terratest.yml

name: Terratest

on:
  pull_request:
    paths:
      - "infrastructure/terraform/**"
  push:
    branches: [main]
    paths:
      - "infrastructure/terraform/**"

concurrency:
  group: terratest-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

env:
  TF_VERSION: "1.7.5"
  GO_VERSION: "1.22"

jobs:
  terratest:
    name: Run Terratest
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write

    defaults:
      run:
        working-directory: infrastructure/terraform/tests

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: infrastructure/terraform/tests/go.sum

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
          aws-region: us-east-1

      - name: Install dependencies
        run: |
          go mod download
          go mod tidy

      - name: Run Terratest
        id: terratest
        run: |
          go test -v -timeout 30m ./... 2>&1 | tee terratest-output.txt
          echo "exitcode=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"

      - name: Upload test output
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: terratest-output-${{ github.run_id }}
          path: infrastructure/terraform/tests/terratest-output.txt
          retention-days: 30

      - name: Post test results to PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const output = fs.readFileSync('infrastructure/terraform/tests/terratest-output.txt', 'utf8');
            const body = `### Terratest Results\n\`\`\`\n${output.slice(0, 60000)}\n\`\`\``;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body,
            });

  cleanup:
    name: Test Cleanup
    runs-on: ubuntu-latest
    needs: terratest
    if: always()
    permissions:
      id-token: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
          aws-region: us-east-1

      - name: Destroy any orphaned resources
        working-directory: infrastructure/terraform
        run: |
          for dir in modules/*/; do
            if [ -f "$dir/terraform.tfstate" ]; then
              echo "Destroying resources in $dir"
              terraform destroy -auto-approve "$dir" || true
            fi
          done