Infrastructure Cicd Data Engineering

name: Terraform CI
on:  pull_request:    branches:      - main    paths:      - 'terraform/**'      - '.github/workflows/ci.yml'
permissions:  contents: read  pull-requests: write
jobs:  terraform-checks:    name: Terraform Checks    runs-on: ubuntu-latest        steps:      - name: Checkout code        uses: actions/checkout@v4            - name: Setup Terraform        uses: hashicorp/setup-terraform@v3        with:          terraform_version: 1.5.0            - name: Terraform Format Check        id: fmt        run: terraform fmt -check -recursive terraform/        continue-on-error: true            - name: Terraform Init (Main)        run: terraform -chdir=terraform/main init -backend=false            - name: Terraform Validate (Main)        run: terraform -chdir=terraform/main validate            - name: Comment PR        if: steps.fmt.outcome == 'failure'        uses: actions/github-script@v7        with:          script: |            github.rest.issues.createComment({              issue_number: context.issue.number,              owner: context.repo.owner,              repo: context.repo.repo,              body: '❌ Terraform formatting check failed. Run `terraform fmt -recursive terraform/` to fix.'            })            - name: Fail if format check failed        if: steps.fmt.outcome == 'failure'        run: exit 1

name: Deploy Infrastructure
on:  push:    branches:      - main    paths:      - 'terraform/main/**'  workflow_dispatch:
permissions:  id-token: write  contents: read  pull-requests: write
jobs:  terraform-plan:    name: Terraform Plan    runs-on: ubuntu-latest        steps:      - name: Checkout code        uses: actions/checkout@v4            - name: Configure AWS credentials        uses: aws-actions/configure-aws-credentials@v4        with:          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}          aws-region: us-east-1            - name: Setup Terraform        uses: hashicorp/setup-terraform@v3        with:          terraform_version: 1.5.0            - name: Terraform Init        run: terraform -chdir=terraform/main init            - name: Terraform Plan        id: plan        run: |          terraform -chdir=terraform/main plan -no-color -out=tfplan          terraform -chdir=terraform/main show -no-color tfplan > plan.txt            - name: Upload plan        uses: actions/upload-artifact@v4        with:          name: terraform-plan          path: |            terraform/main/tfplan            plan.txt          retention-days: 5    terraform-apply:    name: Terraform Apply    needs: terraform-plan    runs-on: ubuntu-latest    environment: production        steps:      - name: Checkout code        uses: actions/checkout@v4            - name: Configure AWS credentials        uses: aws-actions/configure-aws-credentials@v4        with:          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}          aws-region: us-east-1            - name: Setup Terraform        uses: hashicorp/setup-terraform@v3        with:          terraform_version: 1.5.0            - name: Terraform Init        run: terraform -chdir=terraform/main init            - name: Download plan        uses: actions/download-artifact@v4        with:          name: terraform-plan          path: terraform/main/            - name: Terraform Apply        run: terraform -chdir=terraform/main apply -auto-approve tfplan

- name: Terraform Plan  run: |    terraform -chdir=terraform/main plan \      -var-file=environments/${{ github.event.inputs.environment }}.tfvars \      -out=tfplan

jobs:  terraform-plan:    strategy:      matrix:        environment: [dev, staging, production]    name: Plan - ${{ matrix.environment }}    runs-on: ubuntu-latest    environment: ${{ matrix.environment }}        steps:      - uses: actions/checkout@v4            - uses: aws-actions/configure-aws-credentials@v4        with:          role-to-assume: ${{ secrets[format('AWS_ROLE_ARN_{0}', matrix.environment)] }}          aws-region: us-east-1            - uses: hashicorp/setup-terraform@v3            - name: Terraform Plan        run: |          terraform -chdir=terraform/main plan \            -var-file=environments/${{ matrix.environment }}.tfvars \            -out=tfplan-${{ matrix.environment }}

name: Terraform Drift Detection
on:  schedule:    - cron: '0 6 * * *'  # Daily at 6 AM UTC  workflow_dispatch:
permissions:  id-token: write  contents: read  issues: write
jobs:  detect-drift:    name: Detect Infrastructure Drift    runs-on: ubuntu-latest        steps:      - uses: actions/checkout@v4            - uses: aws-actions/configure-aws-credentials@v4        with:          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}          aws-region: us-east-1            - uses: hashicorp/setup-terraform@v3            - name: Terraform Init        run: terraform -chdir=terraform/main init            - name: Terraform Plan        id: plan        run: |          terraform -chdir=terraform/main plan -detailed-exitcode -no-color > plan.txt        continue-on-error: true            - name: Create Issue on Drift        if: steps.plan.outputs.exitcode == 2        uses: actions/github-script@v7        with:          script: |            const fs = require('fs');            const plan = fs.readFileSync('plan.txt', 'utf8');                        await github.rest.issues.create({              owner: context.repo.owner,              repo: context.repo.repo,              title: '⚠️ Infrastructure Drift Detected',              body: `Drift detected in Terraform state.\n\n\`\`\`\n${plan}\n\`\`\``,              labels: ['drift', 'infrastructure']            });

- name: Setup Infracost  uses: infracost/actions/setup@v2  with:    api-key: ${{ secrets.INFRACOST_API_KEY }}
- name: Generate cost estimate  run: |    infracost breakdown \      --path=terraform/main \      --format=json \      --out-file=/tmp/infracost.json
- name: Post cost comment  run: |    infracost comment github \      --path=/tmp/infracost.json \      --repo=$GITHUB_REPOSITORY \      --github-token=${{ secrets.GITHUB_TOKEN }} \      --pull-request=${{ github.event.pull_request.number }}

- uses: aws-actions/configure-aws-credentials@v4  with:    role-to-assume: ${{ secrets.AWS_ROLE_ARN }}    aws-region: us-east-1