name: test-ci-bootstrap-oss

permissions:
  contents: read

on:
  pull_request:
    branches:
      - main
    paths:
      - enos/ci/**
      - .github/workflows/test-ci-bootstrap-oss.yml
  push:
    branches:
      - main
    paths:
      - enos/ci/**
      - .github/workflows/test-ci-bootstrap-oss.yml

jobs:
  bootstrap-ci-oss:
    if: ${{ github.event.repository.name == 'boundary' }}
    env:
      TF_WORKSPACE: "boundary-ci-enos-bootstrap"
      TF_VAR_repository: boundary
      TF_VAR_aws_ssh_public_key: ${{ secrets.SSH_KEY_PUBLIC_CI }}
      TF_TOKEN_app_terraform_io: ${{ secrets.TF_API_TOKEN }}
    runs-on: ${{ fromJSON(vars.RUNNER) }}
    steps:
      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1    # TSCCR: loading action configs: failed to query HEAD reference: failed to get advertised references: authorization failed
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
          role-skip-session-tagging: true
          role-duration-seconds: 3600
      - name: Init Terraform
        id: tf_init
        run: |
          terraform -chdir=enos/ci/bootstrap init
      - name: Plan Terraform
        id: tf_plan
        run: |
          terraform -chdir=enos/ci/bootstrap plan
      - name: Apply Terraform
        if: ${{ github.ref == 'refs/heads/main' }}
        id: tf_apply
        run: |
          terraform -chdir=enos/ci/bootstrap apply -auto-approve