diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..ac6f090 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,14 @@ +## Hva endres, og hvorfor? + + + +## Hva sier planen? + + + +## Sjekkliste + +- [ ] Ingen ressurser rives eller erstattes +- [ ] Porten er grønn \ No newline at end of file diff --git a/.github/workflows/cd-dev.yml b/.github/workflows/cd-dev.yml new file mode 100644 index 0000000..2c5302f --- /dev/null +++ b/.github/workflows/cd-dev.yml @@ -0,0 +1,81 @@ +# ============================================================================= +# .github/workflows/cd-dev.yml – alt som merges til main, går rett til dev +# ----------------------------------------------------------------------------- +# Stackene rulles ut i rekkefølgen kjor.sh bestemmer (se LAG der). +# +# Kan også startes for hånd (Run workflow). Det trenger du hver morgen: +# nattjobben sletter ressursgruppene dine, men ikke staten, så en ny kjøring +# bygger alt opp igjen. +# ============================================================================= + +name: CD dev + +run-name: dev ← ${{ github.sha }} + +on: + push: + branches: [main] + paths: + - "stacks/**" + - "modules/**" + - "config/**" + - "shared/**" + - "scripts/kjor.sh" + - ".github/workflows/cd-dev.yml" + workflow_dispatch: + +permissions: + id-token: write + contents: read + +concurrency: + group: cd-dev + cancel-in-progress: false + +jobs: + rull-ut: + runs-on: ubuntu-latest + environment: dev + + env: + ARM_USE_OIDC: true + ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + TF_IN_AUTOMATION: true + + steps: + - name: Hent koden + uses: actions/checkout@v5 + + - name: Installer Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: 1.16.0 + terraform_wrapper: false + + - name: Logg inn i Azure + uses: Azure/login@v3.1.0 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + - name: Hvem er jeg + run: az account show --query "{navn:name, type:user.type, bruker:user.name}" -o json + + - name: Plan og apply + run: bash scripts/kjor.sh dev apply + + - name: Skriv oppsummering + if: always() + run: | + { + echo "## Utrulling til dev" + echo + echo "Commit: \`${{ github.sha }}\`" + echo + cat rapport.md 2>/dev/null || true + echo + echo "**Til prod:** Actions → *CD prod* → *Run workflow* → lim inn SHA-en over." + } >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file diff --git a/.github/workflows/cd-prod.yml b/.github/workflows/cd-prod.yml new file mode 100644 index 0000000..eaec4f2 --- /dev/null +++ b/.github/workflows/cd-prod.yml @@ -0,0 +1,91 @@ +# ============================================================================= +# .github/workflows/cd-prod.yml – promotering til prod +# ----------------------------------------------------------------------------- +# Startes for hånd med SHA-en fra en vellykket utrulling til dev. prod- +# environmentet har en godkjenningsport (Required reviewers), så jobben venter +# til noen har sagt ja. +# +# Hva godkjenner du? At commiten som ble rullet ut i dev, skal ut i prod. Les +# prod-planen på PR-en før du trykker. +# ============================================================================= + +name: CD prod + +run-name: prod ← ${{ inputs.sha }} + +on: + workflow_dispatch: + inputs: + sha: + description: Hele commit-SHA-en som allerede er rullet ut i dev + type: string + required: true + +permissions: + id-token: write + contents: read + +concurrency: + group: cd-prod + cancel-in-progress: false + +jobs: + rull-ut: + runs-on: ubuntu-latest + environment: prod + + env: + ARM_USE_OIDC: true + ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + TF_IN_AUTOMATION: true + + steps: + - name: Hent commiten som skal promoteres + uses: actions/checkout@v5 + with: + ref: ${{ inputs.sha }} + fetch-depth: 0 + + - name: Sjekk at commiten ligger på main + env: + SHA: ${{ inputs.sha }} + run: | + if ! git merge-base --is-ancestor "$SHA" origin/main; then + echo "::error::$SHA ligger ikke på main. Bare commits som er merget, kan promoteres." + exit 1 + fi + echo "OK: $SHA ligger på main." + + - name: Installer Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: 1.16.0 + terraform_wrapper: false + + - name: Logg inn i Azure + uses: Azure/login@v3.1.0 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + - name: Hvem er jeg + run: az account show --query "{navn:name, type:user.type, bruker:user.name}" -o