workflow-pr.yml

name: PR Workflow

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

defaults:
  run:
    shell: bash

jobs:
  generate-tag:
    name: Generate tag
    uses: ./.github/workflows/generate-tag.yml

  generate-environment-workspace-name:
    runs-on: ubuntu-latest
    steps:
      - name: Generate workspace name
        id: name_workspace
        run: |
          workspace=${{ github.event.number }}${{ github.head_ref }}
          workspace=${workspace//-}
          workspace=${workspace//_}
          workspace=${workspace//\/}
          workspace=${workspace:0:11}
          workspace=$(echo ${workspace} | tr '[:upper:]' '[:lower:]')
          echo "name=${workspace}" >> $GITHUB_OUTPUT
          echo ${workspace}
    outputs:
      environment_workspace_name: ${{ steps.name_workspace.outputs.name }}

  static-analysis:
    name: Run static analysis checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: "0"
      - run: make check-code
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: results.sarif

  build:
    name: Build, Scan & Push Images
    needs: [generate-tag]
    uses: ./.github/workflows/build-push-images.yml
    with:
      docker_tag: ${{ needs.generate-tag.outputs.tag }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  plan-dev-account:
    name: TF Plan Dev Account
    uses: ./.github/workflows/account-deploy.yml
    with:
      plan_only: true
      workspace_name: development
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  plan-preproduction-account:
    name: TF Plan Preproduction Account
    uses: ./.github/workflows/account-deploy.yml
    with:
      plan_only: true
      workspace_name: preproduction
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  plan-production-account:
    name: TF Plan Production Account
    uses: ./.github/workflows/account-deploy.yml
    with:
      plan_only: true
      workspace_name: production
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  plan-preproduction-env:
    name: Plan Preproduction Environment
    needs: [generate-tag]
    uses: ./.github/workflows/env-deploy.yml
    with:
      plan_only: true
      workspace_name: preproduction
      version_tag: ${{ needs.generate-tag.outputs.tag }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      github_access_token: ${{ secrets.GITHUB_TOKEN }}

  plan-production-env:
    name: Plan Production Environment
    needs: [generate-tag]
    uses: ./.github/workflows/env-deploy.yml
    with:
      plan_only: true
      workspace_name: production
      version_tag: ${{ needs.generate-tag.outputs.tag }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      github_access_token: ${{ secrets.GITHUB_TOKEN }}

  deploy-pr-env:
    name: Deploy PR Environment
    needs:
      [
        build,
        static-analysis,
        generate-tag,
        generate-environment-workspace-name,
      ]
    uses: ./.github/workflows/env-deploy.yml
    with:
      workspace_name: ${{ needs.generate-environment-workspace-name.outputs.environment_workspace_name }}
      version_tag: ${{ needs.generate-tag.outputs.tag }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      github_access_token: ${{ secrets.GITHUB_TOKEN }}

  test-pr-env:
    name: Test PR Environment
    needs: [deploy-pr-env]
    uses: ./.github/workflows/env-test.yml
    with:
      base_url: ${{ needs.deploy-pr-env.outputs.base_url }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}