name: Terraform - Multiple AWS Accounts

on:
  workflow_dispatch:
    inputs:
      action:
        description: 'Action to perform (apply or destroy)'
        required: true
        default: 'apply'
      aws_account:
        description: 'AWS Account to deploy to (shared, network, production, stage, develop)'
        required: true
      terraform_version:
        description: 'Version of Terraform to use'
        required: true
        default: '1.8.0'

jobs:
  plan:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      issues: write
      id-token: write # This is required for requesting the JWT
      contents: write  # This is required for actions/checkout
    timeout-minutes: 5
    steps:
      - name: Checkout Code
        uses: actions/checkout@v2

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'network' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_NETWORK }}
          aws-region: us-east-1

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'prod' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_PROD }}
          aws-region: us-east-1

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'stage' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_STAGE }}
          aws-region: us-east-1

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'develop' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_DEVELOP }}
          aws-region: us-east-1

      - name: Install TFLint
        run: |
          curl -L https://github.com/terraform-linters/tflint/releases/latest/download/tflint_linux_amd64.zip -o tflint.zip
          unzip tflint.zip
          sudo mv tflint /usr/local/bin/
          rm tflint.zip

      - name: Lint Terraform files
        run: tflint

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ github.event.inputs.terraform_version }}
        env:
          AWS_DEFAULT_REGION: us-east-1

      - name: Initialize Terraform
        run: terraform init -reconfigure

      - name: Plan Terraform changes
        run: terraform plan -out=tfplan

      - name: Cache Terraform files
        uses: actions/cache@v2
        with:
          path: |
            .terraform
            .terraform.lock.hcl
          key: ${{ runner.os }}-terraform-${{ hashFiles('**/*.tf') }}

      - name: Upload Terraform plan
        uses: actions/upload-artifact@v2
        with:
            name: tfplan
            path: tfplan

  approval:
    needs: plan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      issues: write
      id-token: write # This is required for requesting the JWT
      contents: write  # This is required for actions/checkout
    steps:
      - name: Request Manual Approval
        uses: trstringer/manual-approval@v1
        with:
          secret: ${{ secrets.GITHUB_TOKEN }}
          approvers: alerabello
          minimum-approvals: 1
          additional-approved-words: 'Approve, Approved, approve, approved'
        timeout-minutes: 10

  deploy:
    needs: approval
    runs-on: ubuntu-latest
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: write  # This is required for actions/checkout
    timeout-minutes: 20
    steps:
      - name: Checkout Code
        uses: actions/checkout@v2

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'network' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_NETWORK }}
          aws-region: us-east-1

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'prod' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_PROD }}
          aws-region: us-east-1

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'stage' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_STAGE }}
          aws-region: us-east-1

      - name: Configure AWS Credentials
        if: ${{ github.event.inputs.aws_account == 'develop' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_DEVELOP }}
          aws-region: us-east-1

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ github.event.inputs.terraform_version }}

      - name: Download repository artifact
        uses: actions/download-artifact@v2
        with:
          name: tfplan
          path: ./tfplan

      - name: Move Terraform plan
        run: mv ./tfplan/tfplan ./tfplan.tfplan

      - name: Initialize Terraform
        run: terraform init -reconfigure

      - name: Apply or Destroy Terraform
        run: |
          if [ "${{ github.event.inputs.action }}" == "apply" ]; then
            terraform apply -auto-approve ./tfplan.tfplan
          elif [ "${{ github.event.inputs.action }}" == "destroy" ]; then
            terraform destroy -auto-approve
          else
            echo "Invalid action specified: ${{ github.event.inputs.action }}"
            exit 1
          fi