nuke-redeploy.yml

name: Redeploy after nuke

on:
  push:
    branches:
      - main
    paths:
      - '.github/workflows/nuke-redeploy.yml'
  pull_request:
    branches:
      - main
    types: [opened, edited, reopened, synchronize]
    paths:
      - '.github/workflows/nuke-redeploy.yml'
  schedule:
    # * is a special character in YAML so you have to quote this string
    # trigger every sunday at 12:00am
    - cron: '0 12 * * 0'
  workflow_dispatch:
env:
  AWS_REGION: "eu-west-2"
  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}
  NUKE_REDEPLOY_ACCOUNTS: ${{ secrets.MODERNISATION_PLATFORM_AUTONUKE_REBUILD }}
  BACKEND_NUMBER: ${{ secrets.MODERNISATION_PLATFORM_ACCOUNT_ID }}
  TF_IN_AUTOMATION: true

permissions: {}

defaults:
  run:
    shell: bash

jobs:
  setup-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - id: set-matrix
        run: echo "matrix=$(jq -c '.|sort' <<< $NUKE_REDEPLOY_ACCOUNTS)" >> $GITHUB_OUTPUT

  redeploy-after-nuke:
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read # This is required for actions/checkout
    strategy:
      fail-fast: false
      matrix:
        nuke_accts: ${{ fromJSON(needs.setup-matrix.outputs.matrix) }}
    name: Redeploy after nuke
    needs: setup-matrix
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4

      - name: Set Account Number
        run: echo "ACCOUNT_NUMBER=$(jq -r -e --arg account_name "${ACCOUNT_NAME}" '.account_ids[$account_name]' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
          role-session-name: githubactionsrolesession
          aws-region: ${{ env.AWS_REGION }}

      - name: Load and Configure Terraform
        uses: hashicorp/setup-terraform@97f030cf6dc0b4f5e0da352c7bca9cca34579800 # v3.1.0
        with:
          terraform_version: "~1"
          terraform_wrapper: false

      - name: Plan after nuke - ${{ matrix.nuke_accts }}
        run: |
          terraform --version
          echo "Terraform Plan - ${ACCOUNT_NAME%-development}" # removes the -development suffix in order to get the directory name
          bash scripts/terraform-init.sh terraform/environments/${ACCOUNT_NAME%-development} "assume_role={role_arn=\"arn:aws:iam::${{ env.BACKEND_NUMBER }}:role/modernisation-account-terraform-state-member-access\"}"
          terraform -chdir="terraform/environments/${ACCOUNT_NAME%-development}" workspace select "${ACCOUNT_NAME}"
          bash scripts/terraform-plan.sh terraform/environments/${ACCOUNT_NAME%-development}

      - name: Apply after nuke - ${{ matrix.nuke_accts }}
        if: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
        run: |
          terraform --version
          echo "Terraform apply - ${ACCOUNT_NAME%-development}" # removes the -development suffix in order to get the directory name
          bash scripts/terraform-init.sh terraform/environments/${ACCOUNT_NAME%-development} "assume_role={role_arn=\"arn:aws:iam::${{ env.BACKEND_NUMBER }}:role/modernisation-account-terraform-state-member-access\"}"
          terraform -chdir="terraform/environments/${ACCOUNT_NAME%-development}" workspace select "${ACCOUNT_NAME}"
          bash scripts/terraform-apply.sh terraform/environments/${ACCOUNT_NAME%-development}
    env:
      ACCOUNT_NAME: ${{ matrix.nuke_accts }}