Terraform

.github/workflows/docker-ci.yml → .github/workflows/docker-ci.txt

@@ -11,6 +11,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Setup .NET'
         uses: actions/setup-dotnet@v4
@@ -32,6 +34,8 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: 'Login via Azure CLI'
         uses: azure/login@v1
@@ -53,9 +57,12 @@ jobs:
 
       - run: |
           docker build . \
-            --build-arg GIT_SHA=${{ steps.commit.outputs.sha }} \
-            --build-arg "GIT_COMMIT_MSG=${{ steps.commit.outputs.msg }}" \
+            --build-arg GIT_SHA=${STEPS_COMMIT_OUTPUTS_SHA} \
+            --build-arg "GIT_COMMIT_MSG=${STEPS_COMMIT_OUTPUTS_MSG}" \
             -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/thesexy6bot:${{ github.sha }} \
             -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/thesexy6bot:latest
           docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/thesexy6bot:${{ github.sha }}
           docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/thesexy6bot:latest
+        env:
+          STEPS_COMMIT_OUTPUTS_SHA: ${{ steps.commit.outputs.sha }}
+          STEPS_COMMIT_OUTPUTS_MSG: ${{ steps.commit.outputs.msg }}

.github/workflows/pr-validation.yml

@@ -1,26 +1,146 @@
 name: PR Validation
 
+permissions: {}
+
 on:
   pull_request:
     branches: [main]
 
 jobs:
-  test:
+  changes:
+    permissions:
+      pull-requests: read
+    runs-on: ubuntu-latest
+    outputs:
+      terraform: ${{ steps.filter.outputs.terraform }}
+      github: ${{ steps.filter.outputs.github }}
+    steps:
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
+        id: filter
+        with:
+          filters: |
+            terraform:
+              - 'src/terraform/**'
+            github:
+              - '.github/**'
+
+
+  zizmor-scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: changes
+    if: needs.changes.outputs.github == 'true'
+    steps:
+      - name: Sparse Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 1
+          sparse-checkout: |
+            .github
+          sparse-checkout-cone-mode: true
+          persist-credentials: false
+
+      - name: Zizmor Scan
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false
+          inputs:
+            .github
+          fail-on-no-inputs: true
+
+
+  terraform-plan:
+    permissions:
+      id-token: write
+      contents: read
+    environment: stg
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.terraform == 'true'
+    env: 
+      ARM_USE_OIDC: true
+      ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+    steps:
+        - name: Checkout Terraform files only
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+          with:
+            fetch-depth: 1
+            sparse-checkout: |
+              src/terraform
+            sparse-checkout-cone-mode: true
+            persist-credentials: false
+
+        - name: Token replace Terraform env vars
+          env:
+            ENVIRONMENT: ${{ vars.NAME_PREFIX }}
+          run: |
+            sed "s|__ENVIRONMENT__|${ENVIRONMENT}|g" \
+              src/terraform/environment.tfvars \
+              > src/terraform/environment.auto.tfvars
+
+        - name: Azure Login
+          uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
+          with:
+            client-id: ${{ secrets.AZURE_CLIENT_ID }}
+            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} 
+            enable-AzPSSession: true
+        - name: Setup Terraform
+          uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd 
+          with:
+            terraform_version: 1.9.8
+        - name: Terraform Init
+          run: |
+           terraform -chdir=src/terraform init -input=false \
+           -backend-config="resource_group_name=${VARS_TFSTATE_RESOURCE_GROUP}" \
+           -backend-config="storage_account_name=${VARS_TFSTATE_STORAGE_ACCOUNT}" \
+           -backend-config="container_name=${VARS_TFSTATE_CONTAINER}" \
+           -backend-config="key=${VARS_TFSTATE_KEY}" \
+          env:
+            VARS_TFSTATE_RESOURCE_GROUP: ${{ vars.TFSTATE_RESOURCE_GROUP}}
+            VARS_TFSTATE_STORAGE_ACCOUNT: ${{ vars.TFSTATE_STORAGE_ACCOUNT}}
+            VARS_TFSTATE_CONTAINER: ${{ vars.TFSTATE_CONTAINER}}
+            VARS_TFSTATE_KEY: ${{ vars.TFSTATE_KEY}}
+
+        - name: Terraform Plan
+          run: terraform -chdir=src/terraform plan -input=false -no-color
+
+
+  test-dotnet:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: 'Setup .NET'
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: '9.0.x'
 
       - name: 'Restore dependencies'
-        run: dotnet restore TheSexy6BotWorker.sln
+        run: dotnet restore TheSexy6BotWorker.slnx
 
       - name: 'Build'
-        run: dotnet build TheSexy6BotWorker.sln --no-restore
+        run: dotnet build TheSexy6BotWorker.slnx --no-restore
 
       - name: 'Test'
-        run: dotnet test TheSexy6BotWorker.sln --no-build --verbosity normal --filter "Category!=Integration"
+        run: dotnet test TheSexy6BotWorker.slnx --no-build --verbosity normal --filter "Category!=Integration"
+
+  status-check:
+    if: ${{ always() }}
+    needs: [test-dotnet, terraform-plan, zizmor-scan]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if required jobs failed
+        run: |
+          echo "dotnet=${{ needs.test-dotnet.result }}"
+          echo "terraform=${{ needs.terraform-plan.result }}"
+          echo "zizmor=${{ needs.zizmor-scan.result }}"
+          test "${{ needs.test-dotnet.result }}" = "success"
+          test "${{ needs.terraform-plan.result }}" = "success" -o "${{ needs.terraform-plan.result }}" = "skipped"
+          test "${{ needs.zizmor-scan.result }}" = "success" -o "${{ needs.zizmor-scan.result }}" = "skipped"

