teardown-reusable.yml

name: Teardown (Reusable)

on:
  workflow_call:
    inputs:
      aws_role_arn:
        description: 'AWS Role ARN for credential assumption'
        required: true
        type: string
      aws_region:
        description: 'AWS region'
        required: false
        type: string
        default: 'us-east-1'
      cdk_env:
        description: 'CDK environment variables'
        required: true
        type: string

jobs:
  destroy:
    name: Teardown
    runs-on: ubuntu-latest
    timeout-minutes: 15

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          cache: 'npm'

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ inputs.aws_role_arn }}
          aws-region: ${{ inputs.aws_region }}
          role-session-name: teardown-lambda-starter

      - name: Install infrastructure dependencies
        working-directory: ./infrastructure
        run: npm ci

      - name: Create infrastructure .env file
        working-directory: ./infrastructure
        run: echo "${{ inputs.cdk_env }}" > .env

      - name: Destroy CDK stacks
        working-directory: ./infrastructure
        run: npm run destroy:all -- --force --progress events

      # Final Step: Clean up sensitive infrastructure files
      - name: Clean up sensitive files
        if: always()
        working-directory: ./infrastructure
        run: |
          echo "🧹 Cleaning up sensitive files..."
          rm -f .env
          rm -rf cdk.out
          echo "✅ Sensitive files cleaned up"