IaC CI CD 파이프라인 구현 - 100-hours-a-week/KTB4-16th-Cloud GitHub Wiki

name: Terraform Plan

# PR에서 코드 형식과 문법을 검사하고, 환경별로 terraform plan을 돌려서 PR 댓글로 보여준다.
# plan은 읽기 전용 서비스 계정으로 실행하므로 인프라를 바꾸지 않는다.
on:
  pull_request:
    branches: [main]
    paths:
      - "environments/**"
      - "modules/**"
      - ".github/workflows/terraform-*.yml"

permissions:
  contents: read
  id-token: write
  pull-requests: write

concurrency:
  group: tf-plan-${{ github.ref }}
  cancel-in-progress: true

env:
  TF_VERSION: "1.16.4"

jobs:
  check:
    name: fmt and validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Format check
        run: terraform fmt -check -recursive

      # 백엔드와 인증 없이 문법만 검사한다. 개발(dev)은 CI/CD로 plan, apply를 하지 않지만 코드 문법 검사는 같이 한다.
      - name: Validate each environment
        run: |
          for e in dev staging prod; do
            echo "== $e"
            terraform -chdir="environments/$e" init -backend=false -input=false
            terraform -chdir="environments/$e" validate
          done

  plan:
    name: plan (${{ matrix.env }})
    needs: check
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        env: [staging, prod]
    # 스테이징은 DB를 꺼 두면 Terraform이 조회하지 못해서 plan이 실패할 수 있다. 실패해도 PR을 막지 않는다.
    continue-on-error: ${{ matrix.env == 'staging' }}
    defaults:
      run:
        working-directory: environments/${{ matrix.env }}
    steps:
      - uses: actions/checkout@v7

      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ vars.TF_WIF_PROVIDER }}
          service_account: ${{ vars.TF_PLAN_SA }}

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      # 환경별 입력값(tfvars)은 비밀이 아닌 값만 GitHub 변수 TFVARS_<환경>에 둔다.
      - name: Write tfvars
        env:
          TFVARS: ${{ vars[format('TFVARS_{0}', matrix.env)] }}
        run: printf '%s\n' "$TFVARS" > terraform.tfvars

      - name: Init
        run: terraform init -input=false -backend-config=backend.hcl

      - name: Plan
        id: plan
        run: |
          set -o pipefail
          terraform plan -input=false -lock-timeout=60s -no-color -out=tfplan 2>&1 | tee plan.txt

      - name: Summarize changes
        id: sum
        if: steps.plan.outcome == 'success'
        run: |
          terraform show -json tfplan > plan.json
          ADD=$(jq '[.resource_changes[]? | select(.change.actions==["create"])] | length' plan.json)
          CHG=$(jq '[.resource_changes[]? | select(.change.actions==["update"])] | length' plan.json)
          DEL=$(jq '[.resource_changes[]? | select(.change.actions | index("delete"))] | length' plan.json)
          echo "text=추가 ${ADD}, 변경 ${CHG}, 삭제 또는 교체 ${DEL}" >> "$GITHUB_OUTPUT"
          if [ "$DEL" -gt 0 ]; then
            echo "warn=삭제 또는 교체가 포함되어 있습니다. 내용을 꼭 확인하세요." >> "$GITHUB_OUTPUT"
          fi

      - name: Comment on PR
        if: always()
        uses: actions/github-script@v7
        env:
          ENV_NAME: ${{ matrix.env }}
          SUMMARY: ${{ steps.sum.outputs.text }}
          WARN: ${{ steps.sum.outputs.warn }}
          PLAN_OUTCOME: ${{ steps.plan.outcome }}
        with:
          script: |
            const fs = require('fs');
            const env = process.env.ENV_NAME;
            const file = `environments/${env}/plan.txt`;
            let plan = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '(plan 출력 없음)';
            const max = 60000;
            if (plan.length > max) plan = plan.slice(0, max) + '\n... (너무 길어서 잘림)';
            const status = process.env.PLAN_OUTCOME === 'success' ? process.env.SUMMARY : 'plan 실패';
            const warn = process.env.WARN ? `\n> ${process.env.WARN}\n` : '';
            const marker = `<!-- tf-plan-${env} -->`;
            const body = `### Terraform plan: ${env}\n\n${status}\n${warn}\n<details><summary>plan 보기</summary>\n\n\`\`\`\n${plan}\n\`\`\`\n</details>\n\n${marker}`;
            const { data: comments } = await github.rest.issues.listComments({ ...context.repo, issue_number: context.issue.number });
            const existing = comments.find(c => c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body });
            } else {
              await github.rest.issues.createComment({ ...context.repo, issue_number: context.issue.number, body });
            }

