workflow-pr.yml

name: PR Workflow

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

defaults:
  run:
    shell: bash

jobs:
  generate-tag:
    name: Generate tag
    uses: ./.github/workflows/generate-tag.yml

  generate-environment-workspace-name:
    runs-on: ubuntu-latest
    steps:
      - name: Generate workspace name
        id: name_workspace
        run: |
          workspace=${{ github.event.number }}${{ github.head_ref }}
          workspace=${workspace//-}
          workspace=${workspace//_}
          workspace=${workspace//\/}
          workspace=${workspace:0:11}
          workspace=$(echo ${workspace} | tr '[:upper:]' '[:lower:]')
          echo "name=${workspace}" >> $GITHUB_OUTPUT
          echo ${workspace}
    outputs:
      environment_workspace_name: ${{ steps.name_workspace.outputs.name }}

  static-analysis:
    name: Run static analysis checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: "0"
      - uses: actions/setup-go@v5
        with:
          go-version: "1.21"
      - run: make check-code
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

  build:
    name: Build, Scan & Push Images
    needs: [generate-tag]
    uses: ./.github/workflows/build-push-images.yml
    with:
      docker_tag: ${{ needs.generate-tag.outputs.tag }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  plan-account:
    strategy:
      matrix:
        account:
          - development
          - preproduction
          - production
    name: "TF Plan Account: ${{ matrix.account }}"
    uses: ./.github/workflows/account-deploy.yml
    with:
      workspace_name: ${{ matrix.account }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  plan-environment:
    strategy:
      matrix:
        environment:
          - preproduction
          - production
    name: "TF Plan Environment: ${{ matrix.environment }}"
    needs: [generate-tag]
    uses: ./.github/workflows/env-deploy.yml
    with:
      workspace_name: ${{ matrix.environment }}
      version_tag: ${{ needs.generate-tag.outputs.tag }}
    secrets:
      allowlist_deploy_key: ${{ secrets.SSH_PRIVATE_KEY_ALLOW_LIST_REPOSITORY }}
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      github_access_token: ${{ secrets.GITHUB_TOKEN }}

  deploy-pr-env:
    name: Deploy PR Environment
    needs:
      [
        build,
        static-analysis,
        generate-tag,
        generate-environment-workspace-name,
      ]
    uses: ./.github/workflows/env-deploy.yml
    with:
      workspace_name: ${{ needs.generate-environment-workspace-name.outputs.environment_workspace_name }}
      version_tag: ${{ needs.generate-tag.outputs.tag }}
      apply: true
    secrets:
      allowlist_deploy_key: ${{ secrets.SSH_PRIVATE_KEY_ALLOW_LIST_REPOSITORY }}
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      github_access_token: ${{ secrets.GITHUB_TOKEN }}

  test-pr-env:
    name: Test PR Environment
    needs: [deploy-pr-env]
    uses: ./.github/workflows/env-test.yml
    with:
      base_url: ${{ needs.deploy-pr-env.outputs.base_url }}
    secrets:
      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      jwt_secret_key: ${{ secrets.JWT_SECRET_KEY }}