145 lines
4.2 KiB
YAML
145 lines
4.2 KiB
YAML
name: Auto-PR Check/Creation and TF/OpenTofu Plan
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches-ignore:
|
|
- "main"
|
|
- "renovate/**"
|
|
env:
|
|
OPENTOFU_VERSION: "1.10.6"
|
|
HC_VAULT_VERSION: "1.20.4"
|
|
|
|
jobs:
|
|
check-and-create-pr:
|
|
name: Check and Create PR
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Setting Vault Token
|
|
run: |
|
|
echo "VAULT_TOKEN=${{ secrets.VAULT_GITEA_TOKEN }}" >> $GITHUB_ENV
|
|
|
|
- name: Gotify Notification
|
|
uses: eikendev/gotify-action@master
|
|
with:
|
|
gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
|
|
gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
|
|
notification_title: "GITEA: PR Check @ Rinoa"
|
|
notification_message: "Checking for existing PR... 🔍"
|
|
|
|
- name: PR Check/Creation
|
|
uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
|
|
with:
|
|
url: ${{ secrets.TREZ_GITEA_URL }}
|
|
token: ${{ secrets.BOT_GITEA_TOKEN }}
|
|
pr-label: docker-compose,manual
|
|
assignee: ${{ github.actor }}
|
|
|
|
- name: Gotify Notification
|
|
uses: eikendev/gotify-action@master
|
|
with:
|
|
gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
|
|
gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
|
|
notification_title: "GITEA: PR Check @ Rinoa"
|
|
notification_message: "PR Check done 🎟️"
|
|
|
|
plan:
|
|
name: Terraform/OpenTofu Plan
|
|
needs: check-and-create-pr
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup OpenTofu / Terraform
|
|
uses: opentofu/setup-opentofu@v1.0.6
|
|
with:
|
|
version: ${{ env.OPENTOFU_VERSION }}
|
|
tofu_wrapper: true
|
|
|
|
- name: Generate .env from Hashicorp Vault
|
|
uses: https://git.trez.wtf/Trez/hc-vault-env@main
|
|
with:
|
|
HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
|
|
HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
|
|
HC_VAULT_AUTH: token
|
|
HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
|
|
HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
|
|
ENV_FILE_NAME: cloudflare/.env
|
|
|
|
- name: Export env vars from Vault .env
|
|
run: |
|
|
echo "🧩 Cleaning and loading cloudflare/.env into GitHub Actions environment..."
|
|
|
|
# 1️⃣ Strip any single or double quotes from the file to avoid invalid URIs or extra quoting
|
|
sed -i 's/[\"'\'']//g' cloudflare/.env
|
|
|
|
echo "✅ Cleaned .env content:"
|
|
cat cloudflare/.env
|
|
|
|
# 2️⃣ Load all vars into current shell
|
|
set -a
|
|
source cloudflare/.env
|
|
set +a
|
|
|
|
# 3️⃣ Export to GitHub Actions environment
|
|
while IFS='=' read -r key value; do
|
|
if [[ -n "$key" ]]; then
|
|
echo "$key=$value" >> $GITHUB_ENV
|
|
fi
|
|
done < cloudflare/.env
|
|
|
|
echo "🌍 Exported environment variables:"
|
|
grep -E 'AWS_|VAULT_' cloudflare/.env || true
|
|
|
|
- name: Run tofu init
|
|
uses: dnogu/tofu-init@v1
|
|
with:
|
|
working-directory: .
|
|
chdir: cloudflare
|
|
|
|
- name: Tofu Plan
|
|
id: tofu_plan
|
|
uses: dnogu/tofu-plan@v1
|
|
with:
|
|
working-directory: .
|
|
chdir: cloudflare
|
|
# destroy:
|
|
# refresh-only:
|
|
# refresh:
|
|
# replace:
|
|
# target:
|
|
# target-file:
|
|
# exclude:
|
|
# exclude-file:
|
|
# var:
|
|
# var-file:
|
|
# out:
|
|
# compact-warnings:
|
|
# detailed-exitcode:
|
|
# generate-config-out: .
|
|
# input: true
|
|
# json:
|
|
# lock:
|
|
# lock-timeout:
|
|
# no-color:
|
|
# concise:
|
|
# parallelism:
|
|
# state:
|
|
# show-sensitive:
|
|
# display-plan:
|
|
|
|
- name: Tofu Plan Comment
|
|
id: tofu_plan
|
|
uses: alexnorell/tofu-pr-commenter@v2.0.0
|
|
with:
|
|
commenter_type: plan
|
|
commenter_input: ${{ steps.tofu_plan.outputs.plan-output }}
|
|
commenter_exitcode: ${{ steps.tofu_plan.outputs.exitcode }} |