deploy.yml

name: Deploy Cloud CA
on:
  workflow_dispatch:
  push:
    paths:
      - "**/*.py"
      - "**/*.tf"
      - ".github/workflows/deploy.yml"
    branches:
      - main

jobs:
  terraform_validate:
    name: Terraform validate
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read
      checks: write
    steps:
      - name: Terraform setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.1

      - name: Checkout
        uses: actions/checkout@v4

      - name: Terraform validate
        id: fmt
        run: terraform fmt -check -recursive

  secret_scan:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Install GitLeaks
        run: |
          wget https://github.com/gitleaks/gitleaks/releases/download/v8.16.1/gitleaks_8.16.1_linux_x64.tar.gz && \
          tar -xf gitleaks_8.16.1_linux_x64.tar.gz
          sudo mv gitleaks /usr/local/bin/gitleaks && \
          sudo chmod +x /usr/local/bin/gitleaks
      - name: Run GitLeaks Scan
        run: |
          gitleaks detect --source . -v

  terraform_plan_apply:
    name: Terraform plan & apply
    runs-on: ubuntu-latest
    needs:
      - terraform_validate
      - secret_scan
    permissions:
      id-token: write
      contents: read
      pull-requests: read
      checks: write
    steps:
      - name: Terraform setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.1

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Display Python version
        run: python -c "import sys; print(sys.version)"

      - name: Install virtualenv
        run: pip install virtualenv

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}
      
      - name: Clone terraform-aws-ca
        uses: actions/checkout@v4
        with:
          repository: serverless-ca/terraform-aws-ca
          token: ${{secrets.GH_TOKEN}}
          path: terraform-aws-ca

      - name: Terraform initialise
        run: >
          terraform init 
          -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET}} 
          -backend-config=key=${{ secrets.TERRAFORM_STATE_KEY}} 
          -backend-config=region=${{ secrets.TERRAFORM_STATE_REGION}}

      - name: Cache built python modules
        uses: actions/cache@v4
        with:
          key: modules_terraform-aws-ca-lambda_build_${{ hashFiles('./modules/terraform-aws-ca-lambda/lambda_code/**') }}_${{ hashFiles('./modules/terraform-aws-ca-lambda/utils/**') }}_${{ github.job }}_py${{ steps.setup_python.outputs.python-version }}
          path: ./terraform-aws-ca/modules/terraform-aws-ca-lambda/build

      - name: Terraform plan
        run: terraform plan -out tfplan

      - name: Terraform apply
        run: terraform apply -auto-approve tfplan

  start_ca:
    name: Start CA
    runs-on: ubuntu-latest
    needs:
      - terraform_plan_apply
    permissions:
      id-token: write
      contents: read
      checks: write
    steps:
      - name: checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Display Python version
        run: python -c "import sys; print(sys.version)"

      - name: Install dependencies
        run: |
          pip install -r scripts/requirements.txt

      - name: Configure AWS Credentials - Dev
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Start CA
        run: |
          python scripts/start_ca_step_function.py

  integration_tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: start_ca
    permissions:
      id-token: write
      contents: read
      checks: write
        
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          pip install -r requirements-dev.txt

      - name: Configure AWS Credentials - Dev
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Integration tests
        run: |
          pytest -v tests