This repository was archived by the owner on Jan 13, 2025. It is now read-only.

Check for infrastructure drift #57

	name: Check for infrastructure drift

	on:
	schedule:
	- cron: "0 8 * * *"

	permissions:
	id-token: write
	contents: read

	jobs:
	check_drift:
	runs-on: ubuntu-latest
	name: Check for drift of terraform configuration

	strategy:
	fail-fast: false
	matrix:
	branch: [ production ]
	context: [ infrastructure, applications ]

	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	VAULT_ADDR: "https://vault.presentium.ch"

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	ref: ${{ matrix.branch }}

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	aws-region: ${{ vars.AWS_REGION }}
	role-to-assume: ${{ vars.AWS_ARN }}

	- name: Login to vault
	uses: hashicorp/vault-action@v3
	with:
	url: ${{ env.VAULT_ADDR }}
	method: jwt
	path: jwt-github-actions
	role: github-actions-read-only
	exportToken: true

	- name: Add environment variables
	shell: bash
	run: \|-
	echo "${{ secrets.INFRASTRUCTURE_TFVARS }}" \| base64 -d > infrastructure/secrets.auto.tfvars
	echo "${{ secrets.APPLICATIONS_TFVARS }}" \| base64 -d > applications/secrets.auto.tfvars

	- name: Check for drift
	uses: ./.github/actions/terraform-check
	with:
	path: ${{ matrix.context }}

Provide feedback