.github/workflows/provision_users.yaml #364
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| # 15:00 UTC = 6PM/7PM Eastern Europe, 8AM/9AM Pacific | |
| - cron: "0 15 * * *" | |
| jobs: | |
| provision_users: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| CONFIG_DIRECTORY: "./config/" | |
| steps: | |
| - name: SetupOpenTofu | |
| uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Load state from artifacts | |
| continue-on-error: true # Allow for artifact not existing yet | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: provision-user-state | |
| path: $CONFIG_DIRECTORY | |
| pattern: terraform.tfstate | |
| - name: Generate a token | |
| id: generate-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.USER_MANAGEMENT_APP_ID }} | |
| private-key: ${{ secrets.USER_MANAGEMENT_PRIVATE_KEY }} | |
| # These are also set in the App's permissions, but this is more easily reviewable. | |
| permission-members: write | |
| permission-actions: read | |
| - name: OpenTofu Apply | |
| id: apply | |
| env: | |
| GH_TOKEN: ${{ steps.generate-token.outputs.token }} | |
| run: | | |
| set -e | |
| cd $CONFIG_DIRECTORY | |
| tofu init | |
| tofu validate -no-color | |
| tofu apply -no-color -input=false -auto-approve | |
| # NOTE: we don't encrypt/decrypt the state file, as it only contains | |
| # (public) github memberships. | |
| - name: Save state to artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: provision-user-state | |
| path: $CONFIG_DIRECTORY/terraform.tfstate |