integration.yml

# Run secret-dependent integration tests only after /ok-to-test approval
on:
  push:
    branches: [ "main", "renovate/**" ]
  pull_request:
  repository_dispatch:
    types: [ "ok-to-test-command" ]

name: Integration Tests

jobs:
  # Branch-based pull request
  integration-trusted:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    if: |
      github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository ||
      github.event_name == 'push' && (github.event.ref == 'refs/heads/main' || startsWith(github.event.ref, 'refs/heads/renovate'))
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: arn:aws:iam::520156417308:role/github-action-auth-Role-MJSGfkUydl2D

      - name: Integration Test
        run: >-
          AWS_REGION=us-east-1
          BUCKET_NAME=sqsec-integration-bucket
          QUEUE_URL=https://sqs.us-east-1.amazonaws.com/520156417308/sqsec-integration-queue
          go test -v ./... -run Integration

  # Repo owner has commented /ok-to-test on a (fork-based) pull request
  integration-fork:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      checks: write
      id-token: write
    if: |
      github.event_name == 'repository_dispatch' &&
      github.event.client_payload.slash_command.args.named.sha != '' &&
      contains(
        github.event.client_payload.pull_request.head.sha,
        github.event.client_payload.slash_command.args.named.sha
      )
    steps:
    - name: Fork based /ok-to-test checkout
      uses: actions/checkout@v4
      with:
        ref: 'refs/pull/${{ github.event.client_payload.pull_request.number }}/merge'

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.22'

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-region: us-east-1
        role-to-assume: arn:aws:iam::520156417308:role/github-action-auth-Role-MJSGfkUydl2D

    - name: Integration Test
      run: >-
        AWS_REGION=us-east-1
        BUCKET_NAME=sqsec-integration-bucket
        QUEUE_URL=https://sqs.us-east-1.amazonaws.com/520156417308/sqsec-integration-queue
        go test -v ./... -run Integration

    # Update check run called "integration-fork"
    - uses: actions/github-script@v7
      id: update-check-run
      if: ${{ always() }}
      env:
        number: ${{ github.event.client_payload.pull_request.number }}
        job: ${{ github.job }}
        # Conveniently, job.status maps to https://developer.github.com/v3/checks/runs/#update-a-check-run
        conclusion: ${{ job.status }}
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          const { data: pull } = await github.rest.pulls.get({
            ...context.repo,
            pull_number: process.env.number
          });
          const ref = pull.head.sha;

          const { data: checks } = await github.rest.checks.listForRef({
            ...context.repo,
            ref
          });

          const check = checks.check_runs.filter(c => c.name === process.env.job);

          const { data: result } = await github.rest.checks.update({
            ...context.repo,
            check_run_id: check[0].id,
            status: 'completed',
            conclusion: process.env.conclusion
          });

          return result;