ci_workflows/.github/workflows/ci-plan-infra.yml at main · WalletConnect/ci_workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: Infra - Plan

on:
  workflow_call:
    inputs:
      version:
        description: 'The image version to use in the ECS task definition'
        type: string
        default: 'latest'
      stage:
        description: 'The environment to plan against'
        type: string
        required: true
      stage-url:
        description: 'The URL of the environment'
        type: string
        required: true
      grafana-workspace-name:
        description: 'The name of the Grafana workspace for the monitoring deployment'
        type: string
        default: ${{ vars.GRAFANA_WORKSPACE_NAME }}
      tf-directory:
        description: 'The directory containing the Terraform files'
        type: string
        default: ${{ vars.TF_DIRECTORY }}
      tf-variables:
        description: 'The values of the dynamic Terraform variables'
        type: string
        default: ''
      aws-region:
        description: 'The AWS region to deploy to'
        type: string
        default: ${{ vars.AWS_REGION }}
      aws-role-monitoring-arn:
        description: 'The ARN of the AWS role to assume for the monitoring deployment'
        type: string
        default: ${{ vars.AWS_ROLE_MONITORING }}
      run-label:
        description: 'The run label to use for the actions'
        type: string
        default: 'ubuntu-latest'
    secrets:
      TF_API_TOKEN:
        required: true
      ANTHROPIC_API_KEY:
        required: false

permissions:
  contents: read
  id-token: write
  pull-requests: write

concurrency: deploy-${{ inputs.stage }}

env:
  TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
  TF_WORKSPACE: wl-${{ inputs.stage }}

jobs:
  plan:
    name: Plan `${{ inputs.stage }}`
    runs-on: ${{ inputs.run-label }}
    environment:
      name: ${{ inputs.stage }}
      url: ${{ inputs.stage-url }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          submodules: recursive
          token: ${{ secrets.PRIVATE_SUBMODULE_ACCESS_TOKEN || github.token }}

      - name: Configure AWS Credentials for Monitoring account
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ inputs.aws-role-monitoring-arn }}
          aws-region: ${{ inputs.aws-region }}

      - name: Create Grafana key
        id: grafana-get-key
        uses: WalletConnect/ci_workflows/.github/actions/grafana-key@main
        with:
          workspace-name: ${{ inputs.grafana-workspace-name }}
          key-prefix: ${{ github.event.repository.name }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Cache Terraform data
        uses: actions/cache@v4
        with:
          path: ${{ inputs.tf-directory }}/.terraform
          key: terraform-${{ hashFiles('${{ inputs.tf-directory }}/.terraform.lock.hcl') }}

      - name: Init Terraform
        working-directory: ${{ inputs.tf-directory }}
        run: terraform init -no-color

      - name: Configure Terraform Variables
        uses: WalletConnect/ci_workflows/.github/actions/tf-vars@main
        with:
          infra-directory: ${{ inputs.tf-directory }}
          variables: |
            image_version:${{ inputs.version }}
            grafana_auth:${{ steps.grafana-get-key.outputs.key }}
            ${{ inputs.tf-variables }}

      - name: Plan ${{ inputs.stage }}
        working-directory: ${{ inputs.tf-directory }}
        run: |
          set -o pipefail
          terraform plan -no-color 2>&1 | tee /tmp/plan_output.txt

      - name: Upload Plan Output
        if: always() && github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: terraform-plan-${{ inputs.stage }}
          path: /tmp/plan_output.txt
          retention-days: 1

      - name: Claude AI Review
        if: github.event_name == 'pull_request'
        continue-on-error: true
        uses: WalletConnect/actions/claude/terraform-plan-review@master
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          terraform_plan_file: /tmp/plan_output.txt

      - name: Delete Grafana key
        if: ${{ always() }}
        uses: WalletConnect/actions/aws/grafana/delete-key/@2.5.4
        with:
          workspace-id: ${{ steps.grafana-get-key.outputs.workspace-id }}
          key-name: ${{ steps.grafana-get-key.outputs.key-name }}