terraform-ci-deploy.yml

name: Terraform CI Deploy

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:

  paths-filter:
    runs-on: ubuntu-latest
    outputs:
      operations: ${{ steps.filter.outputs.operations }}

    steps:

      - uses: actions/checkout@v4

      # keep in sync with terraform-ci-destroy.yml
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            operations:
              - 'operations/environments/pr/**'
              - 'operations/template/**'


  terraform-deploy:
    name: PR Infrastructure Deploy
    needs: paths-filter
    uses: ./.github/workflows/terraform-deploy_reusable.yml
    if: needs.paths-filter.outputs.operations == 'true'
    with:
      ENVIRONMENT: pr
      TERRAFORM_DIRECTORY: operations/environments/pr
      TERRAFORM_INIT_PARAMETERS: -backend-config="key=pr_${{ github.event.number }}.tfstate"
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      TERRAFORM_APPLY_PARAMETERS: -var="pr_number=${{ github.event.number }}" -var="alert_slack_email=${{ secrets.NON_PROD_ALERT_SLACK_EMAIL }}"


  terraform-deploy-skip:  # runs when the PR doesn't have any changes that require the PR deploy; this ensures we get the appropriate required PR checks
    name: PR Infrastructure Deploy  # this name must match the above `terraform-deploy` job's name
    needs: paths-filter
    uses: ./.github/workflows/terraform-deploy_reusable-skip.yml
    if: needs.paths-filter.outputs.operations != 'true'


  pr-deploy:
    name: PR Application Deploy
    needs:
      - terraform-deploy
      - paths-filter
    uses: ./.github/workflows/deploy_reusable.yml
    if: needs.paths-filter.outputs.operations == 'true'
    with:
      ENVIRONMENT: pr
      REPO: trusted-intermediary-router
      APP: ${{ needs.terraform-deploy.outputs.APP }}
      REGISTRY: ${{ needs.terraform-deploy.outputs.REGISTRY }}
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}


  pr-deploy-skip:  # runs when the PR doesn't have any changes that require the PR deploy; this ensures we get the appropriate required PR checks
    name: PR Application Deploy  # this name must match the above `pr-deploy` job's name
    needs:
      - paths-filter
    uses: ./.github/workflows/deploy_reusable-skip.yml
    if: needs.paths-filter.outputs.operations != 'true'