From bbdf79f816ce8b379d86df9e601bb7c09a4a9226 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2008@gmail.com>
Date: Mon, 17 Nov 2025 17:42:02 +0800
Subject: [PATCH] ci(terraform): add Terraform Standard pipeline for AWS
 LandingZone baseline

---
 ...eline-aws-global-landingzone-baseline.yaml | 146 ++++++++++++++++++
 1 file changed, 146 insertions(+)
 create mode 100644 .github/workflows/terraform-standard-iac-pipeline-aws-global-landingzone-baseline.yaml

diff --git a/.github/workflows/terraform-standard-iac-pipeline-aws-global-landingzone-baseline.yaml b/.github/workflows/terraform-standard-iac-pipeline-aws-global-landingzone-baseline.yaml
new file mode 100644
index 00000000..fd8f0f81
--- /dev/null
+++ b/.github/workflows/terraform-standard-iac-pipeline-aws-global-landingzone-baseline.yaml
@@ -0,0 +1,146 @@
+name: Terraform Standard - AWS Global LandingZone Baseline
+
+on:
+  push:
+    paths:
+      - 'iac-template/terraform-standard/**'
+      - '.github/workflows/terraform-standard-iac-pipeline-aws-global-landingzone-baseline.yaml'
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      deploy_action:
+        description: "Deployment action"
+        type: choice
+        options: [init, plan, apply, destroy]
+        default: plan
+      deploy_dry_run:
+        description: "Dry-run mode"
+        type: choice
+        options: ['true', 'false']
+        default: 'true'
+
+env:
+  TF_WORKDIR: iac-template/terraform-standard
+  DEPLOY_ACTION: ${{ github.event.inputs.deploy_action || 'plan' }}
+  DEPLOY_DRY_RUN: ${{ github.event.inputs.deploy_dry_run || 'true' }}
+
+jobs:
+  # -------------------------------------------------------
+  #  1. Bootstrap Stage (Matrix)
+  # -------------------------------------------------------
+  bootstrap:
+    name: "Bootstrap: DynamoDB / S3 / IAM"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - bootstrap-dynamodb
+          - bootstrap-s3
+          - bootstrap-iam
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.9.5
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Terraform Init
+        working-directory: ${{ env.TF_WORKDIR }}/${{ matrix.target }}
+        run: terraform init -upgrade
+
+      - name: Terraform Plan (bootstrap)
+        if: env.DEPLOY_DRY_RUN == 'true'
+        working-directory: ${{ env.TF_WORKDIR }}/${{ matrix.target }}
+        run: terraform plan -no-color
+
+      - name: Terraform Apply (bootstrap)
+        if: env.DEPLOY_DRY_RUN == 'false'
+        working-directory: ${{ env.TF_WORKDIR }}/${{ matrix.target }}
+        run: terraform apply -auto-approve
+
+  # -------------------------------------------------------
+  #  2. Landing Zone Baseline Stage
+  # -------------------------------------------------------
+  landingzone:
+    name: "Deploy LandingZone Baseline"
+    needs: bootstrap
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.9.5
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Terraform Init (LandingZone)
+        working-directory: ${{ env.TF_WORKDIR }}/envs/dev-landingzone
+        run: terraform init -upgrade
+
+      - name: Terraform Plan (LandingZone)
+        id: tfplan
+        working-directory: ${{ env.TF_WORKDIR }}/envs/dev-landingzone
+        run: terraform plan -no-color > plan_output.txt
+
+      - name: Upload LandingZone Plan Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: landingzone-plan
+          path: ${{ env.TF_WORKDIR }}/envs/dev-landingzone/plan_output.txt
+
+      - name: Terraform Apply (LandingZone)
+        if: env.DEPLOY_DRY_RUN == 'false'
+        working-directory: ${{ env.TF_WORKDIR }}/envs/dev-landingzone
+        run: terraform apply -auto-approve
+
+  # -------------------------------------------------------
+  #  3. Validation Stage
+  # -------------------------------------------------------
+  validation:
+    name: "Validate LandingZone Baseline"
+    needs: landingzone
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Validation Checks
+        run: |
+          echo "⚙️ Running LandingZone baseline validation..."
+          chmod +x scripts/validation/validate-landingzone.sh
+          scripts/validation/validate-landingzone.sh \
+            ${{ env.TF_WORKDIR }}/envs/dev-landingzone
+
+  # -------------------------------------------------------
+  #  4. Delivery / Notification Stage
+  # -------------------------------------------------------
+  delivery:
+    name: "Delivery: Notify Rollout"
+    needs: validation
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Notify
+        run: |
+          echo "📣 Sending LandingZone rollout notification..."
+          chmod +x scripts/notifications/notify-landingzone.sh
+          scripts/notifications/notify-landingzone.sh