test.yml

#
# Copyright (C) 2021 CloudTruth, Inc.
#

# the secret values will be redacted by GitHub Actions
# this contains tests, which is why the secret value we are
#   testing against are checked into this file

name: 'build-test'
on:
  pull_request:
  push:
    branches:
      - main
      - 'release/*'

jobs:
  secrets-gate:
    runs-on: ubuntu-latest
    outputs:
      ok: ${{ steps.check-secrets.outputs.ok }}
    steps:
      - name: check for secrets needed to run demo
        id: check-secrets
        run: |
          if [ ! -z "${{ secrets.CLOUDTRUTH_API_KEY }}" ]; then
            echo "ok=true" >>$GITHUB_OUTPUT
          fi

  codeql:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          config-file: .github/codeql/codeql-config.yml
          languages: 'javascript'

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

  build:
    needs:
      - secrets-gate
    runs-on: "${{ matrix.os }}"
    strategy:
      fail-fast: false
      matrix:
        node-version:
          - 20.x
        os:
          - macos-latest
          - ubuntu-latest
          - windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
      - run: |
          npm install
      - name: Build
        run: |
          npm run all
      - name: Check for changes in dist
        if: ${{ contains(matrix.os, 'ubuntu') }}
        run: |
          git diff --exit-code
      - name: Upload coverage to Codecov
        if: ${{ contains(matrix.os, 'ubuntu') && needs.secrets-gate.outputs.ok == 'true' }}
        uses: codecov/codecov-action@v3 
        with:
          token: "${{ secrets.CODECOV_TOKEN }}"

  test-posix:
    # tests against an environment named "staging"
    # runs on ubuntu against production, macos against staging
    # to detect regressions or breaking changes
    needs:
      - secrets-gate
    if: ${{ needs.secrets-gate.outputs.ok == 'true' }}
    runs-on: "${{ matrix.os }}"
    strategy:
      matrix:
        include:
          - apikey: CLOUDTRUTH_API_KEY
            os: ubuntu-latest
            server: "https://api.cloudtruth.io"
          - apikey: CLOUDTRUTH_STAGING_API_KEY
            os: macos-latest
            server: "https://api.staging.cloudtruth.io"
        os:
          - macos-latest
          - ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: save initial state and set expectations
        run: |
          printenv | grep -v 'GITHUB_' > env_expected_unsorted
          echo CTTEST_NOT_A_SECRET=not_a_secret_override >> env_expected_unsorted
          echo CTTEST_TOTALLY_A_SECRET=totally_a_secret_override >> env_expected_unsorted
          echo CTTEST_HAS_NO_OVERRIDE=has_no_override_default >> env_expected_unsorted
          echo cttest.not.posix=not.posix.override >> env_expected_unsorted
          cat env_expected_unsorted | sort > env_expected
      - name: run action from repository
        uses: ./
        with:
          apikey: "${{ secrets[matrix.apikey] }}"
          project: "${{ github.repository }}"
          environment: staging
          server: "${{ matrix.server }}"
      - name: check environment is as expected 
        run: |
          printenv | grep -v 'GITHUB_' | sort > env_after
          diff env_after env_expected
      - name: dump the environment
        run: |
          printenv | sort

  test-windows:
    # tests against an environment named "override"
    needs:
      - secrets-gate
    if: ${{ needs.secrets-gate.outputs.ok == 'true' }}
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: save initial state and set expectations
        shell: pwsh
        run: |
          [Environment]::SetEnvironmentVariable("CTTEST_NOT_A_SECRET", "not_a_secret_override")
          [Environment]::SetEnvironmentVariable("CTTEST_TOTALLY_A_SECRET", "totally_a_secret_override")
          [Environment]::SetEnvironmentVariable("CTTEST_HAS_NO_OVERRIDE", "has_no_override_default")
          [Environment]::SetEnvironmentVariable("cttest.not.posix", "not.posix.override")
          Get-ChildItem Env: | Sort-Object -Property Name | Out-File -FilePath .\env_expected
          [Environment]::SetEnvironmentVariable("CTTEST_NOT_A_SECRET", $null)
          [Environment]::SetEnvironmentVariable("CTTEST_TOTALLY_A_SECRET", $null)
          [Environment]::SetEnvironmentVariable("CTTEST_HAS_NO_OVERRIDE", $null)
          [Environment]::SetEnvironmentVariable("cttest.not.posix", $null)
      - name: run action from repository
        uses: ./
        with:
          apikey: "${{ secrets.CLOUDTRUTH_API_KEY }}"
          project: "${{ github.repository }}"
          environment: staging
      - name: check environment is as expected 
        shell: pwsh
        run: |
          Get-ChildItem Env: | Sort-Object -Property Name | Out-File -FilePath .\env_after
          Compare-Object -ReferenceObject $(Get-Content .\env_expected) -DifferenceObject $(Get-Content .\env_after)
      - name: dump the environment
        shell: pwsh
        run: |
          Get-ChildItem Env: | Sort-Object -Property Name | Format-Table -Wrap -AutoSize