Terraform+CSV+GitHub ActionsでGitHub Organizationのメンバー管理をやってみた-③仕組み編

.
├── .github/
│   └── workflows/ #GitHub Actionsのワークフローファイルの格納フォルダ
│       ├── apply.yml # Pull Requestマージ時に実行されるterraform apply用ワークフローファイル
│       └── plan.yml # Pull Request時に実行されるterraform plan用ワークフローファイル
├── shell/
│   └── script.sh # GitHub Appsトークン生成用シェルスクリプト
├── terraform/ #tfファイル格納用フォルダ
│   ├── module/
│   │   └── terraform-github-organization/ # Organizationのメンバー管理用モジュールフォルダ
│   │       ├── main.tf # モジュールのメインtfファイル
│   │       └── variables.tf # モジュールの変数用tfファイル
│   ├── .terraform.lock.hcl # terraform init時に自動生成されるプロバイダロックファイル
│   ├── organization.tf # モジュールに渡す引数を定義するtfファイル。チーム追加時などに更新するファイル
│   ├── README.md # organization.tfの内容を説明したREADMEファイル
│   └── versions.tf # terraform version、プロパイダー、バックエンドを指定するファイル
├── users/ #メンバー管理用のCSVファイルを格納するフォルダ
│   └── *.csv
├── .gitignore
└── README.md

locals {
  owners     = csvdecode(file("../users/owners.csv"))
  members    = csvdecode(file("../users/members.csv"))
  test-team  = csvdecode(file("../users/test-team.csv"))
  exsit-team = csvdecode(file("../users/exsit-team.csv"))
}

module "organization" {
  source = "./module/terraform-github-organization"

  name = "example"

  owners  = local.owners[*].username
  members = local.members[*].username

  existing_teams = ["exist-team"]

  teams = [
    {
      name    = "Test Team"
      members = local.test-team[*].username
    },
    {
      name    = "exist-team"
      members = local.exsit-team[*].username
    }
  ]
}

# see https://www.terraform.io/docs/configuration/terraform.html
terraform {
  required_version = "~> 1.10.5"

  required_providers {
    github = {
      source  = "hashicorp/github"
      version = "~> 6.5.0"
    }
  }

  backend "s3" {
    bucket = "" #S3バケット名を指定
    key    = "" #tfstateファイル用のKeyを指定。特に命名規則がなければ、「{Org名}/{リポジトリ名}/tfstate」で指定することを推奨
    region = "ap-northeast-1"
    acl    = "bucket-owner-full-control"
  }
}

variable "name" {
  type        = string
  description = "The name of the organization."
}

variable "owners" {
  type        = set(string)
  default     = []
  description = "List of owners."
}

variable "blocked_users" {
  type        = set(string)
  default     = []
  description = "List of blocked users."
}

variable "members" {
  type        = set(string)
  default     = []
  description = "List of members."
}

variable "teams" {
  type        = any
  default     = []
  description = "List of teams. This should be `teams` object."
}

variable "existing_teams" {
  type        = set(string)
  default     = []
  description = "List of existing team names"
}

locals {
  memberships = merge(
    { for u in var.owners : u => "admin" },
    { for u in var.members : u => "member" },
    {
      for u in setunion(
        flatten(local.teams[*].maintainers),
        flatten(local.teams[*].members)
      ) : u => "member" if ! contains(var.owners, u)
    }
  )

  # チーム設定の基本形
  teams = [
    for t in var.teams : merge({
      name        = ""
      description = ""
      visible     = true
      maintainers = []
      members     = []
    }, t)
  ]

  # 既存のTeamと新規のTeamを分離
  new_teams = { 
    for team in local.teams : team.name => team 
    if !contains(var.existing_teams, team.name)
  }

  teams_maintainers = flatten([
    for t in local.teams : [
      for u in t.maintainers : {
        team_name = t.name
        username  = u
        role      = "maintainer"
      }
    ]
  ])

  teams_members = flatten([
    for t in local.teams : [
      for u in t.members : {
        team_name = t.name
        username  = u
        role      = "member"
      }
    ]
  ])

  team_memberships = {
    for m in concat(local.teams_maintainers, local.teams_members) :
    "${m.team_name} ${m.username}" => m
  }

  users = setunion(
    var.owners,
    var.blocked_users,
    var.members,
    flatten(local.teams[*].maintainers),
    flatten(local.teams[*].members)
  )
}

data "github_user" "main" {
  for_each = local.users
  username = each.key
}

# 既存のTeamを取得するデータソース
data "github_team" "existing" {
  for_each = var.existing_teams
  slug     = each.key
}

provider "github" {
  owner = var.name
}

resource "github_membership" "main" {
  for_each = local.memberships
  username = each.key
  role     = each.value
}

resource "github_organization_block" "main" {
  for_each = var.blocked_users
  username = each.key
}

