main.yaml

name: Deploy Terraform Code to ACG 
defaults:
  run:
    shell: bash

on:
  push:
    branches:
      - master
  workflow_dispatch:

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  bitbucket_mirror:
    name: Mirror to Bitbucket
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the repository to the runner
        uses: actions/checkout@v4
        with: 
          ssh-known-hosts: 'bitbucket.org'
  tf_fmt_plan_000base:
    name: Terraform Format and Plan 000Base
    runs-on: ubuntu-latest
    environment: 'prod'
    defaults:
      run:
        working-directory: ./layers/000base
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout the repository to the runner
        uses: actions/checkout@v2
 
      - name: Setup Terraform with specified version on the runner
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.5
    
      - name: Terraform init
        id: init
        run: terraform init

      - name: Terraform format
        id: fmt
        run: terraform fmt -check
        continue-on-error: true

      - name: Terraform Plan
        id: plan
        run: terraform plan
  tf_apply_000base:
    name: Terraform Apply 000Base
    timeout-minutes: 30
    needs: tf_fmt_plan_000base
    runs-on: ubuntu-latest
    environment: 'prod'
    defaults:
      run:
        working-directory: ./layers/000base
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout the repository to the runner
        uses: actions/checkout@v2
      - name: Setup Terraform with specified version on the runner
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.5
      - name: Terraform init
        id: init
        run: terraform init
      - name: Terraform Apply
        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false
  tf_fmt_plan_100security:
    name: Terraform Format and Plan 100security
    needs: tf_apply_000base
    runs-on: ubuntu-latest
    environment: 'prod'
    defaults:
      run:
        working-directory: ./layers/100security
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout the repository to the runner
        uses: actions/checkout@v2
 
      - name: Setup Terraform with specified version on the runner
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.5
    
      - name: Terraform init
        id: init
        run: terraform init

      - name: Terraform format
        id: fmt
        run: terraform fmt -check
        continue-on-error: true

      - name: Terraform Plan
        id: plan
        run: terraform plan
  tf_apply_100Security:
    name: Terraform Apply 100Security
    timeout-minutes: 30
    needs: [tf_fmt_plan_100Security, tf_apply_000base]
    runs-on: ubuntu-latest
    environment: 'prod'
    defaults:
      run:
        working-directory: ./layers/100security
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout the repository to the runner
        uses: actions/checkout@v2
      - name: Setup Terraform with specified version on the runner
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.5
      - name: Terraform init
        id: init
        run: terraform init
      - name: Terraform Apply
        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false