deploy.yml

name: Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        type: environment
      image-hash:
        type: string
        required: false
        default: ''
        description: SHA256 of the image to deploy
      image-tag:
        type: string
        required: false
        default: 'latest'
        description: Tag of the image to deploy

jobs:
  deploy:
    runs-on: ubuntu-latest

    environment: ${{ inputs.environment }}

    permissions:
      id-token: write
      packages: write
      contents: write

    steps:
      #
      # Setup Terraform
      #
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: 1.9.7

      #
      # Checkout the source code
      #
      - name: Checkout the source code
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
        with:
          token: ${{ secrets.GIT_PAT }}
          fetch-depth: 0

      #
      # Terraform init
      #
      - name: Terraform
        shell: bash
        working-directory: src/main/terraform
        env:
          IMAGE_HASH: "${{ inputs.image-hash }}"
          IMAGE_TAG: "${{ inputs.image-tag }}"
          ENVIRONMENT: "${{ inputs.environment }}"
          ARM_CLIENT_ID: "${{ secrets.AZURE_CLIENT_ID }}"
          ARM_SUBSCRIPTION_ID: "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
          ARM_TENANT_ID: "${{ secrets.AZURE_TENANT_ID }}"
        run: |
          if [ -n "$IMAGE_HASH" ]; then
            IMAGE="ghcr.io/pagopa/mil-auth:$IMAGE_TAG@sha256:$IMAGE_HASH"
          else
            IMAGE="ghcr.io/pagopa/mil-auth:$IMAGE_TAG"
          fi
          echo "*** [$IMAGE] will be deployed."

          if [[ "$ENVIRONMENT" == "prod-cd" ]]; then
            ENV_FOLDER="prod"
          elif [[ "$ENVIRONMENT" == "uat-cd" ]]; then
            ENV_FOLDER="uat"
          else
            ENV_FOLDER="dev"
          fi
          echo "*** [$ENV_FOLDER] folder will be used."
          
          echo "Terraform init..."
          terraform init -backend-config="env/$ENV_FOLDER/backend.tfvars" -reconfigure

          echo "Terraform apply..."
          terraform apply -var-file="env/$ENV_FOLDER/backend.tfvars" -var="mil_auth_image=$IMAGE" -auto-approve -lock-timeout=300s