fix: switch to bitwarden secret provider #495
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| pull-requests: write | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }} | |
| KUBECONFIG: ${{ github.workspace }}/.kubeconfig | |
| TF_TOKEN_app_terraform_io: ${{ secrets.TERRAFORM_CLOUD_SECRET }} | |
| TF_VAR_hcloud_token: ${{ secrets.HCLOUD_TOKEN }} | |
| TF_VAR_kubeconfig_output_path: ${{ github.workspace }}/.kubeconfig | |
| TF_VAR_bitwarden_token: ${{ secrets.BITWARDEN_TOKEN }} | |
| TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }} | |
| TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }} | |
| TF_VAR_infisical_project_id: ${{ secrets.INFISICAL_PROJECT_ID }} | |
| TF_VAR_ssh_key: ${{ secrets.SSH_KEY_PRIVATE }} | |
| TF_VAR_ssh_key_public: ${{ secrets.SSH_KEY_PUBLIC }} | |
| TF_VAR_argocd_github_client_id: ${{ secrets.GH_CLIENT_ID }} | |
| TF_VAR_argocd_github_client_secret: ${{ secrets.GH_CLIENT_SECRET }} | |
| TF_VAR_argocd_github_org: ${{ secrets.GH_ORG }} | |
| TF_VAR_argocd_github_teams: ${{ secrets.GH_TEAMS }} | |
| TF_VERSION: '1.9.3' | |
| TG_VERSION: '0.66.1' | |
| WORKING_DIR: stacks/prod | |
| jobs: | |
| commitlint: | |
| runs-on: ubuntu-latest | |
| env: | |
| GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # fetch-depth is required | |
| - uses: wagoid/commitlint-github-action@v6 | |
| pre-commit: | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # fetch-depth is required | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: 3.x | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '>=1.20.0' | |
| - name: Setup TFLint | |
| uses: terraform-linters/setup-tflint@v4 | |
| - name: Install Trivy | |
| run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin | |
| - name: Install Terragrunt | |
| uses: jaxxstorm/[email protected] | |
| with: | |
| repo: gruntwork-io/terragrunt | |
| extension-matching: disable | |
| rename-to: terragrunt | |
| chmod: 0755 | |
| - name: Init Terragrunt | |
| run: terragrunt run-all init | |
| - uses: pre-commit/[email protected] | |
| plan: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - commitlint | |
| - pre-commit | |
| environment: prod | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Plan | |
| uses: gruntwork-io/terragrunt-action@v2 | |
| with: | |
| tf_version: ${{ env.TF_VERSION }} | |
| tg_version: ${{ env.TG_VERSION }} | |
| tg_dir: ${{ env.WORKING_DIR }} | |
| tg_command: run-all plan | |
| tg_comment: 1 | |
| deploy: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - plan | |
| environment: prod | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: azure/setup-kubectl@v4 | |
| - name: Deploy | |
| uses: gruntwork-io/terragrunt-action@v2 | |
| with: | |
| tf_version: ${{ env.TF_VERSION }} | |
| tg_version: ${{ env.TG_VERSION }} | |
| tg_dir: ${{ env.WORKING_DIR }} | |
| tg_command: run-all apply | |
| - name: Change kubeconfig owner to runner | |
| run: sudo chown $(whoami):$(whoami) $KUBECONFIG | |
| - name: ArgoCD registry | |
| run: kubectl apply -f registry/clusters/prod/registry.yaml |