dispatch_manage_public_access_ur_environment.yml

name: "[WD] Toggle public access to UR environment"

on:
  workflow_dispatch:
    inputs:
      public_access_enabled:
        description: 'Enable public access to the UR environment?'
        required: true
        type: boolean

permissions:
  id-token: write
  contents: write
  security-events: write
  pull-requests: write
  actions: none
  checks: none
  deployments: none
  issues: write
  packages: none
  repository-projects: none
  statuses: none

defaults:
  run:
    shell: bash

jobs:
  ur_toggle_public_access:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: unfor19/install-aws-cli-action@v1
      - name: Parse terraform version
        id: tf_version_setup
        working-directory: ./terraform/environment
        run: |
          if [ -f ./versions.tf ]; then
            terraform_version=$(cat ./versions.tf | ../../scripts/terraform-version.sh)
            echo "- Terraform version: [${terraform_version}]" >> $GITHUB_STEP_SUMMARY
            echo "TERRAFORM_VERSION=${terraform_version}" >> $GITHUB_OUTPUT
          fi
      - name: "Terraform version [${{ steps.tf_version_setup.outputs.TERRAFORM_VERSION }}]"
        run: echo "terraform version [${{ steps.tf_version_setup.outputs.TERRAFORM_VERSION }}]"
        working-directory: ./terraform/environment
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ steps.tf_version_setup.outputs.TERRAFORM_VERSION }}
          terraform_wrapper: false
      - name: Configure AWS Credentials For Terraform
        uses: aws-actions/configure-aws-credentials@v4.0.1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_ACTIONS }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_ACTIONS }}
          aws-region: eu-west-1
          role-duration-seconds: 3600
          role-session-name: OPGModernisingLPATerraformGithubAction
      - uses: webfactory/ssh-agent@v0.8.0
        with:
          ssh-private-key: ${{ secrets.OPG_MODERNISING_LPA_DEPLOY_KEY_PRIVATE_KEY }}
      - name: Terraform Init
        run: terraform init -input=false
        working-directory: ./terraform/environment
      - name: Terraform Toggle Public Access for UR
        env:
          TF_WORKSPACE: ur
          TF_VAR_pagerduty_api_key: ${{ secrets.pagerduty_api_key }}
        run: |
          terraform apply -lock-timeout=300s  -input=false -auto-approve -var public_access_enabled=${{ inputs.public_access_enabled }} \
            -target 'module.eu_west_1[0].module.app.aws_security_group_rule.app_loadbalancer_public_access_ingress[0]' \
            -target 'module.eu_west_1[0].module.app.aws_security_group_rule.app_loadbalancer_public_access_ingress_port_80[0]' \
            -target 'module.eu_west_1[0].module.mock_onelogin[0].aws_security_group_rule.mock_onelogin_loadbalancer_public_access_ingress[0]' \
        working-directory: ./terraform/environment