Skip to content

Commit 1e0817f

Browse files
jamesiarmesjamesiarmes
committed
ci: Add workflow to launch a tools container.
1 parent 0a68a59 commit 1e0817f

File tree

3 files changed

+157
-0
lines changed

3 files changed

+157
-0
lines changed

‎.github/workflows/launch-tools.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
name: Launch tools container
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
environment:
7+
description: Environment to destroy.
8+
default: development
9+
required: true
10+
type: environment
11+
command:
12+
description: |
13+
Command to run in the tools container in the CMD format: executable,
14+
param1, param2, ...
15+
default: "echo,hello world"
16+
required: true
17+
type: string
18+
19+
permissions:
20+
contents: read
21+
id-token: write
22+
23+
jobs:
24+
launch:
25+
name: Launch tools container in ${{ inputs.environment }}
26+
runs-on: ubuntu-latest
27+
environment: ${{ inputs.environment }}
28+
env:
29+
# Set required variables.
30+
TF_VAR_repo_oidc_arn: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
31+
TF_VAR_vpc_cidr: ${{ secrets.TF_VAR_VPC_CIDR }}
32+
TF_VAR_vpc_private_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
33+
TF_VAR_vpc_public_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@v4
37+
- name: Set up AWS credentials
38+
uses: aws-actions/configure-aws-credentials@v4
39+
with:
40+
aws-region: ${{ secrets.AWS_REGION || 'us-west-1' }}
41+
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
42+
role-session-name: GitHub_to_AWS_via_FederatedOIDC
43+
- name: Setup OpenTofu
44+
uses: opentofu/setup-opentofu@v1
45+
with:
46+
tofu_wrapper: false
47+
- name: Display OpenTofu version
48+
run: tofu version
49+
- name: Set optional variables
50+
env:
51+
# For any of these that have a value, the corresponding TF_VAR_*
52+
# environment variable will be set.
53+
APPLY_DATABASE_UPDATES_IMMEDIATELY: ${{ secrets.TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY }}
54+
TF_VAR_CONSUMER_CONTAINER_COUNT: ${{ secrets.TF_VAR_CONSUMER_CONTAINER_COUNT }}
55+
CONSUMER_CPU: ${{ secrets.TF_VAR_CONSUMER_CPU }}
56+
CONSUMER_MEMORY: ${{ secrets.TF_VAR_CONSUMER_MEMORY }}
57+
DATABASE_SKIP_FINAL_SNAPSHOT: ${{ secrets.TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT }}
58+
DELETION_PROTECTION: ${{ secrets.TF_VAR_DELETION_PROTECTION }}
59+
DEPLOYMENT_ENVIRONMENTS: ${{ secrets.TF_VAR_DEPLOYMENT_ENVIRONMENTS }}
60+
ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
61+
EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
62+
IMAGE_TAGS_MUTABLE: ${{ secrets.TF_VAR_IMAGE_TAGS_MUTABLE }}
63+
KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
64+
PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
65+
PROJECT: ${{ secrets.TF_VAR_PROJECT }}
66+
REPOSITORY: ${{ secrets.TF_VAR_REPOSITORY }}
67+
run: |
68+
variables=(
69+
"apply_database_updates_immediately" "consumer_container_count"
70+
"consumer_cpu" "consumer_memory" "database_skip_final_snapshot"
71+
"deletion_protection" "deployment_environments" "environment"
72+
"export_expiration" "image_tags_mutable" "key_recovery_period"
73+
"program" "project" "repository"
74+
)
75+
for var in ${variables[@]}; do
76+
name="$(echo $var | tr '[:lower:]' '[:upper:]')"
77+
if [ -n "${!name}" ]; then
78+
echo "Setting TF_VAR_$var"
79+
echo "TF_VAR_$var=${!name}" >> $GITHUB_ENV
80+
else
81+
echo "$name is not set"
82+
fi
83+
done
