deploy_environment.yml

name: Deploy Commit to Environment

on:
  workflow_call:
    inputs:
      environment:
        description: Github action environment and AWS account type
        type: string
        required: true
      commit-identifier:
        description: SHA or tag to apply
        type: string
        required: true
      release-tag:
        description: release name to apply to resources
        type: string
        required: false
        default: unnamed
      oidc-domain:
        description: 'OIDC Domain. Ex: "core" or "reveng"'
        required: true
        type: string
      terraform-workspace:
        description: Terraform Workspace
        type: string
        required: true
      terraform-root:
        description: Root directory of terraform
        type: string
        required: true
      terraform-version:
        description: Terraform version to use
        type: string
        required: true
    secrets:
      ORG_READ_ONLY_SSH_KEY:
        required: true
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN:
        required: true


concurrency: ${{ github.repository }}-${{ inputs.environment }}

permissions:
  id-token: write
  contents: read

jobs:
  TF-Validate-Plan:
    name: Terraform Validate and Plan
    uses: ./.github/workflows/tf_validate_plan_single_root.yml
    with:
      environment: ${{ inputs.environment }}
      oidc-domain: ${{ inputs.oidc-domain }}
      commit-identifier: ${{ inputs.commit-identifier }}
      with-lock: false
      terraform-workspace: ${{ inputs.terraform-workspace }}
      terraform-root: ${{ inputs.terraform-root }}
      terraform-version: ${{ inputs.terraform-version }}
    secrets:
      ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}

  TF-Apply:
    name: Terraform Apply
    needs: TF-Validate-Plan
    uses: ./.github/workflows/tf_apply.yml
    with:
      environment: ${{ inputs.environment }}
      oidc-domain: ${{ inputs.oidc-domain }}
      terraform-workspace: ${{ inputs.terraform-workspace }}
      commit-identifier: ${{ inputs.commit-identifier }}
      terraform-root: ${{ inputs.terraform-root }}
      terraform-version: ${{ inputs.terraform-version }}
      release-tag: ${{ inputs.release-tag }}
    secrets:
      ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}