edited github action for drift detection #22

Workflow file for this run

.github/workflows/infra_drift_detection.yml at df3e0c8

	name: Drift Detection

	on:
	push:
	branches:
	- EC-281-mario
	workflow_dispatch:
	inputs:
	environment:
	description: Environment where the resources will be deployed.
	type: string
	required: true
	default: dev
	base_path:
	description: The base path on which the script will look for Terraform projects
	type: string
	required: true
	default: infra/resources/
	env_vars:
	description: List of environment variables to set up, given in env=value format.
	type: string
	required: false
	use_private_agent:
	description: Use a private agent to run the Terraform plan.
	type: boolean
	required: false
	default: false
	webhook_url:
	description: The webhook URL to send the notification to.
	type: string
	required: false
	schedule:
	- cron: '08 00 * * *'


	env:
	ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
	ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
	ARM_USE_OIDC: true
	ARM_USE_AZUREAD: true
	ARM_STORAGE_USE_AZUREAD: true
	BASE_DIR: ${{ inputs.base_path != '' && inputs.base_path \|\| 'infra/resources/' }}
	AZURE_ENVIRONMENT: ${{ inputs.environment != '' && inputs.environment \|\| 'dev' }}

	jobs:
	terraform_driftdetection_job:
	name: Terraform Drift Detection
	runs-on: ${{ inputs.use_private_agent == true && 'self-hosted' \|\| 'ubuntu-20.04' }}
	environment: ${{ inputs.environment != '' && inputs.environment \|\| 'dev' }}-ci
	concurrency:
	group: ${{ github.workflow }}-ci
	cancel-in-progress: true
	permissions:
	id-token: write
	contents: read
	pull-requests: write
	env:
	ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

	steps:
	# Set the directory where the Terraform files are located
	# The directory the value is then available in ${{ steps.directory.outputs.dir }}
	- name: Set directory
	id: directory
	env:
	ENVIRONMENT: ${{ env.AZURE_ENVIRONMENT }}
	BASE_PATH: ${{ env.BASE_DIR }}
	run: \|
	set -euo pipefail

	if [ -z "$ENVIRONMENT" ]; then
	echo "Environment must be provided."
	exit 1
	else
	# The directory is expected to be in the format
	# infra/resources/${{ inputs.environment }}
	# Example: infra/resources/prod
	printf "dir=%q/%q" "$BASE_PATH" "$ENVIRONMENT" >> "$GITHUB_OUTPUT"
	fi

	- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
	name: Checkout

	- name: Set Environment Variables
	if: ${{ inputs.env_vars }}
	env:
	ENV_VARS: ${{ inputs.env_vars }}
	run: \|
	set -euo pipefail

	for i in "$ENV_VARS[@]"
	do
	printf "%q\n" "$i" >> "$GITHUB_ENV"
	done

	- name: Azure Login
	uses: azure/login@v2 # v2.0.0
	with:
	client-id: ${{ env.ARM_CLIENT_ID }}
	tenant-id: ${{ env.ARM_TENANT_ID }}
	subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}

	- name: Set Terraform Version
	id: set-terraform-version
	run: \|
	set -eu
	terraform_version=$(cat .terraform-version)
	printf "terraform_version=$terraform_version" >> "$GITHUB_OUTPUT"

	- uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
	name: Setup Terraform
	with:
	terraform_version: ${{ steps.set-terraform-version.outputs.terraform_version }}

	- name: Terraform Init
	working-directory: ${{ steps.directory.outputs.dir }}
	run: \|
	terraform init

	# Run Terraform Plan
	# The plan output is saved in a file and then processed to remove unnecessary lines
	# The step never fails but the result is checked in the next step
	# This is because we want to post the plan output in the PR even if the plan fails
	- name: Terraform Plan
	id: plan
	working-directory: ${{ steps.directory.outputs.dir }}
	run: \|
	terraform plan -lock-timeout=3000s -no-color 2>&1 \| tee plan_output.txt

	OUTPUT=$(grep -Ev "Refreshing state\|state lock\|Reading\|Read" plan_output.txt \| tail -c 60000)
	printf "%s" "$OUTPUT" > plan_output_multiline.txt

	if grep -q "::error::Terraform exited with code" plan_output.txt; then
	echo "failed"
	exit 1
	fi

	- name: Drift Detection
	id: drift
	working-directory: ${{ steps.directory.outputs.dir }}
	run: \|
	if grep -q "No changes. Your infrastructure matches the configuration." plan_output.txt; then
	echo "No drifts in this configuration"
	exit 0
	else
	changes=$(grep 'Plan: ' plan_output.txt)

	to_add=$(echo $changes \| awk '{print $2}')
	to_change=$(echo $changes \| awk '{print $5}')
	to_destroy=$(echo $changes \| awk '{print $8}')

	echo "Drift detected!"
	echo "Resource to add: $to_add"
	echo "Resource to change: $to_change"
	echo "Resource to destroy: $to_destroy"

	# Save variables to environment for use in next step
	echo "TO_ADD=$to_add" >> $GITHUB_ENV
	echo "TO_CHANGE=$to_change" >> $GITHUB_ENV
	echo "TO_DESTROY=$to_destroy" >> $GITHUB_ENV

	exit 1
	fi

	# How to configure: https://github.com/ravsamhq/notify-slack-action
	# Use ${{ inputs.webhook_url }} instead of secret if you want to change it manually
	- name: Drift Notification
	if: ${{ always() && (env.SLACK_WEBHOOK_URL \|\| inputs.webhook_url) }}
	uses: ravsamhq/[email protected]
	with:
	status: ${{ job.status }}
	notify_when: 'failure'
	notification_title: "Drift detected! {workflow} action is {status_message}"
	message_format: \|
	{emoji} {workflow} results:
	Owner: ${{ github.event.head_commit.author.name }}
	Commit message: ${{ github.event.head_commit.message }}
	:page_with_curl:
	Terraform plan results:
	- Resource to add: ${{ env.TO_ADD }}
	- Resource to change: ${{ env.TO_CHANGE }}
	- Resource to destroy: ${{ env.TO_DESTROY }}
	footer: "Linked Repo <{repo_url}\|{repo}>"
	env:
	SLACK_WEBHOOK_URL: ${{ env.SLACK_WEBHOOK_URL }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

edited github action for drift detection #22

Workflow file

edited github action for drift detection #22

Jobs

Run details

Workflow file for this run