GitHub Actions¶

name: Terraform

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write   # needed for OIDC

jobs:
  apply:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/jinalshah/devops/images/aws-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7

      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-terraform
          aws-region: eu-west-2

      - run: |
          terraform init -input=false
          terraform apply -input=false -auto-approve

name: Terraform pipeline

on:
  pull_request:
    paths: ["terraform/**"]
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

concurrency:
  group: terraform-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/jinalshah/devops/images/aws-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7
      - run: terraform fmt -check -recursive terraform/
      - run: |
          cd terraform
          tflint --init
          tflint --recursive
      - run: trivy config --severity HIGH,CRITICAL --exit-code 1 terraform/

  plan:
    needs: validate
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/jinalshah/devops/images/aws-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-terraform-plan
          aws-region: eu-west-2
      - run: |
          cd terraform
          terraform init -input=false
          terraform plan -input=false -out=tfplan
      - uses: actions/upload-artifact@v7
        with:
          name: tfplan
          path: terraform/tfplan

  apply:
    needs: plan
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production   # add required reviewers in repo settings
    container:
      image: ghcr.io/jinalshah/devops/images/aws-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          name: tfplan
          path: terraform
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-terraform-apply
          aws-region: eu-west-2
      - run: |
          cd terraform
          terraform init -input=false
          terraform apply -input=false tfplan

name: Security scan

on:
  pull_request:
  schedule:
    - cron: "17 4 * * 1"

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/jinalshah/devops/images/all-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7

      - name: Trivy (vulnerabilities, secrets, misconfigurations)
        run: trivy fs --scanners vuln,secret,misconfig --format sarif --output trivy.sarif .

      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: trivy.sarif

      - name: Fail on HIGH/CRITICAL
        run: trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 .

      - name: Linters
        run: |
          tflint --init && tflint --recursive
          if [ -d ansible ]; then ansible-lint ansible/; fi
          if [ -d cloudformation ]; then cfn-lint "cloudformation/**/*.yaml"; fi

steps:
  - uses: actions/checkout@v7
  - run: |
      echo "TF_PLUGIN_CACHE_DIR=$GITHUB_WORKSPACE/.terraform-plugin-cache" >> "$GITHUB_ENV"
      mkdir -p "$GITHUB_WORKSPACE/.terraform-plugin-cache"
  - uses: actions/cache@v6
    with:
      path: .terraform-plugin-cache
      key: tf-providers-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/.terraform.lock.hcl') }}
  - run: terraform init -input=false

name: AI review

on:
  pull_request:
    paths: ["terraform/**", "ansible/**"]

permissions:
  contents: read
  pull-requests: write

jobs:
  review:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/jinalshah/devops/images/all-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Review the diff
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git diff "origin/${{ github.base_ref }}...HEAD" -- terraform/ ansible/ \
            | claude -p "Review this infrastructure diff for security issues, risky changes and best-practice problems. Reply in Markdown." \
            > review.md

      - name: Comment on the PR
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh pr comment ${{ github.event.pull_request.number }} --repo "$GITHUB_REPOSITORY" --body-file review.md

name: Reusable Terraform deploy

on:
  workflow_call:
    inputs:
      environment: { required: true, type: string }
      working-directory: { required: true, type: string }
      role-arn: { required: true, type: string }

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    container:
      image: ghcr.io/jinalshah/devops/images/aws-devops:1.0.abc1234
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@v7
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ inputs.role-arn }}
          aws-region: eu-west-2
      - run: terraform init -input=false
      - run: terraform apply -input=false -auto-approve

name: Deploy all environments

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

jobs:
  dev:
    uses: ./.github/workflows/terraform-deploy.yml
    with: { environment: dev, working-directory: terraform/dev, role-arn: "arn:aws:iam::111111111111:role/deploy" }
  staging:
    needs: dev
    uses: ./.github/workflows/terraform-deploy.yml
    with: { environment: staging, working-directory: terraform/staging, role-arn: "arn:aws:iam::222222222222:role/deploy" }
  production:
    needs: staging
    uses: ./.github/workflows/terraform-deploy.yml
    with: { environment: production, working-directory: terraform/production, role-arn: "arn:aws:iam::333333333333:role/deploy" }