cleanup.yaml

name: Cleanup

permissions:
  id-token: write

on:
  workflow_dispatch:
    inputs:
      stackName:
        description: "Name of the stack to clean"
        required: true
      openssl_lambda_tag:
        description: "OpenSSL Lambda container tag to deploy"
        required: true
      http_api_mock_stack_name:
        description: "Stack name of the HTTP API mock instance"
        required: true
env:
  CI: 1
  FORCE_COLOR: 3
  JSII_SILENCE_WARNING_UNTESTED_NODE_VERSION: 1
  STACK_NAME: ${{ github.event.inputs.stackName }}
  OPENSSL_LAMBDA_CONTAINER_TAG: ${{ github.event.inputs.openssl_lambda_tag }}

jobs:
  cleanup:
    runs-on: ubuntu-24.04

    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22.x"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --no-audit

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          # The role is set up via https://github.com/hello-nrfcloud/ci
          # secrets.AWS_ACCOUNT_ID_CI is an organization secret
          role-to-assume: |
            arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_CI }}:role/${{ github.repository_owner }}-ci-${{ github.event.repository.name }}
          # vars.AWS_REGION_CI is an organization variable
          aws-region: ${{ vars.AWS_REGION_CI }}

      - name: Delete logs
        run: ./cli.sh logs -X

      - name: Destroy stack
        run: npx cdk destroy --all -f

      - name: Clean up SSM parameters
        run: |
          ./cli.sh configure-nrfcloud-account apiEndpoint -X
          ./cli.sh configure-nrfcloud-account apiKey -X

      - name: Delete ECR repositories
        run: |
          aws ecr delete-repository --force --repository-name ${{ env.STACK_NAME }}-openssl-lambda

  cleanup-http-api-mock:
    runs-on: ubuntu-24.04

    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22.x"
          cache: "npm"

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          # The role is set up via https://github.com/hello-nrfcloud/ci
          # secrets.AWS_ACCOUNT_ID_CI is an organization secret
          role-to-assume: |
            arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_CI }}:role/${{ github.repository_owner }}-ci-${{ github.event.repository.name }}
          # vars.AWS_REGION_CI is an organization variable
          aws-region: ${{ vars.AWS_REGION_CI }}

      - name: Delete HTTP API mock
        run: |
          npx @bifravst/http-api-mock destroy ${{ inputs.http_api_mock_stack_name }}