fix: remove csuf email verification (no longer working) #357
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy with Terraform | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_call: | |
| secrets: | |
| GIT_CRYPT_KEY: | |
| required: true | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| # Use Nix for all of our build commands. | |
| # Doing this will automatically run everything in our devShell. | |
| shell: nix develop -c bash -e -o pipefail {0} | |
| jobs: | |
| deploy: | |
| name: Deploy with Terraform | |
| runs-on: ubuntu-latest | |
| environment: Production | |
| concurrency: Production | |
| outputs: | |
| commit_hash: ${{ steps.git-commit.outputs.commit_hash }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Use ref_name instead of ref so we always get the branch to pull our | |
| # latest commit from. | |
| ref: ${{ github.ref_name }} | |
| - uses: nixbuild/nix-quick-install-action@v30 | |
| - uses: nix-community/cache-nix-action@v6 | |
| with: # see https://github.com/nix-community/cache-nix-action#example-steps | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 1G | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-primary-key: never | |
| # Add a Nix channel as a workaround for terraform-nixos-ng. | |
| # See https://github.com/Gabriella439/terraform-nixos-ng/issues/11. | |
| # | |
| # TODO: Remove this once terraform-nixos-ng is fixed. | |
| - name: Add NixOS channel | |
| run: |- | |
| nix-channel --add https://nixos.org/channels/nixos-unstable nixpkgs | |
| nix-channel --update | |
| shell: bash | |
| # Task: Initialize development environment | |
| # This step is a no-op. It just forces a first invocation of `nix develop` | |
| # and will let us isolate any issues with the Nix environment. | |
| - name: Initialize development environment | |
| run: true | |
| # Task: Handle Makefiles | |
| # This shouldn't need any secrets. | |
| # Avoid giving it any. | |
| - name: Run all package Makefiles | |
| run: ./scripts/pkg make | |
| - name: Commit changes, if any | |
| uses: stefanzweifel/git-auto-commit-action@v5 | |
| with: | |
| branch: ${{ github.ref_name }} | |
| commit_message: Run all Makefiles using GitHub Actions | |
| # Task: Apply Terraform deployment | |
| - name: Decrypt git-crypt secrets | |
| uses: ./.github/actions/git-crypt | |
| with: | |
| key: ${{ secrets.GIT_CRYPT_KEY }} | |
| - name: Initialize Tailscale | |
| uses: tailscale/github-action@v3 | |
| with: | |
| oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} | |
| oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} | |
| tags: tag:server | |
| - name: Initialize Terraform | |
| id: terraform-init | |
| run: |- | |
| chmod 640 secrets/terraform.tfstate* | |
| terraform init | |
| - name: Calculate a Terraform deployment plan | |
| id: terraform-plan | |
| run: |- | |
| set +e | |
| terraform plan --detailed-exitcode --out="/tmp/acm-aws-plan" | |
| status=$? | |
| set -e | |
| if [[ $status == 1 ]]; then | |
| echo "::error::Terraform plan failed, exiting..." | |
| exit 1 | |
| fi | |
| # 0 - Succeeded, diff is empty (no changes) | |
| # 1 - Errored | |
| # 2 - Succeeded, there is a diff | |
| echo "status=$status" >> $GITHUB_OUTPUT | |
| - name: Apply Terraform configurations | |
| id: terraform-apply | |
| if: steps.terraform-plan.outputs.status == 2 | |
| run: |- | |
| set -o pipefail | |
| terraform apply --auto-approve "/tmp/acm-aws-plan" \ | |
| |& tee /tmp/terraform-apply.log \ | |
| |& grep -v 'deployment.null_resource.deploy (.*-exec):' | |
| - name: Commit changes, if any | |
| id: git-commit | |
| if: steps.terraform-plan.outputs.status == 2 | |
| uses: stefanzweifel/git-auto-commit-action@v5 | |
| with: | |
| commit_message: "Update deployment using GitHub Actions" | |
| branch: ${{ github.ref_name }} | |
| - name: Prepare Terraform deployment logs | |
| id: terraform-logs-prepare | |
| if: steps.terraform-plan.outputs.status == 2 && failure() | |
| run: |- | |
| ./scripts/encrypt-ssh \ | |
| /tmp/terraform-apply.log \ | |
| /tmp/terraform-apply.log.enc | |
| - name: Upload Terraform deployment logs | |
| id: terraform-logs-upload | |
| if: steps.terraform-plan.outputs.status == 2 && failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: terraform-apply.log.enc | |
| path: /tmp/terraform-apply.log.enc |