基础设施即代码自动化：Terraform/CloudFormation 与 Atlantis

name: Terraform CI
on:
  pull_request:
    paths:
      - 'infra/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra/prod
    permissions:
      contents: read
      pull-requests: write      # 用于写 PR 评论
      id-token: write           # OIDC 云认证
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.0
          terraform_wrapper: true     # 开启 wrapper 以便捕获 plan 输出

      - name: Terraform fmt
        run: terraform fmt -check -recursive

      - name: Terraform Init
        run: terraform init

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color
        continue-on-error: true       # plan 失败不阻断，便于在评论中展示

      - name: Post plan to PR
        uses: actions/github-script@v7
        env:
          PLAN: "${{ steps.plan.outputs.stdout }}"
        with:
          script: |
            const plan = process.env.PLAN || '';
            const body = `#### Terraform Plan 📖\n\`\`\`hcl\n${plan}\n\`\`\``;
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body
            });

      - name: Plan status
        if: steps.plan.outputs.exitcode != 0
        run: |
          echo "::error::Terraform plan 存在错误，请检查评论内容"
          exit 1

# infra/prod/backend.tf
terraform {
  backend "s3" {
    bucket         = "my-org-tfstate"
    key            = "prod/terraform.tfstate"
    region         = "ap-southeast-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"   # 锁表，防止并发 apply
  }
}

concurrency:
  group: terraform-prod-apply
  cancel-in-progress: false

jobs:
  apply:
    runs-on: ubuntu-latest
    environment:
      name: production-tf
    concurrency:
      group: tf-apply-prod
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.0
      - name: Terraform Init & Plan
        run: |
          terraform init
          terraform plan -out=tfplan
      - name: Terraform Apply
        run: terraform apply tfplan -auto-approve

terraform plan -out=tfplan      # 生成可审阅计划
terraform apply tfplan           # 只执行该计划

# atlantis.yaml（仓库根目录）
version: 3
projects:
  - dir: infra/dev
    workspace: default
    autoplan:
      enabled: true            # PR 自动 plan
  - dir: infra/prod
    workspace: default
    autoplan:
      enabled: true
    apply_requirements:
      - approved              # 需要 PR approval 才能 apply
      - mergeable             # 需要 PR 可合并

name: CloudFormation Deploy
on:
  push:
    branches: [main]
    paths: ['cloudformation/**']

jobs:
  deploy-cfn:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/CFNDeployRole
          aws-region: ap-southeast-1

      - name: Validate template
        run: |
          aws cloudformation validate-template \
            --template-body file://cloudformation/app.yaml

      - name: Deploy stack
        uses: aws-actions/aws-cloudformation-github-deploy@v1
        with:
          name: my-app-stack
          template: cloudformation/app.yaml
          capabilities: CAPABILITY_NAMED_IAM
          no-fail-on-empty-changeset: "1"

      - name: Create ChangeSet
        run: |
          aws cloudformation create-change-set \
            --stack-name my-app \
            --change-set-name review-$(date +%s) \
            --template-body file://cloudformation/app.yaml

on:
  push:
    tags: ['release-*']

jobs:
  tf-apply:
    runs-on: ubuntu-latest
    environment: production-tf
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}       # 精确 checkout tag 对应代码
      - uses: hashicorp/setup-terraform@v3
      - run: |
          terraform init
          terraform plan -out=tfplan
          terraform apply tfplan -auto-approve

      - name: Require explicit confirm
        run: |
          echo "确认销毁/重建操作？请在下游审批后再执行"

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/GHATerraformRole
      aws-region: ap-southeast-1
      role-duration-seconds: 900

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
          "token.actions.githubusercontent.com:sub": "repo:my-org/infra-repo:ref:refs/heads/main"
        }
      }
    }
  ]
}