deploy.yaml

name: Deploy pipeline

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        default: 'staging'
        required: true
        type: environment
      config:
        description: 'The OpenTofu configuration to plan'
        default: 'staging'
        required: true
        type: choice
        options:
          - staging
          - production

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1

      - name: Initialize OpenTofu
        working-directory: ./tofu/config/${{ inputs.config }}
        run: tofu init

      # TODO: Add a manual approval step here. For now, we'll use GitHub
      # Actions' environment protection feature for sensitive environments.
      - name: Apply changes
        working-directory: ./tofu/config/${{ inputs.config }}
        run: tofu apply --auto-approve