Automated Apply #

# GitHub Actions: GitOps-style automated apply
# .github/workflows/terraform-gitops.yml

name: Terraform GitOps

on:
  push:
    branches: [develop, staging, main]
    paths: ['infrastructure/**']

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Determine Environment
        id: env
        run: |
          case "${{ github.ref_name }}" in
            develop)  echo "environment=dev"        >> $GITHUB_OUTPUT
                      echo "auto_approve=true"       >> $GITHUB_OUTPUT ;;
            staging)  echo "environment=staging"    >> $GITHUB_OUTPUT
                      echo "auto_approve=true"       >> $GITHUB_OUTPUT ;;
            main)     echo "environment=production"  >> $GITHUB_OUTPUT
                      echo "auto_approve=false"      >> $GITHUB_OUTPUT ;;
          esac          

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: >
            arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/TerraformApplyRole-${{ steps.env.outputs.environment }}            
          aws-region: ap-southeast-1

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "1.7.0"

      - name: Terraform Init
        run: terraform init
        working-directory: infrastructure/environments/${{ steps.env.outputs.environment }}

      - name: Terraform Plan
        run: terraform plan -out=tfplan -no-color
        working-directory: infrastructure/environments/${{ steps.env.outputs.environment }}

      - name: Terraform Apply (Auto-approve for non-production)
        if: steps.env.outputs.auto_approve == 'true'
        run: terraform apply tfplan
        working-directory: infrastructure/environments/${{ steps.env.outputs.environment }}

      - name: Terraform Apply (Production — requires environment approval)
        if: steps.env.outputs.auto_approve == 'false'
        run: terraform apply tfplan
        working-directory: infrastructure/environments/${{ steps.env.outputs.environment }}
        environment: production  # Environment protection rules apply here

#!/bin/bash
# check-plan-safety.sh — run after terraform plan, before apply

PLAN_OUTPUT=$(terraform show -json tfplan)

# Count resources that will be destroyed
DESTROY_COUNT=$(echo $PLAN_OUTPUT | jq '[.resource_changes[] | select(.change.actions[] == "delete")] | length')

# Count resources that will be replaced (destroy + create)
REPLACE_COUNT=$(echo $PLAN_OUTPUT | jq '[.resource_changes[] | select(.change.actions | contains(["delete", "create"]))] | length')

echo "Resources to destroy: $DESTROY_COUNT"
echo "Resources to replace: $REPLACE_COUNT"

# Fail the pipeline if there are destroys in production
if [ "$ENVIRONMENT" = "production" ] && [ "$DESTROY_COUNT" -gt 0 ]; then
  echo "ERROR: Destroy operations detected in the production plan!"
  echo "Destroy operations require manual review and explicit override."
  exit 1
fi

# Warn if there are replaces in production
if [ "$ENVIRONMENT" = "production" ] && [ "$REPLACE_COUNT" -gt 0 ]; then
  echo "WARNING: Replace operations detected (resources will be destroyed and recreated)"
  echo "This may cause downtime. Ensure this is intentional."
  # No exit — just a warning, still needs human approval via environment protection
fi

# Integrate the check into the pipeline
- name: Check Plan Safety
  run: bash ./scripts/check-plan-safety.sh
  env:
    ENVIRONMENT: ${{ steps.env.outputs.environment }}
  working-directory: infrastructure/environments/${{ steps.env.outputs.environment }}

# Notify Slack after apply
- name: Notify Slack on Success
  if: success()
  uses: slackapi/slack-github-action@v1
  with:
    payload: |
      {
        "text": "✅ Terraform apply succeeded",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*✅ Terraform Apply Succeeded*\nEnvironment: `${{ steps.env.outputs.environment }}`\nCommit: `${{ github.sha }}`\nPR: ${{ github.event.pull_request.html_url }}"
            }
          }
        ]
      }      
  env:
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_INFRA_WEBHOOK }}

- name: Notify Slack on Failure
  if: failure()
  uses: slackapi/slack-github-action@v1
  with:
    payload: |
      {
        "text": "🚨 Terraform apply FAILED",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*🚨 Terraform Apply FAILED*\nEnvironment: `${{ steps.env.outputs.environment }}`\nView the log: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
            }
          }
        ]
      }      
  env:
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_INFRA_WEBHOOK }}

# If an apply fails or causes problems:

# 1. Check the state to see what has changed
terraform state list
terraform state show aws_instance.web

# 2. Use a state backup to roll back
terraform state pull > current-state.tfstate
terraform state push backup-before-apply.tfstate

# 3. Or: revert the code and apply again
git revert HEAD
terraform plan
terraform apply

# Monitor a running apply
terraform apply -auto-approve 2>&1 | tee apply.log

# Parse the log for errors
if grep -q "Error:" apply.log; then
  echo "APPLY FAILED!"
  grep "Error:" apply.log
  # Send an alert
fi

# Verify after the apply
terraform output -json > post-apply-outputs.json
terraform state list | wc -l
# Make sure the resource count matches expectations

# Send notifications after a successful/failed apply

# Notification script
terraform apply -auto-approve 2>&1 | tee apply.log

if [ $? -eq 0 ]; then
  # Apply succeeded
  curl -X POST $SLACK_WEBHOOK -d '{
    "text": "✅ Terraform apply succeeded",
    "attachments": [{"text": "'"$(tail -5 apply.log)"'"}]
  }'
else
  # Apply failed
  curl -X POST $SLACK_WEBHOOK -d '{
    "text": "❌ Terraform apply FAILED",
    "attachments": [{"text": "'"$(grep Error apply.log)"'"}]
  }'
fi