chore: Enable automation testing #1037
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Acceptance Tests (github.com) | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| - release-v* | |
| # pull_request_target: | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| - labeled | |
| branches: | |
| - main | |
| - release-v* | |
| concurrency: | |
| group: acctest-dotcom-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: read-all | |
| jobs: | |
| setup: | |
| name: Setup | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| outputs: | |
| fork: ${{ steps.check.outputs.fork }} | |
| test: ${{ steps.check.outputs.test }} | |
| environment: ${{ steps.check.outputs.environment }} | |
| steps: | |
| - name: Check | |
| id: check | |
| env: | |
| GITHUB_HEAD_REPO: ${{ case(github.event_name == 'pull_request' || github.event_name == 'pull_request_target', github.event.pull_request.head.repo.full_name, github.repository) }} | |
| GITHUB_BASE_REPO: ${{ case(github.event_name == 'pull_request' || github.event_name == 'pull_request_target', github.event.pull_request.base.repo.full_name, github.repository) }} | |
| ACCTEST_LABEL_SET: ${{ contains(github.event.pull_request.labels.*.name, 'acctest') }} | |
| run: | | |
| set -euo pipefail | |
| fork="true" | |
| test="false" | |
| environment="acctest-dotcom-untrusted" | |
| if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]] || [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then | |
| fork="false" | |
| test="true" | |
| environment="acctest-dotcom" | |
| echo "::notice::Running in ${GITHUB_EVENT_NAME} context, proceeding with tests" | |
| else | |
| if [[ "${GITHUB_HEAD_REPO}" == "${GITHUB_BASE_REPO}" ]]; then | |
| fork="false" | |
| test="true" | |
| echo "::notice::Running in ${GITHUB_EVENT_NAME} context from the base repository, proceeding with tests" | |
| else | |
| if [[ "${ACCTEST_LABEL_SET}" == "true" ]]; then | |
| test="true" | |
| echo "::warning::Running in ${GITHUB_EVENT_NAME} context from a fork with acctest label, proceeding with tests" | |
| else | |
| echo "::warning::Running in ${GITHUB_EVENT_NAME} context from a fork, skipping tests" | |
| fi | |
| fi | |
| fi | |
| { | |
| echo "test=${test}" | |
| echo "environment=${environment}" | |
| echo "fork=${fork}" | |
| } >> "${GITHUB_OUTPUT}" | |
| test: | |
| name: Test ${{ matrix.mode || 'Skipped' }} | |
| needs: | |
| - setup | |
| if: needs.setup.outputs.test == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| environment: | |
| name: ${{ needs.setup.outputs.environment }} | |
| strategy: | |
| matrix: | |
| mode: [organization] # anonymous, individual, team, enterprise | |
| fail-fast: true | |
| max-parallel: 1 | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Check secrets | |
| if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target' | |
| env: | |
| INPUT_SECRETS: ${{ toJSON(secrets) }} | |
| INPUT_ALLOWED_SECRETS: ${{ vars.GH_TEST_ALLOWED_SECRETS }} | |
| run: | | |
| set -eou pipefail | |
| allowed_secrets="$(jq --raw-input --raw-output --compact-output 'split(",")' <<<"${INPUT_ALLOWED_SECRETS}")" | |
| secret_keys="$(jq --raw-output --compact-output --argjson allowed "${allowed_secrets}" '[[. | to_entries[] | select(.value != "" and .value != "!NOSECRET!")] | from_entries | keys[] | ascii_upcase | select(test("^(?:(?:ACTIONS)|(?:GITHUB)|(?:TEST)|(?:GH_TEST))_") | not) | select((IN($allowed[]) | not))] | sort | join(",")' <<<"${INPUT_SECRETS}")" | |
| if [[ -n "${secret_keys}" ]]; then | |
| echo "::error::Unexpected secrets: ${secret_keys}" | |
| exit 1 | |
| fi | |
| - name: Check credentials | |
| id: credentials | |
| if: matrix.mode != 'anonymous' | |
| env: | |
| MATRIX_MODE: ${{ matrix.mode }} | |
| GH_TEST_APP_ID: ${{ vars.GH_TEST_APP_ID }} | |
| GH_TEST_APP_INSTALLATION_ID: ${{ vars.GH_TEST_APP_INSTALLATION_ID }} | |
| GH_TEST_APP_PEM: ${{ secrets.GH_TEST_APP_PEM }} | |