json + + - name: Plan og apply + run: bash scripts/kjor.sh prod apply + + - name: Skriv oppsummering + if: always() + env: + SHA: ${{ inputs.sha }} + run: | + { + echo "## Promotering til prod" + echo + echo "Commit: \`$SHA\`" + echo + cat rapport.md 2>/dev/null || true + } >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..e0b360b --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,132 @@ +# ============================================================================= +# .github/workflows/ci.yml – kontroll av koden, før den slås sammen +# ----------------------------------------------------------------------------- +# Kjører på hver pull request mot main. Tre jobber: +# +# kodekontroll scripts/valider.sh – fmt, validate, TFLint, Checkov +# plan mot dev hva skjer i dev når dette merges? +# plan mot prod hva skjer i prod når dette promoteres? +# +# Gjør alle tre til required status checks på main. +# +# Planen mot prod sammenligner PR-en med det som står i prod NÅ. Er det merget +# noe til main som ikke er promotert ennå, ser du det også i prod-planen. +# ============================================================================= + +name: CI + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +concurrency: + group: ci-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + kontroll: + name: kodekontroll + runs-on: ubuntu-latest + + steps: + - name: Hent koden + uses: actions/checkout@v5 + + - name: Installer Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: 1.16.0 + + - name: Installer TFLint + uses: terraform-linters/setup-tflint@v6 + with: + tflint_version: v0.64.0 + + - name: Installer Python + uses: actions/setup-python@v7 + with: + python-version: "3.12" + + - name: Installer Checkov + run: pip install checkov==3.3.21 + + - name: Kjør valider.sh + run: bash scripts/valider.sh + env: + GITHUB_TOKEN: ${{ github.token }} + + plan: + name: plan mot ${{ matrix.miljo }} + needs: kontroll + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + include: + - miljo: dev + environment: dev + # prod-plan har ingen godkjenningsport. En plan skriver ingenting, + # så det er ingenting å godkjenne. Se modul 6. + - miljo: prod + environment: prod-plan + + environment: ${{ matrix.environment }} + + permissions: + contents: read + id-token: write + pull-requests: write + + env: + ARM_USE_OIDC: true + ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + TF_IN_AUTOMATION: true + + steps: + - name: Hent koden + uses: actions/checkout@v5 + + - name: Installer Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: 1.16.0 + terraform_wrapper: false + + - name: Logg inn i Azure + uses: Azure/login@v3.1.0 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # kjor.sh gir 0 (ingen endringer), 2 (endringer) eller 1 (feil). + # Bare 1 skal gjøre jobben rød. + - name: Plan + id: plan + run: | + set +e + bash scripts/kjor.sh "${{ matrix.miljo }}" plan + kode=$? + set -e + echo "kode=$kode" >> "$GITHUB_OUTPUT" + [ "$kode" -ne 1 ] + + - name: Legg planen som kommentar + if: always() && steps.plan.outputs.kode != '' + env: + GH_TOKEN: ${{ github.token }} + MILJO: ${{ matrix.miljo }} + run: | + { + echo "## Terraform plan mot $MILJO" + echo + # GitHub godtar maks 65 536 tegn i en kommentar. + head -c 60000 rapport.md + } > kommentar.md + gh pr comment "${{ github.event.pull_request.number }}" --body-file kommentar.md \ No newline at end of file diff --git a/config/felles.tfvars b/config/felles.tfvars index 9fb02e5..04990f3 100644 --- a/config/felles.tfvars +++ b/config/felles.tfvars @@ -3,7 +3,7 @@ # Første PR-en din endrer kortnavnet. Det står i navnet på alle ressursene dine, # og tenanten er delt, så bruk det samme kortnavnet som i oblig 1. -kortnavn = "ENDRE-MEG" +kortnavn = "JAS" # App Service (web app) virker bare i West Europe i abonnementet dere bruker. # Ikke bytt region. diff --git a/shared/backend.hcl b/shared/backend.hcl index 6f17b34..6145a6b 100644 --- a/shared/backend.hcl +++ b/shared/backend.hcl @@ -5,7 +5,7 @@ # shared/backend.hcl i oblig 1-repoet ditt. State for oblig 2 havner under # oblig2/ i containeren, så den blander seg ikke med oblig 1. -resource_group_name = "rg-tfstate-ENDRE-MEG" -storage_account_name = "sttfENDREMEG" +resource_group_name = "rg-tfstate-JAS" +storage_account_name = "sttfJAS" container_name = "tfstate" use_azuread_auth = true