terraform-destroy-dev-environments-cron.yml

name: 'Destroy (Dev Account) Environment CRON'

on:
  schedule:
    - cron: 59 17 * * 1-5 # utc time

permissions:
  pull-requests: write
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  remove_edge_associations:
    name: Remove Lambda@Edge Associations
    uses: ./.github/workflows/cleanup-cloudfront-edge-associations.yml
    strategy:
      matrix:
        # Update with new sandbox environments here
        sandbox-name: [ndra, ndrb, ndrc, ndrd]
    with:
      sandbox_workspace: ${{ matrix.sandbox-name }}
      lambda_function_name: '${{ matrix.sandbox-name }}_EdgePresignLambda'
      python_version: 3.11
      build_branch: main
      environment: development
    secrets:
      AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}

  cleanup_versions_process:
    name: Cleanup Versions Process
    uses: ./.github/workflows/cleanup-appconfig-and-lambda-layer-versions.yml
    strategy:
      matrix:
        # Update with new sandbox environments here
        sandbox-name: [ndra, ndrb, ndrc, ndrd]
    with:
      build_branch: main
      environment: development
      sandbox: ${{ matrix.sandbox-name }}
      python_version: 3.11
    secrets:
      AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}

  terraform_destroy_process:
    runs-on: ubuntu-latest
    environment: development
    needs: [cleanup_versions_process]

    strategy:
      matrix:
        # Can't use an env var here unfortunately, we will have to update here with new sandbox environments
        sandbox-name: [ndra, ndrb, ndrc, ndrd]

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
          role-skip-session-tagging: true
          aws-region: ${{ vars.AWS_REGION }}
          mask-aws-account-id: true

      - name: View AWS Role
        run: aws sts get-caller-identity

      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.5.4
          terraform_wrapper: false

      - name: Terraform Init
        id: init
        run: terraform init -backend-config=backend.conf
        working-directory: ./infrastructure
        shell: bash

      - name: Terraform Set Workspace
        id: workspace
        run: terraform workspace select ${{ matrix.sandbox-name }}
        working-directory: ./infrastructure
        shell: bash

      - name: Terraform Destroy
        id: destroy
        run: terraform destroy -auto-approve -var-file="${{ vars.TF_VARS_FILE }}"
        working-directory: ./infrastructure