diff --git a/.github/workflows/modtest-dev.yaml b/.github/workflows/modtest-dev.yaml index f7e89d3..c98e5f1 100644 --- a/.github/workflows/modtest-dev.yaml +++ b/.github/workflows/modtest-dev.yaml @@ -2,6 +2,9 @@ name: "ModTest: dev" on: pull_request: + push: + branches: + - main jobs: modtest: diff --git a/.github/workflows/terraform.yaml b/.github/workflows/terraform.yaml index 3c54a0d..0df3f90 100644 --- a/.github/workflows/terraform.yaml +++ b/.github/workflows/terraform.yaml @@ -1,28 +1,79 @@ -name: "Gtag" +name: "Terraform Validate" on: workflow_dispatch: - pull_request: push: branches: - main - + +env: + GITHUB_OWNER: ${{ vars.GH_ORG }} + GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} + GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }} + TF_WORKSPACE: happypathway + TFE_TOKEN: ${{ secrets.TFE_TOKEN }} + jobs: - terraform: + setup-terraform: + outputs: + commit_sha: ${{ steps.checkout.outputs.commit }} + + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v4 + id: checkout + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3.1.2 + with: + terraform_version: ${{ vars.terraform_version }} + cli_config_credentials_token: ${{ secrets.TFE_TOKEN }} + cli_config_credentials_hostname: ${{ vars.terraform_api }} + + - name: terraform init + run: terraform init -upgrade + + - uses: actions/upload-artifact@master + name: Archive Configuration + if: github.ref == 'refs/heads/main' + with: + name: terraform_dir + path: .terraform + retention-days: 1 + include-hidden-files: true + + - uses: actions/upload-artifact@master + name: Archive Lockfile + if: github.ref == 'refs/heads/main' + with: + name: terraform_lockfile + path: .terraform.lock.hcl + retention-days: 1 + include-hidden-files: true + + terraform-validate: + needs: setup-terraform uses: HappyPathway/centralized-actions/.github/workflows/terraform-test.yml@main with: - terraform_version: ${{vars.TERRAFORM_VERSION}} - terraform_api: ${{vars.TERRAFORM_API}} - github_username: ${{vars.GH_USERNAME}} - github_email: ${{vars.GH_EMAIL}} - github_org: ${{ vars.GH_ORG }} + terraform_version: ${{ vars.terraform_version }} + terraform_api: ${{ vars.terraform_api }} + github_username: ${{ github.actor }} + github_email: ${{ github.actor }}@roknsound.com + github_org: ${{ github.repository_owner }} + setup_terraform: true + terraform_init: false + cache: ${{ github.workspace }} + download_cache: true + commit_sha: ${{ needs.setup-terraform.outputs.commit_sha }} secrets: TFE_TOKEN: ${{ secrets.TFE_TOKEN }} GH_TOKEN: ${{ secrets.GH_TOKEN }} - + GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }} + gtag: - if: ${{ github.event_name }} != "pull_request" - needs: terraform + needs: terraform-validate + if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' uses: HappyPathway/centralized-actions/.github/workflows/gtag.yml@main with: patch: true @@ -30,4 +81,4 @@ jobs: github_username: ${{ vars.GH_USERNAME }} github_email: ${{ vars.GH_EMAIL }} secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} \ No newline at end of file + GH_TOKEN: ${{ secrets.GH_TOKEN }} diff --git a/README.md b/README.md deleted file mode 100644 index 08a4172..0000000 --- a/README.md +++ /dev/null @@ -1,2 +0,0 @@ -# terraform-github-repo -Terraform Module diff --git a/collaborators.tf b/collaborators.tf index 12ee2d6..5ffe416 100644 --- a/collaborators.tf +++ b/collaborators.tf @@ -4,9 +4,7 @@ resource "github_repository_collaborator" "collaborators" { repository = github_repository.repo.name username = each.key permission = each.value - lifecycle { - ignore_changes = [ - permission - ] - } + depends_on = [ + github_repository.repo + ] } diff --git a/github_repo.tf b/github_repo.tf index b2bd8f0..c000836 100644 --- a/github_repo.tf +++ b/github_repo.tf @@ -17,9 +17,10 @@ resource "github_repository" "repo" { has_issues = var.github_has_issues has_wiki = var.github_has_wiki topics = var.github_repo_topics - gitignore_template = "Terraform" + gitignore_template = var.gitignore_template is_template = var.is_template archived = var.archived + homepage_url = var.homepage_url vulnerability_alerts = var.vulnerability_alerts lifecycle { ignore_changes = [ diff --git a/github_team_access.tf b/github_team_access.tf index f825ff8..c530e6a 100644 --- a/github_team_access.tf +++ b/github_team_access.tf @@ -24,4 +24,7 @@ resource "github_team_repository" "admin" { team_id ] } -} \ No newline at end of file + depends_on = [ + github_repository.repo + ] +} diff --git a/variables.tf b/variables.tf index ad7de82..4e066ca 100644 --- a/variables.tf +++ b/variables.tf @@ -203,3 +203,35 @@ variable "vulnerability_alerts" { type = bool default = false } + +variable gitignore_template { + default = null +} + +variable homepage_url { + default = null +} + +variable security_and_analysis { + description = <