name: Terraform Apply / CRCR / Production

on:
  workflow_dispatch:

concurrency:
  group: "terraform-make-apply-crcr"
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  release:
    name: Terraform Apply
    runs-on: ubuntu-latest
    environment: crcr-prod

    steps:
    - name: Checkout branch
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    - name: Install Terraform
      uses: opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716 # v1.0.5
      with:
        terraform_version: 1.5.7
        terraform_wrapper: false

    - name: Install virtualenv
      run: pip install virtualenv

    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
      with:
        role-to-assume: arn:aws:iam::${{ secrets.PY_FOUNDATION_AWS_ACC_ID }}:role/${{ secrets.PY_FOUNDATION_AWS_DEPLOY_ROLE }}
        aws-region: us-east-1

    - name: Terraform Apply
      working-directory: crcr/aws
      shell: bash
      run: make apply
      env:
        TERRAFORM_EXTRAS: -auto-approve -lock-timeout=15m
        TF_VAR_environment: prod
        TF_VAR_github_app_id: ${{ secrets.CRCR_GITHUB_APP_ID }}
        TF_VAR_github_app_secret: ${{ secrets.CRCR_GITHUB_APP_SECRET }}
        TF_VAR_github_app_privatekey: ${{ secrets.CRCR_GITHUB_APP_PRIVATEKEY }}
        TF_VAR_hud_api_url: ${{ vars.CRCR_HUD_API_URL }}
        TF_VAR_hud_bot_key: ${{ secrets.CRCR_HUD_BOT_KEY }}
