name: Hourly Cloud Nuke
on:
  schedule:
    - cron: "0 * * * *" # Runs every hour
  workflow_dispatch:


permissions:
  id-token: write
  contents: read

jobs:
  run_cloud_nuke:
    name: Nuke
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install cloud-nuke
        run: |
            wget -O /usr/local/bin/cloud-nuke \
                --header="Authorization: Bearer ${GITHUB_TOKEN}" \
                "https://github.com/gruntwork-io/cloud-nuke/releases/download/v${VERSION}/cloud-nuke_linux_amd64"

            chmod +x /usr/local/bin/cloud-nuke
        env:
            # Authenticate to reduce the likelihood of hitting rate limit issues.
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            VERSION: 0.40.0

      - name: Authenticate to AWS
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.CLOUD_NUKE_ROLE }}
          aws-region: us-east-1

      - name: Run cloud-nuke
        run: |
            cloud-nuke aws \
                --force \
                --log-level debug \
                --resource-type s3 \
                --resource-type vpc \
                --resource-type ec2 \
                --resource-type dynamodb \
                --region us-east-1 \
                --region us-west-2 \
                --older-than 1h \
                --config .github/cloud-nuke/config.yml
