workflow_terraform_environment_cleanup.yml

name: "[Workflow] Cleanup PR Workspaces"

on:
  schedule:
    # every hour
    - cron: '0 * * * *'

permissions:
  contents: read
  security-events: none
  pull-requests: none
  actions: none
  checks: none
  deployments: none
  issues: none
  packages: none
  repository-projects: none
  statuses: none

jobs:
  terraform_environment_cleanup:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: '0'
      - uses: unfor19/install-aws-cli-action@v1
      - name: Parse terraform version
        id: tf_version_setup
        working-directory: ./terraform/environment
        run: |
          if [ -f ./versions.tf ]; then
            terraform_version=$(cat ./versions.tf | ../../scripts/terraform-version.sh)
            echo "- Terraform version: [${terraform_version}]" >> $GITHUB_STEP_SUMMARY
            echo "TERRAFORM_VERSION=${terraform_version}" >> $GITHUB_OUTPUT
          fi
      - name: "Terraform version [${{ steps.tf_version_setup.outputs.TERRAFORM_VERSION }}]"
        run: echo "terraform version [${{ steps.tf_version_setup.outputs.TERRAFORM_VERSION }}]"
        working-directory: ./terraform/environment
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ steps.tf_version_setup.outputs.TERRAFORM_VERSION }}
          terraform_wrapper: false
      - name: Configure AWS Credentials For Terraform
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_ACTIONS }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_ACTIONS }}
          aws-region: eu-west-1
          role-duration-seconds: 3600
          role-session-name: OPGModernisingLPATerraformGithubAction
      - uses: webfactory/ssh-agent@v0.8.0
        with:
          ssh-private-key: ${{ secrets.OPG_MODERNISING_LPA_DEPLOY_KEY_PRIVATE_KEY }}

      - name: Install Terraform Workspace Manager
        run: |
          wget https://github.com/TomTucka/terraform-workspace-manager/releases/download/v0.3.0/terraform-workspace-manager_Linux_x86_64.tar.gz -O $HOME/terraform-workspace-manager.tar.gz
          sudo tar -xvf $HOME/terraform-workspace-manager.tar.gz -C /usr/local/bin
          sudo chmod +x /usr/local/bin/terraform-workspace-manager

      - name: Terraform Init
        run: terraform init -input=false
        working-directory: ./terraform/environment

      - name: Destroy PR Terraform Workspaces
        working-directory: ./terraform/environment
        env:
          TF_VAR_pagerduty_api_key: ${{ secrets.PAGERDUTY_API_KEY }}
        run: |
          ../../scripts/workspace_cleanup.sh $(terraform-workspace-manager -protected-workspaces=true -aws-account-id=653761790766 -aws-iam-role=modernising-lpa-ci)