name: Terraform Apply

# main에 머지되면 바뀐 환경만 plan을 만들고, 환경별 승인을 받은 뒤 그 plan 그대로 apply한다.
# 수동 실행(workflow_dispatch)으로 원하는 환경만 적용할 수도 있다.
on:
  push:
    branches: [main]
    paths:
      - "environments/**"
      - "modules/**"
  workflow_dispatch:
    inputs:
      env:
        description: "적용할 환경"
        required: true
        type: choice
        options: [staging, prod]
      allow_destroy:
        description: "삭제 또는 교체가 포함된 plan도 적용한다"
        required: false
        type: boolean
        default: false

permissions:
  contents: read
  id-token: write

env:
  TF_VERSION: "1.16.4"

jobs:
  detect:
    name: 바뀐 환경 찾기
    runs-on: ubuntu-latest
    outputs:
      envs: ${{ steps.pick.outputs.envs }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 2

      - id: pick
        env:
          EVENT: ${{ github.event_name }}
          INPUT_ENV: ${{ inputs.env }}
        run: |
          set -euo pipefail
          if [ "$EVENT" = "workflow_dispatch" ]; then
            echo "envs=[\"$INPUT_ENV\"]" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          CHANGED=$(git diff --name-only HEAD^ HEAD)
          JSON="[]"
          for e in staging prod; do
            if echo "$CHANGED" | grep -qE "^(environments/${e}/|modules/${e}_modules/)"; then
              JSON=$(echo "$JSON" | jq -c --arg e "$e" '. + [$e]')
            fi
          done
          echo "바뀐 환경: $JSON"
          echo "envs=$JSON" >> "$GITHUB_OUTPUT"

  plan:
    name: plan (${{ matrix.env }})
    needs: detect
    if: needs.detect.outputs.envs != '[]'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        env: ${{ fromJson(needs.detect.outputs.envs) }}
    concurrency:
      group: tf-state-${{ matrix.env }}
      cancel-in-progress: false
    defaults:
      run:
        working-directory: environments/${{ matrix.env }}
    steps:
      - uses: actions/checkout@v7

      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ vars.TF_WIF_PROVIDER }}
          service_account: ${{ vars.TF_PLAN_SA }}

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - name: Write tfvars
        env:
          TFVARS: ${{ vars[format('TFVARS_{0}', matrix.env)] }}
        run: printf '%s\n' "$TFVARS" > terraform.tfvars

      - name: Init
        run: terraform init -input=false -backend-config=backend.hcl

      - name: Plan
        run: |
          set -o pipefail
          terraform plan -input=false -lock-timeout=60s -no-color -out=tfplan 2>&1 | tee plan.txt

      - name: Summarize changes
        id: sum
        run: |
          terraform show -json tfplan > plan.json
          ADD=$(jq '[.resource_changes[]? | select(.change.actions==["create"])] | length' plan.json)
          CHG=$(jq '[.resource_changes[]? | select(.change.actions==["update"])] | length' plan.json)
          DEL=$(jq '[.resource_changes[]? | select(.change.actions | index("delete"))] | length' plan.json)
          echo "$DEL" > destroy.txt
          {
            echo "### ${{ matrix.env }}: 추가 ${ADD}, 변경 ${CHG}, 삭제 또는 교체 ${DEL}"
            echo '```'
            head -c 60000 plan.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - uses: actions/upload-artifact@v4
        with:
          name: tfplan-${{ matrix.env }}
          path: |
            environments/${{ matrix.env }}/tfplan
            environments/${{ matrix.env }}/plan.txt
            environments/${{ matrix.env }}/destroy.txt
          retention-days: 1

