scenario1.terraform.yml

name: 'Scenario 1: Terraform Multi-Tenant ASEv3 Secure Baseline'

concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: false

on:
  workflow_dispatch:
    inputs:
      destroy:
        description: 'Destroy resources?'
        required: true
        type: boolean
        default: false

  push:
    branches:
      - main
    paths:
      - '.github/workflows/scenario1.terraform.yml'
      - '.github/workflows/_template.terraform.yml'
      - 'scenarios/secure-baseline-multitenant/terraform/**.tf'
      - 'scenarios/secure-baseline-multitenant/terraform/**/parameters/ase-multitenant.parameters.tfvars'
      - '!scenarios/secure-baseline-multitenant/terraform/**.md'

  pull_request:
    branches:
      - main
    paths:
      - '.github/workflows/scenario1.terraform.yml'
      - '.github/workflows/_template.terraform.yml'
      - 'scenarios/secure-baseline-multitenant/terraform/**'
      - 'scenarios/secure-baseline-multitenant/terraform/**/parameters/ase-multitenant.parameters.tfvars'
      - '!scenarios/secure-baseline-multitenant/terraform/**.md'

permissions:
  id-token: write
  contents: read
  pull-requests: write

env:
  modulePath: 'scenarios/secure-baseline-multitenant/terraform'
  terraformVersion: 1.9.7 # must be greater than or equal to 1.2 for OIDC
  backendStateKey: 'scenario1.hub.tfstate'
  tfvarPath: '_parameters/ase-multitenant.parameters.tfvars'

jobs:
  prepare-environment:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout the code
      uses: actions/checkout@main
    outputs:
      modulePath: ${{ env.modulePath }}
      terraformVersion: ${{ env.terraformVersion }}
      backendStateKey: ${{ env.backendStateKey }}
      tfvarPath: ${{ env.tfvarPath }}

  terraform-deploy:
    name: 'Terraform CICD (Hub & Spoke Multi-tenant Secure Baseline)'
    needs: 
    - prepare-environment
    uses: ./.github/workflows/.template.terraform.yml
    with:
      modulePath: ${{ needs.prepare-environment.outputs.modulePath }}
      terraformVersion: ${{ needs.prepare-environment.outputs.terraformVersion }}
      backendStateKey: 'scenario1.hub.tfstate'
      tfvarPath: ${{ needs.prepare-environment.outputs.tfvarPath }}
      # Ensure this value is a boolean
      destroy: ${{ github.event.inputs.destroy == 'true' }}
    secrets: inherit