workflow-destroy-on-merge.yml

name: "[Workflow] Destroy ephemeral environment"

permissions:
  id-token: write
  contents: read
  security-events: none
  pull-requests: write
  actions: none
  checks: none
  deployments: none
  issues: none
  packages: none
  repository-projects: none
  statuses: none

defaults:
  run:
    shell: bash

on:
  pull_request:
    branches:
      - main
    types:
      - closed

jobs:
  workflow_variables:
    runs-on: ubuntu-latest
    name: output workflow variables
    outputs:
      build_identifier: ${{ steps.variables.outputs.build_identifier }}
    steps:
      - uses: actions/checkout@cbb722410c2e876e24abbe8de2cc27693e501dcb # pin@v3
      - name: extract variables for workflow
        id: variables
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          export BRANCH=$(echo ${GITHUB_HEAD_REF:-${GITHUB_REF##*/}} | awk -F'_' '{print $1}' | tr -cd '[:alnum:]' | tr '[:upper:]' '[:lower:]' | cut -c1-8)
          echo "build_identifier=$(echo ${BRANCH}${PR_NUMBER})" >> $GITHUB_OUTPUT
          echo ${build_identifier}

  cleanup_workspace:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    needs:
      - workflow_variables
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - id: terraform_version
        name: get terraform version
        uses: ministryofjustice/opg-github-actions/.github/actions/terraform-version@v3.1.0
        with:
          terraform_directory: terraform/environment

      - uses: hashicorp/setup-terraform@344fef46b6edc7c46ce8b3b8b0a3ece7e77e05f0 # pin@v2.0.0
        with:
          terraform_version: ${{ steps.terraform_version.outputs.version }}
          terraform_wrapper: false

      - uses: webfactory/ssh-agent@72c0bfd31ab22a2e11716951e3f107a9647dc97e
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_ALLOW_LIST_REPOSITORY }}

      - name: Configure Terraform OIDC AWS Credentials
        uses: aws-actions/configure-aws-credentials@97834a484a5ab3c40fa9e2eb40fcf8041105a573
        with:
          aws-region: eu-west-1
          role-to-assume: "arn:aws:iam::631181914621:role/oidc-serve-development"
          role-duration-seconds: 3600
          role-session-name: terraform-oidc-serve-cleanup-on-merge

      - name: clean up environment
        working-directory: ./terraform/environment
        env:
          WORKSPACE: ${{ needs.workflow_variables.outputs.build_identifier }}
          TF_VAR_APP_VERSION: foo
        run: |
          echo "Running script against ${WORKSPACE}"
          ../../scripts/cleanup/destroy_workspace.sh ${WORKSPACE}