Delete all production AWS resources #3845
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: build | |
| on: | |
| push: | |
| pull_request: | |
| repository_dispatch: | |
| types: [apb] | |
| env: | |
| CURL_CACHE_DIR: ~/.cache/curl | |
| PIP_CACHE_DIR: ~/.cache/pip | |
| PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit | |
| RUN_TMATE: ${{ secrets.RUN_TMATE }} | |
| jobs: | |
| diagnostics: | |
| name: Run diagnostics | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Note that a duplicate of this step must be added at the top of | |
| # each job. | |
| - id: harden-runner | |
| name: Harden the runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - id: github-status | |
| name: Check GitHub status | |
| uses: crazy-max/ghaction-github-status@v3 | |
| - id: dump-context | |
| name: Dump context | |
| uses: crazy-max/ghaction-dump-context@v2 | |
| lint: | |
| needs: | |
| - diagnostics | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: harden-runner | |
| name: Harden the runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - id: setup-env | |
| uses: cisagov/setup-env-github-action@develop | |
| - uses: actions/checkout@v4 | |
| - id: setup-python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.11' | |
| # We need the Go version and Go cache location for the actions/cache step, | |
| # so the Go installation must happen before that. | |
| - id: setup-go | |
| uses: actions/setup-go@v4 | |
| with: | |
| # There is no expectation for actual Go code so we disable caching as | |
| # it relies on the existence of a go.sum file. | |
| cache: false | |
| go-version: '1.20' | |
| - name: Lookup Go cache directory | |
| id: go-cache | |
| run: echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT | |
| - uses: actions/cache@v3 | |
| env: | |
| BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ | |
| py${{ steps.setup-python.outputs.python-version }}-\ | |
| go${{ steps.setup-go.outputs.go-version }}-\ | |
| tf${{ steps.setup-env.outputs.terraform-version }}-" | |
| with: | |
| # Note that the .terraform directory IS NOT included in the | |
| # cache because if we were caching, then we would need to use | |
| # the `-upgrade=true` option. This option blindly pulls down the | |
| # latest modules and providers instead of checking to see if an | |
| # update is required. That behavior defeats the benefits of caching. | |
| # so there is no point in doing it for the .terraform directory. | |
| path: | | |
| ${{ env.PIP_CACHE_DIR }} | |
| ${{ env.PRE_COMMIT_CACHE_DIR }} | |
| ${{ steps.go-cache.outputs.dir }} | |
| key: "${{ env.BASE_CACHE_KEY }}\ | |
| ${{ hashFiles('**/requirements-test.txt') }}-\ | |
| ${{ hashFiles('**/requirements.txt') }}-\ | |
| ${{ hashFiles('**/.pre-commit-config.yaml') }}" | |
| restore-keys: ${{ env.BASE_CACHE_KEY }} | |
| - uses: hashicorp/setup-terraform@v2 | |
| with: | |
| terraform_version: ${{ steps.setup-env.outputs.terraform-version }} | |
| - name: Install shfmt | |
| env: | |
| PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt | |
| PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }} | |
| run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
| - name: Install Terraform-docs | |
| env: | |
| PACKAGE_URL: github.com/terraform-docs/terraform-docs | |
| PACKAGE_VERSION: ${{ steps.setup-env.outputs.terraform-docs-version }} | |
| run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip setuptools wheel | |
| pip install --upgrade --requirement requirements-test.txt | |
| - name: Set up pre-commit hook environments | |
| run: pre-commit install-hooks | |
| - name: Create .env file needed by docker-compose-check pre-commit hook | |
| run: cp dev.env.example .env | |
| - name: Run pre-commit on all files | |
| run: pre-commit run --all-files | |
| - name: Setup tmate debug session | |
| uses: mxschmitt/action-tmate@v3 | |
| if: env.RUN_TMATE |