# 新規のTeamのみを作成するリソース
resource "github_team" "main" {
  for_each    = local.new_teams
  name        = each.key
  description = each.value.description
  privacy     = each.value.visible ? "closed" : "secret"
}

# Team membership の設定を既存・新規両方に対応
resource "github_team_membership" "main" {
  depends_on = [github_membership.main]

  for_each = local.team_memberships
  team_id  = contains(var.existing_teams, each.value.team_name) ? data.github_team.existing[each.value.team_name].id : github_team.main[each.value.team_name].id
  username = each.value.username
  role     = each.value.role
}

data "github_user" "main" {
  for_each = local.users
  username = each.key
}

data "github_team" "existing" {
  for_each = var.existing_teams
  slug     = each.key
}

provider "github" {
  owner = var.name
}

resource "github_membership" "main" {
  for_each = local.memberships
  username = each.key
  role     = each.value
}

resource "github_organization_block" "main" {
  for_each = var.blocked_users
  username = each.key
}

resource "github_team" "main" {
  for_each    = local.new_teams
  name        = each.key
  description = each.value.description
  privacy     = each.value.visible ? "closed" : "secret"
}

resource "github_team_membership" "main" {
  depends_on = [github_membership.main]

  for_each = local.team_memberships
  team_id  = contains(var.existing_teams, each.value.team_name) ? data.github_team.existing[each.value.team_name].id : github_team.main[each.value.team_name].id
  username = each.value.username
  role     = each.value.role
}

name: terraform plan

on:
  pull_request:
    paths:
      - 'terraform/*.tf'
      - 'users/*.csv'
      - '.github/workflows/*.yml'

jobs:
  plan:
    name: terraform plan
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    steps:
      - name: checkout
        uses: actions/checkout@v3
        with:
          ref: ${{ github.head_ref }}

      - name: setup terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.10.5

      - uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ap-northeast-1
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}

      - run: terraform init
        working-directory: terraform

      - id: fmt
        run: terraform fmt
        working-directory: terraform

      # terraform fmtでフォーマットされた場合、コミットしてプッシュ
      - name: Commit changes
        run: |
          if [[ -n "$(git status -s)" ]]; then
            git config --global user.name 'github-actions[bot]'
            git config --global user.email 'github-actions[bot]@users.noreply.github.com'
            git add .
            git commit -m "terraform fmt"
            git push origin ${{ github.head_ref }}
          else
            echo "No changes to commit"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: validate
        run: terraform validate -no-color
        working-directory: terraform
        continue-on-error: true

      # terraform validate失敗時の結果をプルリクエストに出力
      - uses: actions/github-script@v6
        if: steps.validate.outcome == 'failure'
        env:
          STDERR: "```${{ steps.validate.outputs.stderr }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDERR
            });
            core.setFailed('terraform validate failed');

      - name: Make script executable
        run: chmod +x ./script.sh
        working-directory: shell

      - name: Generate GitHub Apps token
        id: generate
        env:
          APP_ID: ${{ secrets.APP_ID }}
          PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
        run: |
          ./script.sh
        working-directory: shell

      - id: plan
        run: terraform plan -no-color
        working-directory: terraform
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}

      # terraform plan成功時・失敗時それぞれの結果をプルリクエストに出力
      - uses: actions/github-script@v6
        if: steps.plan.outcome == 'failure'
        env:
          STDERR: "```${{ steps.plan.outputs.stderr }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDERR
            });
            core.setFailed('terraform plan failed');

      - uses: actions/github-script@v6
        if: steps.plan.outcome == 'success'
        env:
          STDOUT: "```${{ steps.plan.outputs.stdout }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDOUT
            })

      - name: Revoke GitHub Apps token
        if: ${{ always() }}
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}
        run: |
          curl --location --silent --request DELETE \
            --url "${GITHUB_API_URL}/installation/token" \
            --header "Accept: application/vnd.github+json" \
            --header "X-GitHub-Api-Version: 2022-11-28" \
            --header "Authorization: Bearer ${GITHUB_TOKEN}"

on:
  pull_request:
    paths:
      - 'terraform/*.tf'
      - 'users/*.csv'
      - '.github/workflows/*.yml'

jobs:
  plan:
    name: terraform plan
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      pull-requests: write

      - name: checkout
        uses: actions/checkout@v3
        with:
          ref: ${{ github.head_ref }}

      - name: setup terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.10.5

      - uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ap-northeast-1
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}

