cd.yml

name: "CD"

on:
  push:
    branches: [master]

defaults:
  run:
    working-directory: terraform

jobs:
  deploy-infra:
    name: "Deploy Infra"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v2

      - name: "Configure AWS credentials"
        uses: aws-actions/configure-aws-credentials@ea7b857d8a33dc2fb4ef5a724500044281b49a5e  # v1.6.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@3d8debd658c92063839bc97da5c2427100420dec  # 1.3.2

      - name: "Terraform init"
        id: init
        run: terraform init

      - name: "Set TFPLAN variable"
        run: echo "TFPLAN=$(git cat-file -p HEAD | grep '^parent' | tail -1 | cut -d ' ' -f 2).tfplan" >> $GITHUB_ENV

      - name: "Fetch the stored plan from S3"
        # No need to delete the plan file from S3. Our CI workflow will anyways leave lots of
        # those lying around, and it also doesn't hurt that this can be re-ran any amount of times.
        run: aws s3 cp "s3://apilytics-terraform-state/plans/${TFPLAN}" .

      - name: "Terraform apply"
        run: terraform apply -auto-approve -input=false "$TFPLAN"
        env:
          TF_VAR_geoip_prod_api_key: ${{ secrets.TF_VAR_geoip_prod_api_key }}
          TF_VAR_internal_api_key: ${{ secrets.TF_VAR_internal_api_key }}