deploy-generate.yml

# Main build pipeline that verifies, builds, and deploys the software
name: Build and Deploy
# Events that trigger the workflow
on:
  # Trigger based on push to all branches
  push:
    branches:
      - 'development'
      - 'feature/**'
      - 'release/**'
      - 'main'
    tags-ignore:
      - '*'
  # Run workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    name: Build and Deploy
    # The type of runner that the job will run on
    runs-on: ubuntu-latest    
    steps:

      # SIT environment variables
      - name: Set Environment Variables
        if: |
          startsWith(github.ref, 'refs/heads/development') ||
          startsWith(github.ref, 'refs/heads/feature')
        run: |
          echo "TARGET_ENV=SIT" >> $GITHUB_ENV
          echo "PREFIX_ENV=service-generate-sit" >> $GITHUB_ENV
      
      # UAT environment variables
      - name: Set Environment Variables
        if: startsWith(github.ref, 'refs/heads/release') 
        run: |
          echo "TARGET_ENV=UAT" >> $GITHUB_ENV
          echo "PREFIX_ENV=service-generate-uat" >> $GITHUB_ENV

      # OPS environment variables
      - name: Set Environment Variables
        if: startsWith(github.ref, 'refs/heads/main') 
        run: |
          echo "TARGET_ENV=OPS" >> $GITHUB_ENV
          echo "PREFIX_ENV=service-generate-ops" >> $GITHUB_ENV

      # Check out GitHub repo
      - uses: actions/checkout@v3

      # SNYK blocking
      - name: Run Snyk as a blocking step
        uses: snyk/actions/python-3.8@master
        env:
            SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: test
          args: >
              --org=${{ secrets.SNYK_ORG_ID }}
              --project-name=${{ github.repository }}
              --severity-threshold=high
              --fail-on=all

      # SNYK report
      - name: Run Snyk on Python
        uses: snyk/actions/python-3.8@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: monitor
          args: >
            --org=${{ secrets.SNYK_ORG_ID }}
            --project-name=${{ github.repository }}
      
      # Set up Terraform
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2.0.3
        with:
          terraform_version: 1.3.7

      # Validate Terraform file
      - name: Validate Terraform
        run: terraform validate -no-color
      
      # Set up TF_VAR and AWS credentials environment variables
      - name: TF_VAR and AWS credentials
        run: |
          echo "TF_VAR_environment=$TARGET_ENV" >> $GITHUB_ENV
          echo "TF_VAR_prefix=$PREFIX_ENV" >> $GITHUB_ENV
          echo "TF_VAR_cross_account_id=${{ secrets[format('CROSS_ACCOUNT_ID_{0}', env.TARGET_ENV)] }}" >> $GITHUB_ENV
          echo "TF_VAR_sns_topic_email=${{ secrets[format('SNS_TOPIC_EMAIL_{0}', env.TARGET_ENV)] }}" >> $GITHUB_ENV
          echo "AWS_ACCESS_KEY_ID=${{ secrets[format('AWS_ACCESS_KEY_ID_SERVICES_{0}', env.TARGET_ENV)] }}" >> $GITHUB_ENV
          echo "AWS_SECRET_ACCESS_KEY=${{ secrets[format('AWS_SECRET_ACCESS_KEY_SERVICES_{0}', env.TARGET_ENV)] }}" >> $GITHUB_ENV
          echo "AWS_DEFAULT_REGION=us-west-2" >> $GITHUB_ENV

      # Deploy Terraform
      - name: Deploy Terraform
        working-directory: terraform/
        run: |
          terraform init -reconfigure \
              -backend-config="bucket=${PREFIX_ENV}-tf-state" \
              -backend-config="key=generate.tfstate" \
              -backend-config="region=${AWS_DEFAULT_REGION}"

          terraform apply -auto-approve