OpenTofuPlayground/.gitea/workflows/deploy.yml

name: Deploy / Update Apps

on:
  push:
    branches:
      - main
    paths:
      - "apps/**.tfvars"

env:
  TOFU_VERSION: "1.9.0"

jobs:
  detect-changes:
    name: Detect changed tfvars files
    runs-on: ubuntu-latest
    outputs:
      added_modified: ${{ steps.diff.outputs.added_modified }}
      deleted: ${{ steps.diff.outputs.deleted }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Compute diff
        id: diff
        run: |
          ADDED_MODIFIED=$(git diff --name-only --diff-filter=ACM HEAD~1 HEAD -- 'apps/*.tfvars' | jq -R -s -c 'split("\n") | map(select(length > 0))')
          DELETED=$(git diff --name-only --diff-filter=D HEAD~1 HEAD -- 'apps/*.tfvars' | jq -R -s -c 'split("\n") | map(select(length > 0))')
          echo "added_modified=$ADDED_MODIFIED" >> "$GITHUB_OUTPUT"
          echo "deleted=$DELETED"               >> "$GITHUB_OUTPUT"

  # ─── Deploy / Update ──────────────────────────────────────────────────────
  deploy:
    name: Deploy ${{ matrix.tfvars }}
    needs: detect-changes
    if: ${{ needs.detect-changes.outputs.added_modified != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        tfvars: ${{ fromJson(needs.detect-changes.outputs.added_modified) }}

    steps:
      - uses: actions/checkout@v4

      - name: Install OpenTofu
        run: |
          curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method standalone --opentofu-version ${{ env.TOFU_VERSION }}

      - name: Install gopass
        run: |
          curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz | tar xz
          sudo mv gopass /usr/local/bin/

      - name: Configure gopass
        env:
          GOPASS_GPG_KEY: ${{ secrets.GOPASS_GPG_KEY }}
          GOPASS_STORE_REPO: ${{ secrets.GOPASS_STORE_REPO }}
        run: |
          echo "$GOPASS_GPG_KEY" | gpg --batch --import
          gopass clone "$GOPASS_STORE_REPO"

      - name: Resolve app name from tfvars filename
        id: app
        run: |
          TFVARS="${{ matrix.tfvars }}"
          APP=$(basename "$TFVARS" .tfvars)
          echo "name=$APP" >> "$GITHUB_OUTPUT"

      - name: Fetch SSH key from gopass
        run: |
          # Adjust the gopass path to match your store layout
          gopass show -o "infra/ssh-keys/${{ steps.app.outputs.name }}" > /tmp/deploy_key
          chmod 600 /tmp/deploy_key

      - name: Fetch secrets from gopass
        id: secrets
        run: |
          DB_PASSWORD=$(gopass show -o "apps/${{ steps.app.outputs.name }}/db_password")
          GIT_TOKEN=$(gopass show -o "apps/${{ steps.app.outputs.name }}/git_token" 2>/dev/null || echo "")
          echo "::add-mask::$DB_PASSWORD"
          echo "::add-mask::$GIT_TOKEN"
          echo "db_password=$DB_PASSWORD" >> "$GITHUB_OUTPUT"
          echo "git_token=$GIT_TOKEN"     >> "$GITHUB_OUTPUT"

      - name: tofu init
        env:
          # SeaweedFS S3 credentials (set in Gitea repo secrets)
          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
        run: |
          tofu init \
            -backend-config="bucket=tofu-state" \
            -backend-config="key=apps/${{ steps.app.outputs.name }}.tfstate" \
            -backend-config="endpoint=${{ secrets.SEAWEED_S3_ENDPOINT }}" \
            -backend-config="region=us-east-1" \
            -backend-config="force_path_style=true"

      - name: Select or create workspace
        run: |
          tofu workspace select "${{ steps.app.outputs.name }}" \
            || tofu workspace new "${{ steps.app.outputs.name }}"

      - name: tofu apply
        env:
          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
        run: |
          tofu apply -auto-approve \
            -var-file="${{ matrix.tfvars }}" \
            -var="ssh_key_path=/tmp/deploy_key" \
            -var="db_password=${{ steps.secrets.outputs.db_password }}" \
            -var="openresty_git_token=${{ steps.secrets.outputs.git_token }}"

      - name: Cleanup SSH key
        if: always()
        run: rm -f /tmp/deploy_key

  # ─── Destroy (tfvars file deleted) ────────────────────────────────────────
  destroy:
    name: Destroy ${{ matrix.tfvars }}
    needs: detect-changes
    if: ${{ needs.detect-changes.outputs.deleted != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        tfvars: ${{ fromJson(needs.detect-changes.outputs.deleted) }}

    steps:
      - uses: actions/checkout@v4
        with:
          # Checkout the previous commit so we still have the tfvars file
          ref: ${{ github.event.before }}

      - name: Install OpenTofu
        run: |
          curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method=standalone --opentofu-version=${{ env.TOFU_VERSION }}

      - name: Install gopass
        run: |
          curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz | tar xz
          sudo mv gopass /usr/local/bin/

      - name: Configure gopass
        env:
          GOPASS_GPG_KEY: ${{ secrets.GOPASS_GPG_KEY }}
          GOPASS_STORE_REPO: ${{ secrets.GOPASS_STORE_REPO }}
        run: |
          echo "$GOPASS_GPG_KEY" | gpg --batch --import
          gopass clone "$GOPASS_STORE_REPO"

      - name: Resolve app name
        id: app
        run: |
          APP=$(basename "${{ matrix.tfvars }}" .tfvars)
          echo "name=$APP" >> "$GITHUB_OUTPUT"

      - name: Fetch SSH key from gopass
        run: |
          gopass show -o "infra/ssh-keys/${{ steps.app.outputs.name }}" > /tmp/deploy_key
          chmod 600 /tmp/deploy_key

      - name: Fetch secrets from gopass
        id: secrets
        run: |
          DB_PASSWORD=$(gopass show -o "apps/${{ steps.app.outputs.name }}/db_password")
          GIT_TOKEN=$(gopass show -o "apps/${{ steps.app.outputs.name }}/git_token" 2>/dev/null || echo "")
          echo "::add-mask::$DB_PASSWORD"
          echo "::add-mask::$GIT_TOKEN"
          echo "db_password=$DB_PASSWORD" >> "$GITHUB_OUTPUT"
          echo "git_token=$GIT_TOKEN"     >> "$GITHUB_OUTPUT"

      - name: tofu init
        env:
          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
        run: |
          tofu init \
            -backend-config="bucket=tofu-state" \
            -backend-config="key=apps/${{ steps.app.outputs.name }}.tfstate" \
            -backend-config="endpoint=${{ secrets.SEAWEED_S3_ENDPOINT }}" \
            -backend-config="region=us-east-1" \
            -backend-config="force_path_style=true"

      - name: Select workspace
        run: tofu workspace select "${{ steps.app.outputs.name }}"

      - name: tofu destroy
        env:
          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
        run: |
          tofu destroy -auto-approve \
            -var-file="${{ matrix.tfvars }}" \
            -var="ssh_key_path=/tmp/deploy_key" \
            -var="db_password=${{ steps.secrets.outputs.db_password }}" \
            -var="openresty_git_token=${{ steps.secrets.outputs.git_token }}"

      - name: Delete workspace
        run: |
          tofu workspace select default
          tofu workspace delete "${{ steps.app.outputs.name }}"

      - name: Cleanup SSH key
        if: always()
        run: rm -f /tmp/deploy_key