.github/workflows/uks-discordbot-capp-AutoDeployTrigger-1d9d2bc7-25ca-4498-aade-a6f0d0ff776e.yml

@@ -45,7 +45,7 @@ jobs:
           COMMIT_MSG_SAFE="$(git log -1 --pretty=%s | tr -cs '[:alnum:]._+-' '-')"
           echo "msg_safe=${COMMIT_MSG_SAFE}" >> $GITHUB_OUTPUT
 
-      - name: Azure Login
+      - name : Azure Login
         uses: azure/login@v2
         with:
           client-id: ${{ secrets.UKSDISCORDBOTCAPP_AZURE_CLIENT_ID }}

.gitignore

@@ -363,4 +363,11 @@ MigrationBackup/
 FodyWeavers.xsd
 
 # TheSexy6BotWorker
-.env
+.env
+
+#terraform
+
+src/terraform/.terraform*
+.terraform.lock.hcl
+
+*terraform.tfstate*

.vscode/settings.json

@@ -0,0 +1,5 @@
+{
+    "chat.tools.terminal.autoApprove": {
+        "terraform": true
+    }
+}

TheSexy6BotWorker.slnx

@@ -1,4 +1,4 @@
 <Solution>
   <Folder Name="/Solution Items/" />
-  <Project Path="TheSexy6BotWorker/TheSexy6BotWorker.csproj" />
+  <Project Path="src/dotnet/TheSexy6BotWorker/TheSexy6BotWorker.csproj" />
 </Solution>

src/terraform/README.md

@@ -0,0 +1,6 @@
+
+
+
+Before running tf plan:
+1. Set environment subscription
+run `export ARM_SUBSCRIPTION_ID=your-subscription-id`

src/terraform/container_app.tf

@@ -0,0 +1,42 @@
+resource "azurerm_container_app_environment" "this" {
+  name                       = "${local.name_prefix}-cae"
+  location                   = azurerm_resource_group.this.location
+  resource_group_name        = azurerm_resource_group.this.name
+  log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id
+  tags = local.common_tags
+}
+
+resource "azurerm_container_app" "this" {
+  name                         = "${local.name_prefix}-app"
+  container_app_environment_id = azurerm_container_app_environment.this.id
+  resource_group_name          = azurerm_resource_group.this.name
+  revision_mode                = "Single"
+  tags = local.common_tags
+
+  // bootstrap - pipeline owns image
+  template {
+    container {
+      name   = "${local.name_prefix}"
+      image  = "mcr.microsoft.com/k8se/quickstart:latest"
+      cpu    = 0.25
+      memory = "0.5Gi"
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      template[0].container[0].image,
+    ]
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+}
+
+// rbac
+resource "azurerm_role_assignment" "container_app_acr_pull" {
+  scope                = azurerm_container_app.this.id
+  role_definition_name = "Contributor"
+  principal_id         = data.azurerm_client_config.this.object_id
+}

src/terraform/container_registry.tf

@@ -0,0 +1,25 @@
+resource "azurerm_container_registry" "this" {
+    name                = "${local.name_prefix_no_dash}acr"
+    resource_group_name = azurerm_resource_group.this.name
+    location            = var.location
+    sku                 = "Basic"
+    admin_enabled       = false
+    tags                = local.common_tags
+
+    identity {
+        type = "SystemAssigned"
+    }
+}
+
+resource "azurerm_role_assignment" "acr_push" {
+    scope = azurerm_container_registry.this.id
+    role_definition_name = "AcrPush"
+    principal_id = data.azurerm_client_config.this.object_id
+}
+
+resource "azurerm_role_assignment" "acr_pull" {
+    scope = azurerm_container_registry.this.id
+    role_definition_name = "AcrPull"
+    principal_id = azurerm_container_app.this.identity[0].principal_id
+}
+

src/terraform/data.tf

@@ -0,0 +1 @@
+data "azurerm_client_config" "this" {}

src/terraform/environment.tfvars

@@ -0,0 +1,9 @@
+application = "discordbot"
+location = "uksouth"
+location_short = "uks"
+environment = "__ENVIRONMENT__"
+
+#these populate:
+# name_prefix in format "${var.environment}-${var.application}"
+# name_prefix_no_dash in format "${var.environment}${var.application}"
+# e.g. stg-uks-discordbot

src/terraform/key_vault.tf

@@ -0,0 +1,17 @@
+resource "azurerm_key_vault" "this" {
+    name = "${local.name_prefix}-kv"
+    resource_group_name = azurerm_resource_group.this.name
+    location = var.location
+    tenant_id = data.azurerm_client_config.this.tenant_id
+    purge_protection_enabled = false
+    sku_name = "standard"
+    enable_rbac_authorization   = true
+
+    tags = local.common_tags
+}
+
+resource "azurerm_role_assignment" "kv_pipeline_access" {
+    scope = azurerm_key_vault.this.id
+    role_definition_name = "Key Vault Secrets User"
+    principal_id = data.azurerm_client_config.this.client_id
+}

src/terraform/law.tf

@@ -0,0 +1,10 @@
+resource "azurerm_log_analytics_workspace" "this" {
+  name                = "${local.name_prefix}-law"
+  location            = azurerm_resource_group.this.location
+  resource_group_name = azurerm_resource_group.this.name
+  sku                 = "PerGB2018"
+  retention_in_days   = 30
+  daily_quota_gb = 1
+
+  tags = local.common_tags
+}