ghes-acceptance-tests.yaml

name: Acceptance Tests (GHES)

on:
  workflow_dispatch:
  # pull_request_target:
  #   types:
  #     - opened
  #     - synchronize
  #     - reopened
  #     - labeled
  #   branches:
  #     - main
  #     - release-v*

concurrency:
  group: acctest-ghes-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  test:
    name: Test GHES
    runs-on: ubuntu-latest
    permissions:
      contents: read
    environment:
      name: acctest-ghes
      deployment: false
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check secrets
        if: github.event_name == 'pull_request_target'
        env:
          INPUT_ALLOWED_SECRETS: ${{ vars.GHES_ACCEPTANCE_TESTS_ALLOWED_SECRETS || 'GHES_TEST_USER_TOKEN' }}
          INPUT_SECRETS: ${{ toJSON(secrets) }}
        run: |
          set -eou pipefail

          secret_keys="$(jq --raw-output --compact-output '[. | keys[] | select(test("^(?:(?:ACTIONS)|(?:actions)|(?:GITHUB)|(?:github)|(?:TEST)|(?:test))_") | not)] | sort | join(",")' <<<"${INPUT_SECRETS}")"
          if [[ "${secret_keys}" != "${INPUT_ALLOWED_SECRETS}" ]]; then
            echo "::error::Too many or too few secrets configured: ${secret_keys}"
            exit 1
          fi

      - name: Check server address
        id: server
        env:
          GHES_TEST_SERVER_HOST: ${{ vars.GHES_TEST_SERVER_HOST }}
        run: |
          set -eou pipefail

          host="${GHES_TEST_SERVER_HOST}"

          if [[ -z "${host}" ]]; then
            echo "::error::Missing GHES server address"
            exit 1
          fi

          test="$(dig +short "${host}")"

          if [[ "${test}" != "255.255.255.255" ]]; then
            echo "Invalid server address" >&2
            exit 1
          fi

          echo "address=https://${host}/" >> "${GITHUB_OUTPUT}"

      - name: Check credentials
        id: credentials
        env:
          TEST_USER_TOKEN: ${{ secrets.GHES_TEST_USER_TOKEN  }}
        run: |
          set -eou pipefail

          if [[ -z "${TEST_USER_TOKEN}" ]]; then
            echo "::error::Missing credentials"
            exit 1
          fi

          echo "token=${TEST_USER_TOKEN}" >> "${GITHUB_OUTPUT}"

      - name: Set-up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: latest
          terraform_wrapper: false

      - name: Terraform lookup
        id: tf
        run: |
          set -euo pipefail

          {
            echo "version=$(terraform version -json | jq --raw-output '.terraform_version')"
            echo "path=$(command -v terraform || true)"
          } >> "${GITHUB_OUTPUT}"

      - name: Run tests
        env:
          TF_ACC_PROVIDER_NAMESPACE: ""
          TF_ACC_TERRAFORM_VERSION: ${{ steps.tf.outputs.version }}
          TF_ACC_TERRAFORM_PATH: ${{ steps.tf.outputs.path }}
          TF_ACC: "1"
          TF_LOG: WARN
          GITHUB_TOKEN: ${{ steps.credentials.outputs.token }}
          GITHUB_BASE_URL: ${{ steps.server.outputs.address }}
          GITHUB_OWNER: ""
          GITHUB_USERNAME: ""
          GITHUB_ENTERPRISE_SLUG: ""
          GH_TEST_AUTH_MODE: enterprise
        run: |
          set -eou pipefail

          go test ./github -v -sweep=all
          go test -run "^TestAcc*" ./github -v -race -coverprofile=coverage.txt -covermode=atomic -timeout 120m -count=1

  check:
    name: Check GHES Acceptance Tests
    if: always() && github.event_name == 'pull_request'
    needs:
      - test
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Check
        env:
          INPUT_RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          set -euo pipefail
          read -a results <<< "${INPUT_RESULTS}"
          for result in "${results[@]}"; do
            if [[ "${result}" == "failure" ]] || [[ "${result}" == "cancelled" ]]; then
              echo "::error::Workflow failed!"
              exit 1
            fi
          done