pipeline.yaml

name: Rule Sets Pipeline

on:
  pull_request:
    branches:
      - rule-sets-DTSPO-17918
  push:
    branches:
      - rule-sets-DTSPO-17918

permissions:
  id-token: write
  contents: read

jobs:
  plan-and-apply:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Log in to Azure using OIDC
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1

      - name: Change directory to Terraform config
        run: cd components

      - name: Initialize Terraform
        working-directory: components
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
          terraform init \
            -backend-config="resource_group_name=rule-set-rg" \
            -backend-config="storage_account_name=rulesetsa" \
            -backend-config="container_name=tfstate" \
            -backend-config="key=terraform.tfstate"

      - name: Plan Terraform
        working-directory: components
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
          terraform plan -out=tfplan \
            -var="location=UK South" \
            -var="override_action=plan"

      - name: Apply Terraform
        working-directory: components
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.DCD_CFT_SANDBOX_SUBSCRIPTION }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
          terraform apply -auto-approve tfplan