| GH_TEST_TOKEN: ${{ secrets.GH_TEST_TOKEN }} | |
| run: | | |
| set -eou pipefail | |
| app_id="" | |
| app_installation_id="" | |
| app_pem="" | |
| token="" | |
| if [[ "${MATRIX_MODE}" == "individual" ]]; then | |
| if [[ -z "${GH_TEST_TOKEN}" ]]; then | |
| echo "::error::Missing token" | |
| exit 1 | |
| fi | |
| token="${GH_TEST_TOKEN}" | |
| else | |
| if [[ -z "${GH_TEST_APP_ID}" ]]; then | |
| echo "::error::Missing app id" | |
| exit 1 | |
| fi | |
| if [[ -z "${GH_TEST_APP_INSTALLATION_ID}" ]]; then | |
| echo "::error::Missing app installation id" | |
| exit 1 | |
| fi | |
| if [[ -z "${GH_TEST_APP_PEM}" ]]; then | |
| echo "::error::Missing app pem" | |
| exit 1 | |
| fi | |
| app_id="${GH_TEST_APP_ID}" | |
| app_installation_id="${GH_TEST_APP_INSTALLATION_ID}" | |
| app_pem="${GH_TEST_APP_PEM}" | |
| fi | |
| { | |
| echo "app_id=${app_id}" | |
| echo "app_installation_id=${app_installation_id}" | |
| echo "app_pem=${app_pem}" | |
| echo "token=${token}" | |
| } >> "${GITHUB_OUTPUT}" | |
| - name: Set-up Go | |
| uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 | |
| with: | |
| terraform_version: latest | |
| terraform_wrapper: false | |
| - name: Terraform lookup | |
| id: tf | |
| run: | | |
| set -euo pipefail | |
| { | |
| echo "version=$(terraform version -json | jq --raw-output '.terraform_version')" | |
| echo "path=$(command -v terraform || true)" | |
| } >> "${GITHUB_OUTPUT}" | |
| - name: Run tests | |
| env: | |
| TF_ACC_PROVIDER_NAMESPACE: "" | |
| TF_ACC_TERRAFORM_VERSION: ${{ steps.tf.outputs.version }} | |
| TF_ACC_TERRAFORM_PATH: ${{ steps.tf.outputs.path }} | |
| TF_ACC: "1" | |
| TF_LOG: WARN | |
| GITHUB_APP_ID: ${{ steps.credentials.outputs.app_id }} | |
| GITHUB_APP_INSTALLATION_ID: ${{ steps.credentials.outputs.app_installation_id }} | |
| GITHUB_APP_PEM_FILE: ${{ steps.credentials.outputs.app_pem }} | |
| GITHUB_TOKEN: ${{ steps.credentials.outputs.token }} | |
| GITHUB_BASE_URL: https://api.github.com/ | |
| GITHUB_OWNER: ${{ case(matrix.mode == 'anonymous', '', matrix.mode == 'individual', vars.GH_TEST_LOGIN, vars.GH_TEST_ORG_NAME) }} | |
| GITHUB_USERNAME: ${{ case(matrix.mode == 'individual', vars.GH_TEST_LOGIN, '') }} | |
| GITHUB_ENTERPRISE_SLUG: ${{ case(matrix.mode == 'enterprise', vars.GH_TEST_ENTERPRISE_SLUG, '') }} | |
| GH_TEST_AUTH_MODE: ${{ matrix.mode }} | |
| GH_TEST_USER_REPOSITORY: ${{ vars.GH_TEST_USER_REPOSITORY }} | |
| GH_TEST_ORG_USER: ${{ vars.GH_TEST_ORG_USER }} | |
| GH_TEST_ORG_SECRET_NAME: ${{ vars.GH_TEST_ORG_SECRET_NAME }} | |
| GH_TEST_ORG_REPOSITORY: ${{ vars.GH_TEST_ORG_REPOSITORY }} | |
| GH_TEST_ORG_TEMPLATE_REPOSITORY: ${{ vars.GH_TEST_ORG_TEMPLATE_REPOSITORY }} | |
| GH_TEST_ORG_APP_INSTALLATION_ID: ${{ vars.GH_TEST_ORG_APP_INSTALLATION_ID }} | |
| GH_TEST_EXTERNAL_USER: ${{ vars.GH_TEST_EXTERNAL_USER }} | |
| GH_TEST_EXTERNAL_USER_TOKEN: ${{ secrets.GH_TEST_EXTERNAL_USER_TOKEN }} | |
| GH_TEST_EXTERNAL_USER2: ${{ vars.GH_TEST_EXTERNAL_USER2 }} | |
| GH_TEST_ADVANCED_SECURITY: ${{ vars.GH_TEST_ADVANCED_SECURITY || 'false' }} | |
| run: | | |
| set -eou pipefail | |
| if [[ "${GH_TEST_AUTH_MODE}" != "anonymous" ]]; then | |
| go test ./github -v -sweep=all | |
| fi | |
| go test -run "^TestAcc*" ./github -v -race -coverprofile=coverage.txt -covermode=atomic -timeout 120m -count=1 | |
| check: | |
| name: Check DotCom Acceptance Tests | |
| if: always() && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') | |
| needs: | |
| - test | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Check | |
| env: | |
| INPUT_RESULTS: ${{ join(needs.*.result, ' ') }} | |
| run: | | |
| set -euo pipefail | |
| read -a results <<< "${INPUT_RESULTS}" | |
| for result in "${results[@]}"; do | |
| if [[ "${result}" == "failure" ]] || [[ "${result}" == "cancelled" ]]; then | |
| echo "::error::Workflow failed!" | |
| exit 1 | |
| fi | |
| done |