      - run: terraform init
        working-directory: terraform

      - id: fmt
        run: terraform fmt
        working-directory: terraform

      # terraform fmtでフォーマットされた場合、コミットしてプッシュ
      - name: Commit changes
        run: |
          if [[ -n "$(git status -s)" ]]; then
            git config --global user.name 'github-actions[bot]'
            git config --global user.email 'github-actions[bot]@users.noreply.github.com'
            git add .
            git commit -m "terraform fmt"
            git push origin ${{ github.head_ref }}
          else
            echo "No changes to commit"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: validate
        run: terraform validate -no-color
        working-directory: terraform
        continue-on-error: true

      # terraform validate失敗時の結果をプルリクエストに出力
      - uses: actions/github-script@v6
        if: steps.validate.outcome == 'failure'
        env:
          STDERR: "```${{ steps.validate.outputs.stderr }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDERR
            });
            core.setFailed('terraform validate failed');

      - name: Make script executable
        run: chmod +x ./script.sh
        working-directory: shell

      - name: Generate GitHub Apps token
        id: generate
        env:
          APP_ID: ${{ secrets.APP_ID }}
          PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
        run: |
          ./script.sh
        working-directory: shell

      - id: plan
        run: terraform plan -no-color
        working-directory: terraform
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}

      # terraform plan成功時・失敗時それぞれの結果をプルリクエストに出力
      - uses: actions/github-script@v6
        if: steps.plan.outcome == 'failure'
        env:
          STDERR: "```${{ steps.plan.outputs.stderr }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDERR
            });
            core.setFailed('terraform plan failed');

      - uses: actions/github-script@v6
        if: steps.plan.outcome == 'success'
        env:
          STDOUT: "```${{ steps.plan.outputs.stdout }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDOUT
            })

      - name: Revoke GitHub Apps token
        if: ${{ always() }}
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}
        run: |
          curl --location --silent --request DELETE \
            --url "${GITHUB_API_URL}/installation/token" \
            --header "Accept: application/vnd.github+json" \
            --header "X-GitHub-Api-Version: 2022-11-28" \
            --header "Authorization: Bearer ${GITHUB_TOKEN}"

name: terraform apply

on:
  pull_request:
    types: [closed]
    branches:
      - main
    paths:
      - 'terraform/*.tf'
      - 'users/*.csv'
      - '.github/workflows/*.yml'

jobs:
  apply:
    name: terraform apply
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    steps:
      - name: checkout
        uses: actions/checkout@v3

      - name: setup terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.10.5

      - uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ap-northeast-1
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}

      - run: terraform init
        working-directory: terraform

      - name: Make script executable
        run: chmod +x ./script.sh
        working-directory: shell

      - name: Generate GitHub Apps token
        id: generate
        env:
          APP_ID: ${{ secrets.APP_ID }}
          PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
        run: |
          ./script.sh
        working-directory: shell

      - id: apply
        run: terraform apply -auto-approve -no-color
        working-directory: terraform
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}

      # terraform apply成功時・失敗時それぞれの結果をプルリクエストに出力
      - uses: actions/github-script@v6
        if: steps.apply.outcome == 'failure'
        env:
          STDERR: "```${{ steps.apply.outputs.stderr }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDERR
            });
            core.setFailed('terraform apply failed');

      - uses: actions/github-script@v6
        if: steps.apply.outcome == 'success'
        env:
          STDOUT: "```${{ steps.apply.outputs.stdout }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDOUT
            })

      - name: Revoke GitHub Apps token
        if: ${{ always() }}
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}
        run: |
          curl --location --silent --request DELETE \
            --url "${GITHUB_API_URL}/installation/token" \
            --header "Accept: application/vnd.github+json" \
            --header "X-GitHub-Api-Version: 2022-11-28" \
            --header "Authorization: Bearer ${GITHUB_TOKEN}"

on:
  pull_request:
    types: [closed]
    branches:
      - main
    paths:
      - 'terraform/*.tf'
      - 'users/*.csv'
      - '.github/workflows/*.yml'

jobs:
  apply:
    name: terraform apply
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true

jobs:
  apply:
    name: terraform apply
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    permissions:
      id-token: write
      contents: read
      pull-requests: write

      - id: apply
        run: terraform apply -auto-approve -no-color
        working-directory: terraform
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ steps.generate.outputs.token }}

      # terraform apply成功時・失敗時それぞれの結果をプルリクエストに出力
      - uses: actions/github-script@v6
        if: steps.apply.outcome == 'failure'
        env:
          STDERR: "```${{ steps.apply.outputs.stderr }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDERR
            });
            core.setFailed('terraform apply failed');

      - uses: actions/github-script@v6
        if: steps.apply.outcome == 'success'
        env:
          STDOUT: "```${{ steps.apply.outputs.stdout }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: process.env.STDOUT
            })