Skip to content

Commit db350b8

Browse files
jamesiarmesjamesiarmes
committed
ci: Add workflow to launch a tools container.
1 parent e712dc9 commit db350b8

File tree

3 files changed

+147
-0
lines changed

3 files changed

+147
-0
lines changed

‎.github/workflows/launch-tools.yaml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
name: Launch tools container
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
environment:
7+
description: Environment to destroy.
8+
default: development
9+
required: true
10+
type: environment
11+
command:
12+
description: |
13+
Command to run in the tools container in the CMD format: executable,
14+
param1, param2, ...
15+
default: "echo,hello world"
16+
required: true
17+
type: string
18+
19+
permissions:
20+
contents: read
21+
id-token: write
22+
23+
jobs:
24+
launch:
25+
name: Launch tools container in ${{ inputs.environment }}
26+
runs-on: ubuntu-latest
27+
environment: ${{ inputs.environment }}
28+
env:
29+
# Set required variables.
30+
TF_VAR_repo_oidc_arn: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
31+
TF_VAR_vpc_cidr: ${{ secrets.TF_VAR_VPC_CIDR }}
32+
TF_VAR_vpc_private_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
33+
TF_VAR_vpc_public_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@v4
37+
- name: Set up AWS credentials
38+
uses: aws-actions/configure-aws-credentials@v4
39+
with:
40+
aws-region: ${{ secrets.AWS_REGION || 'us-west-1' }}
41+
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
42+
role-session-name: GitHub_to_AWS_via_FederatedOIDC
43+
- name: Setup OpenTofu
44+
uses: opentofu/setup-opentofu@v1
45+
with:
46+
tofu_wrapper: false
47+
- name: Display OpenTofu version
48+
run: tofu version
49+
- name: Set optional variables
50+
env:
51+
# For any of these that have a value, the corresponding TF_VAR_*
52+
# environment variable will be set.
53+
APPLY_DATABASE_UPDATES_IMMEDIATELY: ${{ secrets.TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY }}
54+
TF_VAR_CONSUMER_CONTAINER_COUNT: ${{ secrets.TF_VAR_CONSUMER_CONTAINER_COUNT }}
55+
CONSUMER_CPU: ${{ secrets.TF_VAR_CONSUMER_CPU }}
56+
CONSUMER_MEMORY: ${{ secrets.TF_VAR_CONSUMER_MEMORY }}
57+
DATABASE_SKIP_FINAL_SNAPSHOT: ${{ secrets.TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT }}
58+
DELETION_PROTECTION: ${{ secrets.TF_VAR_DELETION_PROTECTION }}
59+
DEPLOYMENT_ENVIRONMENTS: ${{ secrets.TF_VAR_DEPLOYMENT_ENVIRONMENTS }}
60+
ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
61+
EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
62+
IMAGE_TAGS_MUTABLE: ${{ secrets.TF_VAR_IMAGE_TAGS_MUTABLE }}
63+
KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
64+
PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
65+
PROJECT: ${{ secrets.TF_VAR_PROJECT }}
66+
REPOSITORY: ${{ secrets.TF_VAR_REPOSITORY }}
67+
run: |
68+
variables=(
69+
"apply_database_updates_immediately" "consumer_container_count"
70+
"consumer_cpu" "consumer_memory" "database_skip_final_snapshot"
71+
"deletion_protection" "deployment_environments" "environment"
72+
"export_expiration" "image_tags_mutable" "key_recovery_period"
73+
"program" "project" "repository"
74+
)
75+
for var in ${variables[@]}; do
76+
name="$(echo $var | tr '[:lower:]' '[:upper:]')"
77+
if [ -n "${!name}" ]; then
78+
echo "Setting TF_VAR_$var"
79+
echo "TF_VAR_$var=${!name}" >> $GITHUB_ENV
80+
else
81+
echo "$name is not set"
82+
fi
83+
done
84+
- name: Initialize OpenTofu
85+
working-directory: ./tofu/config/service
86+
run: tofu init
87+
- name: Get OpenTofu outputs
88+
id: outputs
89+
working-directory: ./tofu/config/service
90+
run: |
91+
OUTPUTS=$(tofu output -json | jq -c)
92+
echo "OUTPUTS=$OUTPUTS"
93+
echo "outputs=$OUTPUTS" >> $GITHUB_OUTPUT
94+
- name: Parse subnets
95+
id: subnets
96+
env:
97+
SUBNETS: ${{ toJson(fromJson(steps.outputs.outputs.outputs).container_subnets.value) }}
98+
run: |
99+
SUBNET_STRING=$(echo "$SUBNETS" | jq -r '.[]')
100+
echo "subnets<<EOF" >> $GITHUB_OUTPUT
101+
echo "$SUBNET_STRING" >> $GITHUB_OUTPUT
102+
echo "EOF" >> $GITHUB_OUTPUT
103+
- name: Parse command
104+
id: command
105+
env:
106+
COMMAND: ${{ inputs.command }}
107+
run: |
108+
IFS=',' read -ra parts <<< "$COMMAND"
109+
COMMAND_STRING=$(printf "%s\n" "${parts[@]}")
110+
echo "command<<EOF" >> $GITHUB_OUTPUT
111+
echo "$COMMAND_STRING" >> $GITHUB_OUTPUT
112+
echo "EOF" >> $GITHUB_OUTPUT
113+
# - name: Show outputs
114+
# run: echo "${{ steps.command.outputs.command }}"
115+
- name: Launch container
116+
id: run-task
117+
uses: geekcell/github-action-aws-ecs-run-task@v5
118+
with:
119+
cluster: ${{ secrets.TF_VAR_PROJECT }}-${{ secrets.TF_VAR_ENVIRONMENT }}
120+
task-definition: ${{ secrets.TF_VAR_PROJECT }}-${{ secrets.TF_VAR_ENVIRONMENT }}-tools
121+
override-container: ${{ secrets.TF_VAR_PROJECT }}-${{ secrets.TF_VAR_ENVIRONMENT }}-tools
122+
assign-public-ip: DISABLED
123+
tail-logs: true
124+
task-wait-until-stopped: true
125+
# The block style indicator (|) is necessary to tell YAML to preserve
126+
# newlines.
127+
override-container-command: |
128+
${{ steps.command.outputs.command }}
129+
subnet-ids: |
130+
${{ steps.subnets.outputs.subnets }}
131+
security-group-ids: |
132+
${{ fromJson(steps.outputs.outputs.outputs).task_security_group_id.value }}

‎tofu/config/service/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
output "container_subnets" {
2+
value = split(",", module.inputs.values["vpc/private_subnets"])
3+
description = "The IDs of the subnets in which the container resources will be deployed."
4+
}
5+
16
output "export_bucket" {
27
value = module.system.export_bucket
38
description = "The name of the S3 bucket for exports."
@@ -7,3 +12,8 @@ output "queue_url" {
712
value = module.system.queue_url
813
description = "The URL of the SQS queue."
914
}
15+
16+
output "task_security_group_id" {
17+
value = module.system.task_security_group_id
18+
description = "The ID of the security group attached to the ECS tasks."
19+
}

‎tofu/modules/system/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,8 @@ output "queue_url" {
77
value = module.sqs.queue_url
88
description = "The URL of the SQS queue."
99
}
10+
11+
output "task_security_group_id" {
12+
value = module.task_security_group.security_group_id
13+
description = "The ID of the security group attached to the ECS tasks."
14+
}

0 commit comments

Comments
 (0)