deploy.yml

name: Deploy data pipeline

on:
  workflow_dispatch:
    inputs:
      confirm_apply:
        description: "Confirmar aplicação do plan revisado"
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: data-pipeline-aws-dev
  cancel-in-progress: false

jobs:
  deploy:
    if: inputs.confirm_apply
    runs-on: ubuntu-latest
    environment: aws-dev
    permissions:
      contents: read
      id-token: write
    defaults:
      run:
        working-directory: projetos/03-infraestrutura-com-terraform/terraform
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "1.9.8"
      - name: Configure temporary AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: sa-east-1
          role-session-name: github-actions-data-pipeline
      - name: Confirm active identity
        run: aws sts get-caller-identity
      - name: Initialize Terraform
        run: terraform init
      - name: Validate Terraform
        run: terraform validate
      - name: Create reviewed plan
        run: terraform plan -input=false -out=deploy.tfplan -var-file=terraform.tfvars.example
      - name: Apply reviewed plan
        run: terraform apply -input=false deploy.tfplan
      - name: Show outputs
        run: terraform output