  apply:
    name: apply (${{ matrix.env }})
    needs: [detect, plan]
    if: needs.detect.outputs.envs != '[]'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        env: ${{ fromJson(needs.detect.outputs.envs) }}
    # 환경(tf-staging, tf-prod)에 지정한 승인자가 승인해야 시작한다.
    environment: tf-${{ matrix.env }}
    concurrency:
      group: tf-state-${{ matrix.env }}
      cancel-in-progress: false
    defaults:
      run:
        working-directory: environments/${{ matrix.env }}
    steps:
      - uses: actions/checkout@v7

      - uses: actions/download-artifact@v4
        with:
          name: tfplan-${{ matrix.env }}
          path: environments/${{ matrix.env }}

      # 삭제 또는 교체가 들어 있으면 수동 실행에서 allow_destroy를 켠 경우에만 진행한다.
      - name: Guard destroy
        env:
          ALLOW: ${{ inputs.allow_destroy }}
        run: |
          DESTROY=$(cat destroy.txt)
          if [ "${DESTROY:-0}" -gt 0 ] && [ "$ALLOW" != "true" ]; then
            echo "plan에 삭제 또는 교체가 ${DESTROY}건 있습니다. workflow_dispatch에서 allow_destroy를 켜고 다시 실행하세요."
            exit 1
          fi

      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ vars.TF_WIF_PROVIDER }}
          service_account: ${{ vars.TF_APPLY_SA }}

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - name: Write tfvars
        env:
          TFVARS: ${{ vars[format('TFVARS_{0}', matrix.env)] }}
        run: printf '%s\n' "$TFVARS" > terraform.tfvars

      - name: Init
        run: terraform init -input=false -backend-config=backend.hcl

      # 승인 전에 보여준 plan 그대로 적용한다. 그 사이 상태가 바뀌었으면 실패한다.
      - name: Apply
        run: terraform apply -input=false -lock-timeout=60s tfplan

name: Terraform Drift

# 코드와 실제 인프라가 달라졌는지(콘솔에서 직접 바꾼 경우 등) 매주 확인한다.
on:
  schedule:
    - cron: "0 0 * * 1"   # 매주 월요일 09:00 KST
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

env:
  TF_VERSION: "1.16.4"

jobs:
  drift:
    name: drift (${{ matrix.env }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        env: [prod]
    defaults:
      run:
        working-directory: environments/${{ matrix.env }}
    steps:
      - uses: actions/checkout@v7

      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ vars.TF_WIF_PROVIDER }}
          service_account: ${{ vars.TF_PLAN_SA }}

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}
          terraform_wrapper: false

      - name: Write tfvars
        env:
          TFVARS: ${{ vars[format('TFVARS_{0}', matrix.env)] }}
        run: printf '%s\n' "$TFVARS" > terraform.tfvars

      - name: Init
        run: terraform init -input=false -backend-config=backend.hcl

      # 종료 코드 0은 변경 없음, 2는 차이 있음, 1은 오류다.
      - name: Plan
        id: plan
        run: |
          set +e
          terraform plan -input=false -lock-timeout=60s -no-color -detailed-exitcode > plan.txt 2>&1
          echo "code=$?" >> "$GITHUB_OUTPUT"

      - name: Notify Discord
        if: steps.plan.outputs.code != '0'
        env:
          WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
          CODE: ${{ steps.plan.outputs.code }}
          ENV_NAME: ${{ matrix.env }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          if [ -z "$WEBHOOK" ]; then exit 0; fi
          if [ "$CODE" = "2" ]; then MSG="코드와 실제 인프라가 다릅니다"; else MSG="plan 실행에 실패했습니다"; fi
          jq -n --arg t "Terraform drift (${ENV_NAME})" --arg d "$MSG" --arg u "$RUN_URL" \
            '{username:"MURO_BOT", embeds:[{title:$t, description:$d, url:$u, color:15158332}]}' \
            | curl -sS -H "Content-Type: application/json" -d @- "$WEBHOOK" || true

      - name: Fail on error
        if: steps.plan.outputs.code == '1'
        run: exit 1