Staging

.github/workflows/terraform-drift.yml

@@ -18,6 +18,7 @@ jobs:
     strategy:
       matrix:
         environment:
+          - shared
           - dev
           - staging
           - prod
@@ -30,27 +31,96 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      #################################################
+      # AWS
+      #################################################
+
       - name: Configure AWS Credentials via OIDC
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::123456789012:role/github-terraform-role
-          aws-region: eu-west-1
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      #################################################
+      # SETUP TERRAFORM
+      #################################################
 
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "1.8.5"
 
+      #################################################
+      # TERRAFORM BACKEND
+      #################################################
+
+      - name: Configure Terraform Backend
+        env:
+          TF_STATE_BUCKET: ${{ secrets.TF_STATE_BUCKET }}
+          TF_LOCK_TABLE: ${{ secrets.TF_LOCK_TABLE }}
+          AWS_REGION: us-east-1
+
+        working-directory: infra/environments/${{ matrix.environment }}
+
+        run: |
+
+          BACKEND_KEY="${{ matrix.environment }}/tf.tfstate"
+
+          cat > backend.hcl <<EOF
+          bucket         = "${TF_STATE_BUCKET}"
+          key            = "${BACKEND_KEY}"
+          region         = "${AWS_REGION}"
+          dynamodb_table = "${TF_LOCK_TABLE}"
+          encrypt        = true
+          EOF
+
+          echo "Backend:"
+          cat backend.hcl
+
+      #################################################
+      # TERRAFORM INIT
+      #################################################
+
       - name: Terraform Init
-        run: terraform init -input=false
+        working-directory: infra/environments/${{ matrix.environment }}
+
+        run: |
+          terraform init \
+            -backend-config=backend.hcl \
+            -input=false
+
+      #################################################
+      # TERRAFORM DRIFT CHECK
+      #################################################
 
       - name: Terraform Drift Check
+        working-directory: infra/environments/${{ matrix.environment }}
+
         run: |
+          set +e
+
           terraform plan \
             -detailed-exitcode \
-            -var-file=environments/${{ matrix.environment }}/terraform.tfvars
+            -input=false \
+            -no-color
+
+          EXIT_CODE=$?
+
+          echo "Terraform exit code: $EXIT_CODE"
+
+          # 0 = no changes
+          # 1 = Terraform error
+          # 2 = drift detected
+
+          if [ "$EXIT_CODE" -eq 1 ]; then
+            echo "Terraform encountered an error"
+            exit 1
+          fi
+
+          if [ "$EXIT_CODE" -eq 2 ]; then
+            echo "Terraform drift detected"
+            exit 2
+          fi
 
-      # Exit code meanings:
-      # 0 = no drift
-      # 1 = error
-      # 2 = drift detected
+          echo "No Terraform drift detected"
+          exit 0

.github/workflows/terraform.yml

@@ -10,6 +10,7 @@ on:
 
   pull_request:
     branches:
+      - develop
       - staging
       - main
 
@@ -18,9 +19,10 @@ on:
       action:
         description: "Terraform action"
         required: true
-        default: "apply"
+        default: "plan"
         type: choice
         options:
+          - plan
           - apply
           - destroy
 
@@ -29,16 +31,28 @@ on:
         required: true
         type: choice
         options:
+          - shared
           - dev
           - staging
           - prod
 
 concurrency:
-  group: terraform-${{ github.ref }}
+  group: terraform-${{ github.ref }}-${{ inputs.environment || 'auto' }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+  issues: write
+  pull-requests: write
+  security-events: write
+
 jobs:
 
+  #################################################
+  # DETERMINE TERRAFORM ENVIRONMENT
+  #################################################
+
   determine-env:
     runs-on: ubuntu-latest
 
@@ -47,31 +61,118 @@ jobs:
       tf_action: ${{ steps.setenv.outputs.tf_action }}
 
     steps:
-      - id: setenv
+
+      - name: Determine Environment
+        id: setenv
+        shell: bash
         run: |
 
+          #################################################
+          # MANUAL WORKFLOW
+          #################################################
+
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            echo "environment=${{ github.event.inputs.environment }}" >> $GITHUB_OUTPUT
-            echo "tf_action=${{ github.event.inputs.action }}" >> $GITHUB_OUTPUT
+
+            echo "Manual workflow detected"
+
+            echo "environment=${{ inputs.environment }}" >> "$GITHUB_OUTPUT"
+            echo "tf_action=${{ inputs.action }}" >> "$GITHUB_OUTPUT"
+
+            echo "Environment: ${{ inputs.environment }}"
+            echo "Action: ${{ inputs.action }}"
+
             exit 0
           fi
 
-          BRANCH="${GITHUB_REF#refs/heads/}"
 
-          if [[ "$BRANCH" == "develop" ]]; then
-            echo "environment=dev" >> $GITHUB_OUTPUT
+          #################################################
+          # PULL REQUEST
+          #################################################
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+
+            SOURCE_BRANCH="${{ github.head_ref }}"
+            TARGET_BRANCH="${{ github.base_ref }}"
+
+            echo "Pull request detected"
+            echo "Source branch: ${SOURCE_BRANCH}"
+            echo "Target branch: ${TARGET_BRANCH}"
+
+            case "$TARGET_BRANCH" in
 
-          elif [[ "$BRANCH" == "staging" ]]; then
-            echo "environment=staging" >> $GITHUB_OUTPUT
+              develop)
+                echo "environment=dev" >> "$GITHUB_OUTPUT"
+                echo "tf_action=plan" >> "$GITHUB_OUTPUT"
+                ;;
 
-          elif [[ "$BRANCH" == "main" ]]; then
-            echo "environment=prod" >> $GITHUB_OUTPUT
+              staging)
+                echo "environment=staging" >> "$GITHUB_OUTPUT"
+                echo "tf_action=plan" >> "$GITHUB_OUTPUT"
+                ;;
 
-          else
-            echo "environment=dev" >> $GITHUB_OUTPUT
+              main)
+                echo "environment=prod" >> "$GITHUB_OUTPUT"
+                echo "tf_action=plan" >> "$GITHUB_OUTPUT"
+                ;;
+
+              *)
+                echo "Unsupported PR target branch: ${TARGET_BRANCH}"
+                exit 1
+                ;;
+
+            esac
+
+            exit 0
           fi
 
-          echo "tf_action=apply" >> $GITHUB_OUTPUT
+
+          #################################################
+          # PUSH
+          #################################################
+
+          BRANCH="${GITHUB_REF#refs/heads/}"
+
+          echo "Push detected"
+          echo "Branch: ${BRANCH}"
+
+          case "$BRANCH" in
+
+            develop)
+
+              echo "environment=dev" >> "$GITHUB_OUTPUT"
+              echo "tf_action=apply" >> "$GITHUB_OUTPUT"
+              ;;
+
+            staging)
+
+              echo "environment=staging" >> "$GITHUB_OUTPUT"
+              echo "tf_action=apply" >> "$GITHUB_OUTPUT"
+              ;;
+
+            main)
+
+              echo "environment=prod" >> "$GITHUB_OUTPUT"
+              echo "tf_action=apply" >> "$GITHUB_OUTPUT"
+              ;;
+
+            feature/*)
+
+              echo "environment=dev" >> "$GITHUB_OUTPUT"
+              echo "tf_action=plan" >> "$GITHUB_OUTPUT"
+              ;;
+
+            *)
+
+              echo "Unsupported branch: ${BRANCH}"
+              exit 1
+              ;;
+
+          esac
+
+
+  #################################################
+  # TERRAFORM
+  #################################################
 
   terraform:
     needs: determine-env