name: Reusable common Terraform apply workflow
on:
  workflow_call:
    inputs:
      environment:
        type: string
        required: true
      ref:
        type: string
        required: true
      task:
        type: string
        required: true
      nodeVersion:
        type: string
        required: true
      tfVersion:
        type: string
        required: true
      tfLockTimeout:
        type: string
        required: true
      awsDefaultRegion:
        type: string
        required: true
      awsAccount:
        type: string
        required: true
      dark:
        type: string
        required: true
      target:
        type: string
        required: true
      regionShortName:
        type: string
        required: true
    secrets:
      AWS_ACCESS_KEY_ID:
        required: true
      AWS_SECRET_ACCESS_KEY:
        required: true
      TEAM_GITHUB_TOKEN:
        required: true
      GLOBAL_JFROG_ARTIFACTORY_TOKEN:
        required: true
      PD_NR_INTEGRATION_KEY:
        required: true
      NEWRELIC_LICENCE_KEY:
        required: true
      NEWRELIC_API_KEY:
        required: true
      ACC_API_KEY:
        required: true
env:
  TF_IN_AUTOMATION: 'true'
  AWS_DEFAULT_REGION: ${{inputs.awsDefaultRegion}}
jobs:
  deploy:
    runs-on: nim-linux-no-docker-x86_64
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v3.3.0
        name: checkout
        with:
          ref: ${{inputs.ref}}
      - uses: actions/setup-node@v3
        with:
          node-version: '${{inputs.nodeVersion}}'
      - name: configure platform aws credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ inputs.awsDefaultRegion }}
      - name: prepare terraform files for ${{ inputs.environment }} environment
        run: |
          cp -r terraform/deployment/ terraform/deployment-${{ inputs.environment }}
          cp -r terraform/routing/ terraform/routing-${{ inputs.environment }}
      - name: remove ap-northeast-1
        if: contains('dev,test,test-ci', inputs.environment)
        run: |
          rm terraform/deployment-${{ inputs.environment }}/ap-northeast-1.tf
      - name: remove-us-east-1
        if: inputs.environment == 'dev' || inputs.environment == 'test-ci'
        run: |
          rm terraform/deployment-${{ inputs.environment }}/us-east-1.tf
      - name: remove outputs-1R.tf
        if: contains('prod,stage', inputs.environment) || inputs.environment == 'test'
        run: rm terraform/deployment-${{ inputs.environment }}/outputs-1R.tf
      - name: remove outputs-2R.tf
        if: contains('prod,stage,dev', inputs.environment) || inputs.environment == 'test-ci'
        run: rm terraform/deployment-${{ inputs.environment }}/outputs-2R.tf
      - name: remove outputs-3R.tf
        if: contains('prod,stage', inputs.environment) == false
        run: rm terraform/deployment-${{ inputs.environment }}/outputs-3R.tf
      - name: setup terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{inputs.tfVersion}}
      - name: setup github http auth
        run: |
          echo "https://gh-bot-user:${{ secrets.TEAM_GITHUB_TOKEN }}@github.com" > "${HOME}/.git-credentials"
          git config --global credential.helper store
      - name: terraform init - service
        run: |
          terraform init \
          -backend-config="config/${{ inputs.environment }}/config.remote" \
          -input=false \
          -lock=false
        working-directory: terraform/deployment-${{ inputs.environment }}
      - name: terraform apply - service - ${{ inputs.task }}
        if: inputs.task != 'deploy'
        env:
          TF_VAR_newrelic_license_key: ${{ secrets.NEWRELIC_LICENCE_KEY }}
          TF_VAR_newrelic_api_key: ${{ secrets.NEWRELIC_API_KEY }}
          TF_VAR_nr_pd_integration_key: ${{ secrets.PD_NR_INTEGRATION_KEY }}
        run: |
          terraform apply \
          -target="${{ inputs.target }}" \
          -var-file="config/${{ inputs.environment }}/terraform.tfvars" \
          -var="acc_api_key=${{ secrets.ACC_API_KEY }}" \
          -var="api_disable_routing_${{inputs.regionShortName}}=${{ inputs.dark }}" \
          -var="build_number=${{ github.run_id }}" \
          -var="commit_sha=${GITHUB_SHA:0:10}" \
          -lock-timeout=${{ inputs.tfLockTimeout }} \
          -auto-approve \
          -input=false
        working-directory: terraform/deployment-${{ inputs.environment }}
      - name: terraform apply - service
        if: inputs.task == 'deploy'
        env:
          TF_VAR_newrelic_license_key: ${{ secrets.NEWRELIC_LICENCE_KEY }}
          TF_VAR_newrelic_api_key: ${{ secrets.NEWRELIC_API_KEY }}
          TF_VAR_nr_pd_integration_key: ${{ secrets.PD_NR_INTEGRATION_KEY }}
        run: |
          terraform apply \
          -var-file="config/${{ inputs.environment }}/terraform.tfvars" \
          -var="acc_api_key=${{ secrets.ACC_API_KEY }}" \
          -var="build_number=${{ github.run_id }}" \
          -var="commit_sha=${GITHUB_SHA:0:10}" \
          -lock-timeout=${{ inputs.tfLockTimeout }} \
          -auto-approve \
          -input=false
        working-directory: terraform/deployment-${{ inputs.environment }}
      - name: terraform init - routing
        run: |
          terraform init \
          -backend-config="config/${{ inputs.environment }}/config.remote" \
          -input=false \
          -lock=false
        working-directory: terraform/routing-${{ inputs.environment }}
      - name: terraform apply - routing
        env:
          TF_VAR_newrelic_license_key: ${{ secrets.NEWRELIC_LICENCE_KEY }}
          TF_VAR_newrelic_api_key: ${{ secrets.NEWRELIC_API_KEY }}
        run: |
          terraform apply \
          -var-file="config/${{ inputs.environment }}/terraform.tfvars" \
          -var="build_number=${{ github.run_id }}" \
          -var="commit_sha=${GITHUB_SHA:0:10}" \
          -lock-timeout=${{ inputs.tfLockTimeout }} \
          -auto-approve \
          -input=false
        working-directory: terraform/routing-${{ inputs.environment }}
      - name: npm auth
        env:
          JFROG_ARTIFACTORY_TOKEN: ${{ secrets.GLOBAL_JFROG_ARTIFACTORY_TOKEN }}
        run: |
          echo "//npm.companyxplatform.com/:_authToken=$JFROG_ARTIFACTORY_TOKEN" >> .npmrc
          cp .npmrc ~/
      - name: configure environment aws credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ${{ inputs.awsDefaultRegion }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          role-to-assume: arn:aws:iam::${{ inputs.awsAccount }}:role/automation-gha-ci
      - name: wait for codedeploy
        if: inputs.task == 'deploy'
        run: npx @companyx/atl-codedeploy-wait -t ${{ inputs.environment }} -b ${{ github.run_id }}
      - name: wait for codedeploy
        if: inputs.task != 'deploy'
        run: npx @companyx/atl-codedeploy-wait -t ${{ inputs.environment }}-${{ inputs.task }} -b ${{ github.run_id }}