ci.yml

# Terraform Provider testing workflow.
name: Tests

# This GitHub action runs your tests for each pull request and push.
# Optionally, you can turn it on using a schedule for regular testing.
on:
  pull_request:
    paths-ignore:
      - "README.md"
  push:
    branches:
      - "main"
    tags:
      - "v*"
env:
  AWS_REGION: "us-west-2"

permissions:
  contents: write

jobs:
  # Ensure project builds before running testing matrix
  build:
    name: Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: provider
    timeout-minutes: 5
    steps:
      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          go-version: "1.20"
          cache: true
      - run: go mod download
      - run: go build -v .
      - name: Run linters
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.60
          working-directory: provider
          skip-cache: true
  scan-for-secrets:
    name: Scan for Secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
  generate:
    name: Generate
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: provider
    steps:
      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          go-version: "1.20"
          cache: true
      - run: go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs generate --provider-name cdo --rendered-provider-name "CDO Provider" --rendered-website-dir ../docs
      - name: git diff
        run: |
          git diff --compact-summary --exit-code || \
            (echo; echo "Unexpected difference in directories after docs generation. Run 'go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs generate --provider-name cdo --rendered-provider-name \"CDO Provider\" --rendered-website-dir ../docs' command from the provider directory and commit."; exit 1)

  # Run unit tests
  unit-test:
    name: Terraform Client Unit Tests
    needs: build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: client
    timeout-minutes: 15
    strategy:
      fail-fast: false
    steps:
      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          go-version: "1.20"
          cache: true
      - name: Run Go Test
        run: go test ./...

  # Run acceptance tests in a matrix with Terraform CLI versions on merge to master
  acceptance-test:
    name: Terraform Provider Acceptance Tests
    needs: unit-test
    runs-on: ubuntu-latest
#    if: github.ref == 'refs/heads/main'
    defaults:
      run:
        working-directory: provider
    timeout-minutes: 15
    concurrency: "ci" # fixed group so that it never parallel, even in different PR
    strategy:
      fail-fast: false
      max-parallel: 1 # acceptance tests create real infra, so no parallel run is enabled
      matrix:
        # list whatever Terraform versions here you would like to support
        terraform:
          - "1.3.*"
          - "1.4.*"
          - "1.5.*"
    steps:
      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          go-version: "1.20"
          cache: true
      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          terraform_version: ${{ matrix.terraform }}
          terraform_wrapper: false
      - run: go mod download
      - run: cat .github-action.env >> $GITHUB_ENV # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      - env:
          TF_ACC: "1"
          ACC_TEST_CISCO_CDO_API_TOKEN: ${{ secrets.ACC_TEST_CISCO_CDO_API_TOKEN }}
          IOS_RESOURCE_PASSWORD: ${{ secrets.IOS_RESOURCE_PASSWORD }}
          ASA_RESOURCE_SDC_PASSWORD: ${{ secrets.ASA_RESOURCE_SDC_PASSWORD }}
          DUO_ADMIN_PANEL_RESOURCE_INTEGRATION_KEY: ${{ secrets.DUO_ADMIN_PANEL_RESOURCE_INTEGRATION_KEY }}
          DUO_ADMIN_PANEL_RESOURCE_SECRET_KEY: ${{ secrets.DUO_ADMIN_PANEL_RESOURCE_SECRET_KEY }}
        run: go test -v -cover -p 1 -run "TestAcc.*" ./...
        timeout-minutes: 10
  tag-release-version:
    name: "Tag Release Version"
    needs: [acceptance-test, unit-test]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository code
        uses: actions/checkout@v2
      - name: Create and push tag
        uses: mathieudutour/github-tag-action@v6.1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
  # we cannot trigger workflow using above's tagging, so we need to do it manually
  release:
    name: "Release"
    if: github.ref == 'refs/heads/main'
    needs: [tag-release-version]
    uses: ./.github/workflows/module-release.yml
    secrets: inherit