destroy.yaml

name: Destroy Production
on:
  workflow_dispatch:
    inputs:
      cleanup:
        description: 'Cleanup bucket & logs (yes/no)'
        required: true
        default: 'no'

jobs:
  destroy:
    name: Destroy
    runs-on: ubuntu-latest
    steps:
      - name: Set up Node
        uses: actions/setup-node@v1
        with:
          node-version: 14.x

      - name: Checkout code
        uses: actions/checkout@v2
        with:
          ref: production

      - name: Cache dependencies
        uses: actions/cache@v2
        with:
          path: ~/.npm
          key: ${{ runner.OS }}-npm-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.OS }}-npm-
            ${{ runner.OS }}-

      - name: Install dependencies
        run: npm ci

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Decrypt config
        run: npm run decrypt-config -- --passphrase="$ENCRYPT_PASSPHRASE" maildog.config.json.gpg
        env:
          ENCRYPT_PASSPHRASE: ${{ secrets.ENCRYPT_PASSPHRASE }}

      - name: Deactivate receipt rule set
        run: aws ses set-active-receipt-rule-set

      - name: Destroy stack
        run: npx cdk destroy --force
        env:
          ENVIRONMENT_NAME: production

  cleanup:
    name: Cleanup
    if: ${{ github.event.inputs.cleanup == 'yes' }}
    needs: destroy
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Remove bucket and its content
        run: aws s3 rb s3://$(aws s3api list-buckets --query "Buckets[?starts_with(Name, 'maildog-production-')].Name" --output text) --force

      - name: Clear log groups from Lambda functions
        run: aws logs describe-log-groups --log-group-name-prefix "/aws/lambda/MailDog-production-" --query "logGroups[].logGroupName" --output text | xargs -I {} -n 1 aws logs delete-log-group --log-group-name {}