Deploy tf #17225
Deploy tf #17225
Conversation
.github/actions/trivy/action.yml
Outdated
| exit-code: 1 | ||
| ignore-unfixed: true | ||
| vuln-type: os,library | ||
| severity: LOW,MEDIUM,HIGH,CRITICAL |
There was a problem hiding this comment.
We don't need to check for LOW.
.github/actions/trivy/action.yml
Outdated
| ignore-unfixed: true | ||
| vuln-type: os,library | ||
| severity: LOW,MEDIUM,HIGH,CRITICAL | ||
| #MOVED LOCATION |
There was a problem hiding this comment.
No need for this comment
| @@ -3,18 +3,15 @@ name: Deploy Terraform | |||
| on: | |||
| push: | |||
| branches: | |||
| - main | |||
| - master | |||
There was a problem hiding this comment.
We've migrated from master to main,
| - name: Collect Terraform stats | ||
|
|
||
| uses: josiahsiegel/terraform-stats@68b8cbe42c494333fbf6f8d90ac86da1fb69dcc2 |
There was a problem hiding this comment.
replace with: uses: ./.github/actions/terraform-stats
| uses: josiahsiegel/terraform-stats@68b8cbe42c494333fbf6f8d90ac86da1fb69dcc2 | ||
| ## DevSecOps - Aquia (Replace) - uses: ./.github/actions/terraform-stats |
There was a problem hiding this comment.
No need for this comment anymore.
| - name: Check Out Changes | ||
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 | ||
| - name: Run Deprecation Check | ||
| run: ./scripts/check_deprecations.sh |
There was a problem hiding this comment.
This script needs to be added to this PR
| @@ -96,25 +93,7 @@ jobs: | |||
| steps: | |||
| - name: Check Out Changes | |||
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 | |||
| - name: Connect to VPN and login to Azure | |||
There was a problem hiding this comment.
We need this step to auth to Azure
| @@ -28,17 +28,15 @@ jobs: | |||
|
|
|||
| - name: "Create branch '${{ env.BRANCH_NAME }}' to contain the changes for the deployment on ${{ env.DEPLOYMENT_DATE }}" | |||
|
|
|||
| uses: JosiahSiegel/remote-branch-action@dbe7a2138eb064fbfdb980abee918091a7501fbe | |||
| ## DevSecOps - Aquia (Replace) - uses: ./.github/actions/remote-branch-action | |||
| uses: ./.github/actions/remote-branch-action | |||
There was a problem hiding this comment.
Should be uses: ./.github/actions/remote-branch to correspond to the directory name in the repo
|
|
||
| with: | ||
| branch: "${{ env.BRANCH_NAME }}" | ||
|
|
||
| - name: "Prepare a Pull Request from ${{ env.BRANCH_NAME }} into production branch" | ||
| id: pr | ||
|
|
||
| uses: JosiahSiegel/reliable-pull-request-action@ae8d0c88126329ee363a35392793d0bc94cb82e7 | ||
| ## DevSecOps - Aquia (Replace) - uses: ./.github/actions/reliable-pull-request-action | ||
| uses: ./.github/actions/reliable-pull-request-action |
There was a problem hiding this comment.
Should be uses: ./.github/actions/reliable-pull-request to correspond to directory name in the repo
| - production | ||
| paths: | ||
| - '**.tf' | ||
|
|
||
| env: |
There was a problem hiding this comment.
We need this env var to auth to Azure
| @@ -43,21 +51,8 @@ jobs: | |||
| steps: | |||
| - name: Check Out Changes | |||
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 | |||
| - name: Connect to VPN and login to Azure | |||
There was a problem hiding this comment.
We need this step to authenticate TF to Azure
| terraform fmt -recursive | ||
| terraform plan -out ${{ needs.pre_job.outputs.env_name }}-tf.plan | ||
| terraform apply -input=false -no-color -lock-timeout=600s -auto-approve ${{ needs.pre_job.outputs.env_name }}-tf.plan | ||
| terraform apply -input=false -no-color -lock-timeout=600s -auto-approve |
There was a problem hiding this comment.
I'd like to see some sanity and lint checks in here:
terraform workspace select -or-create ${{ needs.pre_job.outputs.env_name }}
terraform fmt -check -recursive # if this fails, run: 'tf fmt -recursive' and push again
terraform validate
We also need tf plan here and corresponding tfplan file in apply:
terraform plan -out ${{ needs.pre_job.outputs.env_name }}-tf.plan
terraform apply -input=false -no-color -lock-timeout=600s -auto-approve ${{ needs.pre_job.outputs.env_name }}-tf.plan
|
Handled elsewhere, closing. |
Workflow file was updated with deprecation check,