tf-destroy.yml

name: 'Terraform Destroy'

# Allow run manually
on:
  workflow_dispatch:


jobs:
  azure-terraform-destroy-job:
    name: 'Terraform Destroy'
    runs-on: ubuntu-latest
    env:
      project_name: "test-build"
      working_directory: examples/standard
      TF_VAR_short: "cscot"
      TF_VAR_env: "prd"
      TF_VAR_loc: "uks"
      terraform_compliance_policy_path: "git:https://github.com/cyber-scot/utilities.git//terraform/helpers/terraform-compliance-tests?ref=main"
      ARM_CLIENT_ID: ${{ secrets.SpokeSvpClientId }}
      ARM_CLIENT_SECRET: ${{ secrets.SpokeSvpClientSecret }}
      ARM_TENANT_ID: ${{ secrets.SpokeTenantId }}
      ARM_SUBSCRIPTION_ID: ${{ secrets.SpokeSubId }}
      ARM_USE_AZUREAD: true
      ARM_BACKEND_STORAGE_ACCOUNT: ${{ secrets.SpokeSaName }}
      ARM_BACKEND_BLOB_CONTAINER_NAME: ${{ secrets.SpokeSaBlobContainerName }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.working_directory }}

    steps:
      - uses: actions/checkout@v3

      - name: Set ARM_BACKEND_STATE_KEY environment variable
        run: echo "ARM_BACKEND_STATE_KEY=${{ env.TF_VAR_short }}-${{ env.TF_VAR_loc }}-${{ env.TF_VAR_env }}-${{ env.project_name }}.terraform.tfstate" >> $GITHUB_ENV

      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Install Tfenv, TfSec, Terraform-Compliance & CheckOv
        id: install-packages
        run: |
          if [ -z "${terraform_tfenv_version}" ]; then
            echo "terraform_tfenv_version is empty or not set., setting to latest" && export terraform_tfenv_version="latest" && \
            brew install tfenv
          else
            echo "terraform_tfenv_version is set, installing terraform version ${terraform_tfenv_version}" && \
            brew install tfenv@${terraform_tfenv_version}
          fi

      - name: Setup Tfenv and Install terraform
        id: setup-tfenv
        run: |
          if [ -z "${terraform_version}" ]; then
            echo "terraform_version is empty or not set., setting to latest" && export terraform_version="latest"
          
          else
            echo "terraform_version is set, installing terraform version ${terraform_version}"
          fi

          tfenv install ${terraform_version} && tfenv use ${terraform_version}

      - name: Terraform Init, Validate & Plan
        id: terraform-init-validate-plan
        run: |
          terraform init \
          -backend-config="storage_account_name=${ARM_BACKEND_STORAGE_ACCOUNT}" \
          -backend-config="container_name=${ARM_BACKEND_BLOB_CONTAINER_NAME}" \
          -backend-config="key=${ARM_BACKEND_STATE_KEY}" && \
          terraform validate && \
          terraform plan -destroy -out tfplan.plan && \
          terraform fmt -check

      - name: Terraform Destroy
        id: terraform-destroy
        run: |
          terraform apply -auto-approve tfplan.plan

      - name: Cleanup tfplan
        id: cleanup-tfplan
        run: |
          rm -rf tfplan*