run-workflow-production.yml

name: Run APM Workflow for Production

on:
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  build-workflow:
    name: Run APM Workflow
    environment: production
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: NPM install
        working-directory: ./workflow-cli
        run: npm ci

      - name: Get AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ vars.AWS_REGION }}

      - name: Build workflow
        working-directory: ./workflow-cli
        run: npm run build

      - name: Build Intention
        run: sh ./.github/workflows/broker-intention.sh
        env:
          GITHUB_EVENT_PATH: ${{ github.event_path }}

      - name: Open intention
        uses: bcgov-nr/action-broker-intention-open@v2
        with:
          broker_jwt: ${{ secrets.BROKER_JWT }}
          intention_path: workflow-cli/intention.json
          quickstart: true

      - name: Vault login
        uses: bcgov-nr/action-broker-vault-login@v2
        with:
          action_token: ${{ env.ACTION_TOKEN_CONFIGURE }}

      - name: workflow-cli opensearch-sync
        working-directory: ./workflow-cli
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
          OS_URL: apm.io.nrs.gov.bc.ca
          OS_DOMAIN: nress-prod
          AWS_ACCOUNT_NUMBER: ${{ secrets.AWS_ACCOUNT_NUMBER }}
          VAULT_ADDR: https://knox.io.nrs.gov.bc.ca
          BROKER_TOKEN: ${{ secrets.BROKER_JWT }}
        run: |
          ./bin/run opensearch-sync

      - name: Revoke Vault Token Action
        uses: bcgov-nr/action-broker-vault-revoke@v2
        with:
          vault_token: ${{ env.VAULT_TOKEN }}

      - name: workflow-cli snapshot setup
        working-directory: ./workflow-cli
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
          OS_URL: apm.io.nrs.gov.bc.ca
          OS_DOMAIN: nress-prod
          AWS_ACCOUNT_NUMBER: ${{ secrets.AWS_ACCOUNT_NUMBER }}
        run: |
          ./bin/run snapshot setup

      - name: Close intention
        uses: bcgov-nr/action-broker-intention-close@v2
        with:
          intention_token: ${{ env.INTENTION_TOKEN }}