production.yml

name: Production

on:
  workflow_dispatch:
  workflow_run:
    workflows:
      - Non-Production
    types:
      - completed

# For reusable workflows, the permissions setting for id-token should be set to write at the
# caller workflow level or in the specific job that calls the reusable workflow.

permissions:
  id-token: write

jobs:
  global_infra:
    name: "Global"
    uses: osinfra-io/github-terraform-called-workflows/.github/workflows/plan-and-apply.yml@v0.1.8
    if: github.event.workflow_run.conclusion == 'success'
    with:
      checkout_ref: ${{ github.ref }}
      environment: production
      github_environment: "Production Infrastructure: Global"
      service_account: plt-lz-identity-github@ptl-lz-terraform-tf62-prod.iam.gserviceaccount.com
      terraform_plan_args: -var-file=tfvars/production.tfvars
      terraform_state_bucket: plt-lz-identity-e194-prod
      terraform_version: ${{ vars.TERRAFORM_VERSION }}
      terraform_workspace: global-production
      working_directory: global/infra
      workload_identity_provider: projects/134040294660/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
    secrets:
      gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
      infracost_api_key: ${{ secrets.INFRACOST_API_KEY }}
      terraform_plan_secret_args: -var=billing_account=${{ secrets.BILLING_ACCOUNT }}