config-standalone.yaml

  ###############################################################
  # Plan — runs on every PR; posts plan output as PR comment
  ###############################################################
  plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    needs: validate
    permissions:
      id-token: write       # Required for OIDC auth
      contents: read
      pull-requests: write  # Required to post plan as PR comment

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-terraform-role
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Init
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform init

      - name: Terraform Plan
        id: plan
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: |
          terraform plan \
            -var="instance_count=${{ vars.INSTANCE_COUNT || 1 }}" \
            -var="environment=${{ vars.ENVIRONMENT || 'dev' }}" \
            -out=tfplan \
            -no-color 2>&1 | tee plan_output.txt
        continue-on-error: true

      - name: Post Plan to PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const plan = fs.readFileSync('${{ env.TF_WORKING_DIR }}/plan_output.txt', 'utf8');
            const truncated = plan.length > 60000 ? plan.slice(0, 60000) + '\n\n[truncated]' : plan;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## Terraform Plan\n\`\`\`terraform\n${truncated}\n\`\`\``
            });

      - name: Fail if plan errored
        if: steps.plan.outcome == 'failure'
        run: exit 1

      - name: Upload Plan Artifact
        uses: actions/upload-artifact@v4
        with:
          name: tfplan
          path: ${{ env.TF_WORKING_DIR }}/tfplan
          retention-days: 1

  ###############################################################
  # Build Packer AMI — runs on merge to main only
  ###############################################################
  build-ami:
    name: Build Packer AMI
    runs-on: ubuntu-latest
    needs: validate
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    permissions:
      id-token: write
      contents: read

    outputs:
      ami_id: ${{ steps.build.outputs.ami_id }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-packer-role
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Packer
        uses: hashicorp/setup-packer@v3

      - name: Packer Init
        working-directory: modern/packer
        run: packer init .

      - name: Packer Validate
        working-directory: modern/packer
        run: packer validate .

      - name: Packer Build
        id: build
        working-directory: modern/packer
        run: |
          packer build -machine-readable . | tee build_output.txt
          AMI_ID=$(grep 'artifact,0,id' build_output.txt | cut -d: -f2)
          echo "ami_id=${AMI_ID}" >> $GITHUB_OUTPUT

  ###############################################################
  # Apply — runs on merge to main; requires manual approval
  ###############################################################
  apply:
    name: Terraform Apply
    runs-on: ubuntu-latest
    needs: [plan, build-ami]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment: production   # Requires manual approval in GitHub Environments
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-terraform-role
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Init
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform init

      - name: Download Plan Artifact
        uses: actions/download-artifact@v4
        with:
          name: tfplan
          path: ${{ env.TF_WORKING_DIR }}

      - name: Terraform Apply
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform apply -auto-approve tfplan