boundary/.github/workflows/test-cli-ui.yml

name: test-cli-ui

on:
  workflow_dispatch:
  workflow_run:
    workflows: [ build ]
    types:
      - completed

permissions:
  contents: read
  actions: read

jobs:
  set-product-version:
    runs-on: ${{ fromJSON(vars.RUNNER) }}
    outputs:
      product-version: ${{ steps.set-product-version.outputs.product-version }}
      base-product-version: $${{ steps.set-product-version.outputs.base-product-version }}
      prerelease-product-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
      - name: Set Product version
        id: set-product-version
        uses: hashicorp/actions-set-product-version@v1  # TSCCR: loading action configs: failed to query HEAD reference: failed to get advertised references: authorization failed

  bats:
    runs-on: ${{ fromJSON(vars.RUNNER) }}
    name: CLI tests
    if: "! github.event.pull_request.head.repo.fork"
    needs:
      - set-product-version
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
      - name: Import GPG key for Boundary pass keystore
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@111c56156bcc6918c056dbef52164cfa583dc549 # v5.2.0
        with:
          gpg_private_key: ${{ secrets.ENOS_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.ENOS_GPG_PASSPHRASE }}
      - name: Trust the pass keystore GPG key
        id: trust_gpg
        run: |
          gpg -a --encrypt -r ${{ secrets.ENOS_GPG_UID }} --trust-model always
          echo "trusted-key ${{ secrets.ENOS_GPG_UID }}" >> ~/.gnupg/gpg.conf
          cat ~/.gnupg/gpg.conf          
      - name: Set up Bats CLI UI tests dependency cache
        id: dep-cache
        uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
        with:
          path: /tmp/bats-cli-ui-deps
          key: enos-bats-cli-ui-deps-jq-1.6-password-store-1.7.4-vault-1.12.2
      - name: Set up Node for Bats install
        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
        with:
          node-version: 16
      - name: Install Bats via NPM
        # Use npm so this workflow is portable on multiple runner distros
        run: npm install --location=global bats
      - name: Download jq for Bats CLI UI tests
        if: steps.dep-cache.outputs.cache-hit != 'true'
        # NOTE: if you update the jq version make sure to update the dep cache key
        run: |
          mkdir -p /tmp/bats-cli-ui-deps
          wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -O /tmp/bats-cli-ui-deps/jq-bin          
      - name: Install jq for Bats CLI UI tests
        run: |
          chmod +x /tmp/bats-cli-ui-deps/jq-bin
          sudo cp /tmp/bats-cli-ui-deps/jq-bin /usr/local/bin/jq          
      - name: Download and unzip pass for Boundary keyring
        if: steps.dep-cache.outputs.cache-hit != 'true'
        # NOTE: if you update the password store version make sure to update the dep cache key
        run: |
          mkdir -p /tmp/bats-cli-ui-deps/pass
          wget https://git.zx2c4.com/password-store/snapshot/password-store-1.7.4.tar.xz -O /tmp/bats-cli-ui-deps/pass/pass.tar.xz
          cd /tmp/bats-cli-ui-deps/pass
          tar -xvf pass.tar.xz          
      - name: Install pass for Boundary keyring
        run: |
          cd /tmp/bats-cli-ui-deps/pass/password-store-1.7.4
          sudo make install
          pass init ${{ secrets.ENOS_GPG_UID }}          
      - name: Download Vault AMD64 binary for integration testing
        if: steps.dep-cache.outputs.cache-hit != 'true'
        run: |
                    wget https://releases.hashicorp.com/vault/1.12.2/vault_1.12.2_linux_amd64.zip -O /tmp/bats-cli-ui-deps/vault.zip
      - name: Install Vault
        run: |
                    unzip /tmp/bats-cli-ui-deps/vault.zip -d /usr/local/bin
      - name: Download Linux AMD64 Boundary bundle
        uses: dawidd6/action-download-artifact@5e780fc7bbd0cac69fc73271ed86edf5dcb72d67 # v2.26.0
        with:
          workflow: build.yml
          commit: ${{ github.sha }}
          name: boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip
          path: /tmp
      - name: Unpack boundary bundle
        run: |
          unzip /tmp/boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip -d /usr/local/bin
          rm /tmp/boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip          
      - name: Versions
        run: |
          echo "go version:"
          go version
          echo "bats version:"
          bats --version
          echo "jq version:"
          jq --version
          echo "gpg version:"
          gpg --version
          echo "pass version:"
          pass --version
          echo "bash version:"
          bash --version
          echo "boundary version:"
          boundary version
          echo "vault version:"
          vault version          
      - name: Run cli bats tests
        run: |
          export VAULT_ADDR=http://127.0.0.1:8200
          export VAULT_TOKEN=boundarytok
          make -C internal/tests/cli test-vault-up
          until vault status; do docker container inspect boundary-cli-tests-vault &> /dev/null || exit 255; sleep 1; done
          make test-cli          
      - name: Cleanup
        if: success() || failure()
        run: |
                    make -C internal/tests/cli test-vault-down
      - name: Send Slack message
        if: ${{ failure() }}
        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
        with:
          channel-id: ${{ secrets.SLACK_BOUNDARY_TEST_BOT_CHANNEL_ID }}
          payload: |
            {
              "text": ":x: bats tests failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Branch:* ${{ github.event.ref }}\n*SHA:* <${{ github.event.head_commit.url }}|${{ github.event.after }}>"
            }            
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOUNDARY_TEST_BOT_TOKEN }}