84+
- name: Initialize OpenTofu
85+
working-directory: ./tofu/config/service
86+
run: tofu init
87+
- name: Get OpenTofu outputs
88+
id: outputs
89+
working-directory: ./tofu/config/service
90+
run: |
91+
OUTPUTS=$(tofu output -json | jq -c)
92+
echo "OUTPUTS=$OUTPUTS"
93+
echo "outputs=$OUTPUTS" >> $GITHUB_OUTPUT
94+
# TODO: cleanup
95+
- name: Parse subnets
96+
id: subnets
97+
run: |
98+
# Define your JSON array (replace with your actual data)
99+
SUBNETS='${{ toJson(fromJson(steps.outputs.outputs.outputs).container_subnets.value) }}'
100+
echo "SUBNETS=$SUBNETS"
101+
102+
# Use jq to extract elements and join them with newlines
103+
NEWLINE_DELIMITED_STRING=$(echo "$SUBNETS" | jq -r '.[]')
104+
echo "NEWLINE_DELIMITED_STRING=$NEWLINE_DELIMITED_STRING"
105+
106+
# Output the result for use in subsequent steps
107+
echo "subnets<<EOF" >> $GITHUB_OUTPUT
108+
echo "$NEWLINE_DELIMITED_STRING" >> $GITHUB_OUTPUT
109+
echo "EOF" >> $GITHUB_OUTPUT
110+
- name: Parse command
111+
id: command
112+
env:
113+
COMMAND: ${{ inputs.command }}
114+
run: |
115+
COMMAND_STRING=$(echo "$COMMAND" | awk -F',' '{for(i=1;i<=NF;i++) print $i}')
116+
echo "command<<EOF" >> $GITHUB_OUTPUT
117+
echo "$COMMAND_STRING" >> $GITHUB_OUTPUT
118+
echo "EOF" >> $GITHUB_OUTPUT
119+
#IFS=',' read -ra parts <<< "$COMMAND"
120+
#COMMAND_STRING=$(printf "%s\n" "${parts[@]}")
121+
#echo "command='$COMMAND_STRING'" >> $GITHUB_OUTPUT
122+
- name: Show outputs
123+
run: echo "${{ steps.command.outputs.command }}"
124+
# - name: Launch container
125+
# id: run-task
126+
# uses: geekcell/github-action-aws-ecs-run-task@v5
127+
# env:
128+
# COMMAND: ${{ format('[{0}]', inputs.command) }}
129+
# with:
130+
# cluster: ${{ secrets.TF_VAR_PROJECT }}-${{ secrets.TF_VAR_ENVIRONMENT }}
131+
# task-definition: ${{ secrets.TF_VAR_PROJECT }}-${{ secrets.TF_VAR_ENVIRONMENT }}-tools
132+
# assign-public-ip: DISABLED
133+
#
134+
# subnet-ids: |
135+
# ${{ steps.subnets.outputs.subnets }}
136+
# security-group-ids: ${{ fromJson(steps.outputs.outputs.outputs).task_security_group_id.value }}
137+
#
138+
# tail-logs: true
139+
# override-container: ${{ secrets.TF_VAR_PROJECT }}-${{ secrets.TF_VAR_ENVIRONMENT }}-tools
140+
# override-container-command: |
141+
# ${{ env.COMMAND }}
142+
# task-wait-until-stopped: true

‎tofu/config/service/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
output "container_subnets" {
2+
value = split(",", module.inputs.values["vpc/private_subnets"])
3+
description = "The IDs of the subnets in which the container resources will be deployed."
4+
}
5+
16
output "export_bucket" {
27
value = module.system.export_bucket
38
description = "The name of the S3 bucket for exports."
@@ -7,3 +12,8 @@ output "queue_url" {
712
value = module.system.queue_url
813
description = "The URL of the SQS queue."
914
}
15+
16+
output "task_security_group_id" {
17+
value = module.system.task_security_group_id
18+
description = "The ID of the security group attached to the ECS tasks."
19+
}

‎tofu/modules/system/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,8 @@ output "queue_url" {
77
value = module.sqs.queue_url
88
description = "The URL of the SQS queue."
99
}
10+
11+
output "task_security_group_id" {
12+
value = module.task_security_group.security_group_id
13+
description = "The ID of the security group attached to the ECS tasks."
14+
}

0 commit comments

Comments
 (0)