feat(infra): github action for targeted terraform proj (#1747)

* feat: github action for targeted terraform proj * chore: create tfvar for codedang deploy * chore: update terraform directory * chore: generate output file during tf plan * chore: set oicd permission and environment * chore: split deploy jobs * chore: use tf out option in cd-prod action
skkuding · Jul 15, 2024 · ce855d9 · ce855d9
1 parent 77cd5f4
commit ce855d9
Show file tree

Hide file tree

Showing 2 changed files with 109 additions and 8 deletions.
diff --git a/.github/workflows/cd-prod-target.yml b/.github/workflows/cd-prod-target.yml
@@ -0,0 +1,103 @@
+name: CD - Production Target
+
+on:
+  workflow_dispatch:
+    inputs:
+      terraform_project:
+        description: 'Select Terraform Project to Update'
+        required: true
+        type: choice
+        options:
+          - 'storage'
+          - 'network'
+
+permissions: # permissions to the job (for the OpenID Connection)
+  id-token: write
+  contents: read
+
+jobs:
+  deploy-terraform-target-project:
+    name: Deploy Terraform targeted Project
+    runs-on: ubuntu-latest
+    environment: production
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_FOR_DEPLOY }}
+          aws-region: ap-northeast-2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.5.2
+
+      - name: Create Terraform variable file
+        working-directory: ./apps/infra/production/${{ github.event.inputs.terraform_project }}
+        run: |
+          echo "$TFVARS_TARGET" >> terraform.tfvars
+        env:
+          TFVARS_TARGET: ${{ secrets.TFVARS_TARGET }}
+
+      - name: Terraform Init
+        working-directory: ./apps/infra/production/${{ github.event.inputs.terraform_project }}
+        run: terraform init
+
+      - name: Terraform Plan
+        working-directory: ./apps/infra/production/${{ github.event.inputs.terraform_project }}
+        run: terraform plan -input=false -out=plan.out
+
+      - name: Terraform Apply
+        working-directory: ./apps/infra/production/${{ github.event.inputs.terraform_project }}
+        run: terraform apply plan.out -input=false
+
+  deploy-terraform-codedang:
+    name: Deploy Terraform Codedang Project
+    runs-on: ubuntu-latest
+    needs: [deploy-terraform-target-project]
+    environment: production
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_FOR_DEPLOY }}
+          aws-region: ap-northeast-2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.5.2
+      - name: Create Terraform variable file
+        working-directory: ./apps/infra/production/codedang
+        run: |
+          echo "$TFVARS" >> terraform.tfvars
+          echo "$OAUTH_GITHUB" >> terraform.tfvars
+          echo "$OAUTH_KAKAO" >> terraform.tfvars
+        env:
+          TFVARS: ${{ secrets.TFVARS }}
+          OAUTH_GITHUB: ${{ secrets.OAUTH_GITHUB }}
+          OAUTH_KAKAO: ${{ secrets.OAUTH_KAKAO }}
+
+      - name: Terraform Init
+        working-directory: ./apps/infra/production/codedang
+        run: terraform init
+
+      - name: Terraform Plan
+        working-directory: ./apps/infra/production/codedang
+        run: terraform plan -input=false -out=plan.out
+
+      - name: Terraform Apply
+        working-directory: ./apps/infra/production/codedang
+        run: terraform apply plan.out -input=false
diff --git a/.github/workflows/cd-prod.yml b/.github/workflows/cd-prod.yml
@@ -13,7 +13,6 @@ permissions: # permissions to the job (for the OpenID Connection)
 
 jobs:
   # TODO: trigger Amplify deployment
-
   build-client-api:
     name: Build client-api image
     runs-on: ubuntu-latest
@@ -116,7 +115,7 @@ jobs:
           terraform_version: 1.5.2
 
       - name: Create Terraform variable file
-        working-directory: ./apps/infra/deploy
+        working-directory: ./apps/infra/production/codedang
         run: |
           echo "$TFVARS" >> terraform.tfvars
           echo "$OAUTH_GITHUB" >> terraform.tfvars
@@ -127,14 +126,13 @@ jobs:
           OAUTH_KAKAO: ${{ secrets.OAUTH_KAKAO }}
 
       - name: Terraform Init
-        working-directory: ./apps/infra/deploy
+        working-directory: ./apps/infra/production/codedang
         run: terraform init
 
-      # TODO: plan in the other job, and reuse the plan file
       - name: Terraform Plan
-        working-directory: ./apps/infra/deploy
-        run: terraform plan -target=module.codedang-infra -input=false
+        working-directory: ./apps/infra/production/codedang
+        run: terraform plan -input=false -out=plan.out
 
       - name: Terraform Apply
-        working-directory: ./apps/infra/deploy
-        run: terraform apply -target=module.codedang-infra -auto-approve -input=false
+        working-directory: ./apps/infra/production/codedang
+        run: terraform apply plan.out -input=false