AB#96 test: add e2e test for provider types that are safe to apply/re…

…quire approval globally

e2e-tests/suites/safe_to_apply/global_provider_types/artifacts/.terraapprove.yaml

@@ -0,0 +1,6 @@
+global:
+  safeToApply:
+    allResources:
+      matchers:
+        - providerType: "local_file"
+        - providerType: "local_sensitive_file"

e2e-tests/suites/safe_to_apply/global_provider_types/artifacts/main.tf

@@ -0,0 +1,24 @@
+resource "null_resource" "not_safe_to_apply" {
+}
+
+resource "local_file" "safe_to_apply" {
+  content  = "foo!"
+  filename = "${path.module}/foo.bar"
+}
+
+resource "local_sensitive_file" "safe_to_apply" {
+  content  = "bar!"
+  filename = "${path.module}/bar.bar"
+}
+
+terraform {
+  required_providers {
+    null = {
+      source = "hashicorp/null"
+    }
+
+    local = {
+      source = "hashicorp/local"
+    }
+  }
+}

e2e-tests/suites/safe_to_apply/global_provider_types/global_provider_types.bats

@@ -0,0 +1,37 @@
+setup() {
+  # Copy files to a read/write directory. This is necessary because
+  # Terraform generates a lock file in the working directory.
+  export ORIGINAL_DIR=$(pwd)
+  cp -r "$BATS_TEST_DIRNAME/artifacts/." $BATS_TEST_TMPDIR
+  cd $BATS_TEST_TMPDIR
+  terraform init > /dev/null
+}
+
+teardown() {
+  cd $ORIGINAL_DIR
+
+  # Print additional information when a test fails
+  echo "$status"
+  echo "$output"
+}
+
+@test "should return 0 if the only resources in the plan are safe to apply" {
+  # Given
+  terraform apply -auto-approve > /dev/null
+
+  # Delete files to trigger re-creation of the resource
+  rm ${BATS_TEST_TMPDIR}/foo.bar
+  rm ${BATS_TEST_TMPDIR}/bar.bar
+
+  # A second apply should only trigger the re-creation of the files
+  terraform plan -out test.tfplan > /dev/null
+  terraform show -json test.tfplan > ${BATS_TEST_TMPDIR}/test.tfplan.json
+
+  # When
+  run "/code/terraapprove" "." "./test.tfplan.json" "--reverse"
+
+  # Expect
+  [ "$status" -eq 0 ]
+  # Sanity check
+  grep "Operating mode: reverse" <<< "$output"
+}

e2e-tests/suites/standard-mode/global_provider_types/artifacts/.terraapprove.yaml

@@ -0,0 +1,6 @@
+global:
+  requireApproval:
+    allResources:
+      matchers:
+        - providerType: "local_file"
+        - providerType: "local_sensitive_file"

e2e-tests/suites/standard-mode/global_provider_types/artifacts/main.tf

@@ -0,0 +1,27 @@
+resource "null_resource" "not_safe_to_apply" {
+  triggers = {
+    always_run = timestamp()
+  }
+}
+
+resource "local_file" "safe_to_apply" {
+  content  = "foo!"
+  filename = "${path.module}/foo.bar"
+}
+
+resource "local_sensitive_file" "safe_to_apply" {
+  content  = "bar!"
+  filename = "${path.module}/bar.bar"
+}
+
+terraform {
+  required_providers {
+    null = {
+      source = "hashicorp/null"
+    }
+
+    local = {
+      source = "hashicorp/local"
+    }
+  }
+}

e2e-tests/suites/standard-mode/global_provider_types/global_provider_types.bats

@@ -0,0 +1,43 @@
+setup() {
+  # Copy files to a read/write directory. This is necessary because
+  # Terraform generates a lock file in the working directory.
+  export ORIGINAL_DIR=$(pwd)
+  cp -r "$BATS_TEST_DIRNAME/artifacts/." $BATS_TEST_TMPDIR
+  cd $BATS_TEST_TMPDIR
+  terraform init > /dev/null
+}
+
+teardown() {
+  cd $ORIGINAL_DIR
+
+  # Print additional information when a test fails
+  echo "$status"
+  echo "$output"
+}
+
+@test "should return 1 if there are types that require approval" {
+  # Given
+  terraform plan -out test.tfplan > /dev/null
+  terraform show -json test.tfplan > ${BATS_TEST_TMPDIR}/test.tfplan.json
+
+  # When
+  run "/code/terraapprove" "." "./test.tfplan.json"
+
+  # Expect
+  [ "$status" -eq 1 ]
+  grep "Approval required: true" <<< "$output"
+
+  # Given
+  terraform apply -auto-approve > /dev/null
+
+  # A second apply should only trigger the re-creation of the null_resource
+  terraform plan -out test.tfplan > /dev/null
+  terraform show -json test.tfplan > ${BATS_TEST_TMPDIR}/test.tfplan.json
+
+  # When
+  run "/code/terraapprove" "." "./test.tfplan.json"
+
+  # Expect
+  [ "$status" -eq 0 ]
+  grep "Approval required: false" <<< "$output"
+}