Approve production TF plans before deployment

.github/workflows/build.yml

@@ -113,6 +113,7 @@ jobs:
             proxy.golang.org:443
             sum.golang.org:443
             raw.githubusercontent.com:443
+            storage.googleapis.com:443
       - name: Restore Go build sources
         uses: actions/download-artifact@v3
         with:
@@ -230,6 +231,7 @@ jobs:
             proxy.golang.org:443
             sum.golang.org:443
             raw.githubusercontent.com:443
+            storage.googleapis.com:443
       - name: Restore Go build sources
         uses: actions/download-artifact@v3
         with:

.github/workflows/deploy-production.yml

@@ -84,7 +84,7 @@ jobs:
       tf-validate-output: ${{ needs.tf-plan.outputs.validate-output }}
 
   tf-apply:
-    name: Deploy to Staging
+    name: Deploy to Production
     needs:
       - build-lambdas
       - aws-auth
@@ -98,6 +98,7 @@ jobs:
       aws-region: us-west-2
       concurrency-group: run_terraform-production
       tf-backend-config-file: production.s3.tfbackend
+      environment-name: production
     secrets:
       aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
       aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}
@@ -106,7 +107,7 @@ jobs:
       datadog-app-key: ${{ secrets.DATADOG_APP_KEY }}
       gpg-passphrase: ${{ secrets.PRODUCTION_GPG_PASSPHRASE }}
 
-  update_release:
+  update-release:
     name: Update release
     runs-on: ubuntu-latest
     permissions:

.github/workflows/deploy-staging.yml

@@ -98,6 +98,7 @@ jobs:
       aws-region: us-west-2
       concurrency-group: run_terraform-staging
       tf-backend-config-file: staging.s3.tfbackend
+      environment-name: staging
     secrets:
       aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
       aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}

.github/workflows/qa.yml

@@ -25,6 +25,7 @@ jobs:
             objects.githubusercontent.com:443
             proxy.golang.org:443
             sum.golang.org:443
+            storage.googleapis.com:443
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
@@ -68,6 +69,7 @@ jobs:
             objects.githubusercontent.com:443
             proxy.golang.org:443
             sum.golang.org:443
+            storage.googleapis.com:443
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
@@ -107,6 +109,7 @@ jobs:
             github.com:443
             proxy.golang.org:443
             sum.golang.org:443
+            storage.googleapis.com:443
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
@@ -133,6 +136,7 @@ jobs:
             github.com:443
             proxy.golang.org:443
             sum.golang.org:443
+            storage.googleapis.com:443
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
@@ -163,6 +167,7 @@ jobs:
             objects.githubusercontent.com:443
             proxy.golang.org:443
             sum.golang.org:443
+            storage.googleapis.com:443
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}

.github/workflows/terraform-apply.yml

@@ -15,10 +15,13 @@ on:
       tf-plan-artifacts-key:
         type: string
         required: true
+      tf-backend-config-file:
+        type: string
+        required: true
       aws-region:
         type: string
         required: true
-      tf-backend-config-file:
+      environment-name:
         type: string
         required: true
       concurrency-group:
@@ -55,6 +58,7 @@ jobs:
       TF_IN_AUTOMATION: "true"
       TF_INPUT: 0
       TF_PLUGIN_CACHE_DIR: ~/.terraform.d/plugin-cache
+    environment: ${{ inputs.environment-name }}
     concurrency:
       group: ${{ inputs.concurrency-group }}
       cancel-in-progress: false