Merge pull request #109 from ministryofjustice/repo-vars-condition

Repo vars condition

README.md

@@ -4,7 +4,7 @@
 
 This Terraform module will create an [Amazon Elastic Container Registry](https://aws.amazon.com/ecr/) private repository for use on the Cloud Platform.
 
-If you're using GitHub as your OIDC provider, this module will automatically create the required variables for authentication in your GitHub repository.
+If you're using GitHub as your OIDC provider, this module will automatically create the required variables for authentication in your GitHub repository. By default these will be created as [repository secrets and variables](https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository). Alternatively, you can configure the module to instead create the ECR secrets and variables in your own defined [GitHub Environments](https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment) with the `github_environments` field. This pattern is useful if you wish to define separate ECR repositories for different Cloud Platform environments within the same GitHub repository.
 
 If you're using CircleCI as your OIDC provider, this module will create a Kubernetes ConfigMap in your namespace with your authentication variables to use as environment variables in CircleCI.
 

main.tf

@@ -294,23 +294,23 @@ resource "aws_iam_role_policy_attachment" "github_ecr" {
 
 # Actions
 resource "github_actions_secret" "ecr_role_to_assume" {
-  for_each = local.enable_github ? local.github_repos : []
+  for_each = (length(var.github_environments) == 0 && local.enable_github) ? local.github_repos : []
 
   repository      = each.value
   secret_name     = local.github_variable_names["ECR_ROLE_TO_ASSUME"]
   plaintext_value = aws_iam_role.github[0].arn
 }
 
 resource "github_actions_variable" "ecr_region" {
-  for_each = local.enable_github ? local.github_repos : []
+  for_each = (length(var.github_environments) == 0 && local.enable_github) ? local.github_repos : []
 
   repository    = each.value
   variable_name = local.github_variable_names["ECR_REGION"]
   value         = data.aws_region.current.name
 }
 
 resource "github_actions_variable" "ecr_repository" {
-  for_each = local.enable_github ? local.github_repos : []
+  for_each = (length(var.github_environments) == 0 && local.enable_github) ? local.github_repos : []
 
   repository    = each.value
   variable_name = local.github_variable_names["ECR_REPOSITORY"]