From 835e47dbc19bda1ad93fb161c223004080a7c6b8 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 1 Apr 2025 11:40:07 -0400 Subject: [PATCH] add module release process --- .github/workflows/release.yml | 70 ---------------------- .github/workflows/terraform-release.yaml | 73 +++++++++++++++++++++++ .github/workflows/terraform-validate.yaml | 42 +++++++++++++ 3 files changed, 115 insertions(+), 70 deletions(-) delete mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/terraform-release.yaml create mode 100644 .github/workflows/terraform-validate.yaml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index c8ead3b..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,70 +0,0 @@ -# SCT-Engineering/release action -name: Do Release of Module - -# Controls when the workflow will run -on: - pull_request: - types: [opened, reopened, synchronize, labeled, unlabeled] - push: - branches: - - main - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -permissions: - id-token: write - contents: write - pull-requests: write - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - # This workflow contains a single job called "Release" - Release: - # The type of runner that the job will run on - runs-on: ["229685449397"] - if: "!startsWith(github.event.head_commit.message, 'bump:')" - - steps: - - uses: CSVD/gh-actions-checkout@v4 - id: checkout - with: - token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}" - fetch-depth: 0 - - - name: Setup GITHUB Credentials - id: github_credentials - uses: CSVD/gh-auth@main - with: - github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} - github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} - github_base_url: "${{ github.server_url }}/" - - - name: Create bump and changelog - uses: CSVD/commitizen-action@main - with: - github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }} - changelog_increment_filename: body.md - - - uses: CSVD/gh-actions-checkout@v4 - - run: | - date > generated.txt - # Note: the following account information will not work on GHES - git config user.name "github-actions[bot]" - git config user.email "{user.id}+{user.login}@users.noreply.github.e.it.census.gov" - git add . - git commit -m "generated" - git push - # - name: Push doc to Github Page - # uses: peaceiris/actions-gh-pages@v4 - # with: - # personal_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }} - # publish_branch: gh-pages - # publish_dir: ./site - # user_name: "github-actions[bot]" - # user_email: "github-actions[bot]@users.noreply.github.com" - # - name: Release - # uses: ncipollo/release-action@v1 - # with: - # tag: v${{ env.REVISION }} - # bodyFile: "body.md" - # skipIfReleaseExists: true diff --git a/.github/workflows/terraform-release.yaml b/.github/workflows/terraform-release.yaml new file mode 100644 index 0000000..90910bc --- /dev/null +++ b/.github/workflows/terraform-release.yaml @@ -0,0 +1,73 @@ +name: Terraform CI/CD +on: + workflow_dispatch: + pull_request: + types: [closed] + branches: + - main +jobs: + terraform-ci-cd: + runs-on: 229685449397 + permissions: + contents: write + + steps: + - name: Checkout code + uses: CSVD/gh-actions-checkout@v4 + + - name: Setup Terraform + uses: CSVD/gh-actions-setup-terraform@v3 + with: + terraform_version: "1.9.1" + + - name: Setup GITHUB Credentials + id: github_credentials + uses: CSVD/gh-auth@main + with: + github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} + github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} + github_app_id: ${{ vars.GH_APP_ID }} + + + - name: Debug Authentication + run: | + # Print the GitHub server URL + echo "GitHub Server URL: ${{ github.server_url }}" + + # Extract the host from the URL + HOST="${{ github.server_url }}" + HOST="${HOST#*//}" + HOST="${HOST%%/*}" + echo "GitHub Host: $HOST" + + # Check if token exists + if [[ -n "${{ steps.github_credentials.outputs.github_token }}" ]]; then + echo "Token generated successfully" + # Test the token with a simple GitHub API call (without exposing the token) + STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${{ steps.github_credentials.outputs.github_token }}" "${{ github.server_url }}/api/v3/user") + echo "API Test Status Code: $STATUS" + else + echo "No token was generated!" + fi + + - name: Setup GitHub CLI + run: | + # Force manual authentication since setup-git might not work with GitHub Enterprise + echo "${{ steps.github_credentials.outputs.github_token }}" > /tmp/token.txt + gh auth login --with-token --hostname "github.e.it.census.gov" < /tmp/token.txt + rm /tmp/token.txt + + # Test GitHub CLI auth status + gh auth status || echo "GitHub CLI authentication failed" + + - name: AWS Auth + id: aws_auth + uses: CSVD/aws-auth@main + with: + ecs: true + + - name: Run Terraform Module Release Action + uses: CSVD/terraform-module-release@main + with: + github-token: ${{ steps.github_credentials.outputs.github_token }} + working-directory: '.' diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml new file mode 100644 index 0000000..72829d8 --- /dev/null +++ b/.github/workflows/terraform-validate.yaml @@ -0,0 +1,42 @@ +name: Terraform Validate +on: + pull_request: + workflow_dispatch: + +jobs: + + terraform-validate: + runs-on: "229685449397" + permissions: + contents: write + steps: + - name: Checkout code + uses: CSVD/gh-actions-checkout@v4 + + - name: Setup Terraform + uses: CSVD/gh-actions-setup-terraform@v2 + with: + terraform_version: '1.7.3' + + - name: Validate Terraform Configuration + id: validate + uses: CSVD/terraform-validate@main + + - name: Check Validation/Test Results + if: always() + run: | + # Set default values if outputs are empty + IS_VALID="${{ steps.validate.outputs.is_valid }}" + TESTS_PASSED="${{ steps.validate.outputs.tests_passed }}" + + # If outputs are empty, set them to false + [ -z "$IS_VALID" ] && IS_VALID="false" + [ -z "$TESTS_PASSED" ] && TESTS_PASSED="false" + + if [[ "$IS_VALID" != "true" || "$TESTS_PASSED" != "true" ]]; then + echo "Validation or test errors found:" + echo "${{ steps.validate.outputs.stderr }}" + exit 1 + else + echo "All validations and tests passed successfully!" + fi