atmos/.github/workflows/planfile-artifacts-e2e.yml at 23a95e1a0bc8d5253624b7b4d7bb6fc8ec984b84 · cloudposse/atmos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
# End-to-end test for the `github/artifacts` planfile store via the EXPLICIT CLI
# (manual) path, across two separate jobs:
#
#   plan job   -> `atmos terraform plan --ci` uploads the planfile to GitHub
#                 Actions Artifacts.
#   apply job  -> explicitly `atmos terraform planfile download` the artifact
#                 (cross-job, same run) and `atmos terraform apply --planfile=...`.
#
# The AUTOMATIC hook-driven flow (plan --ci upload -> deploy --ci auto download +
# verify + apply) is tested separately in planfile-verify-e2e.yml.
#
# This is the one path no Go unit test can cover: the backend talks to the
# GitHub Actions Artifacts API directly using the runner-only
# ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL, which GitHub withholds from
# `run:` steps. We dogfood the in-repo `actions/github-runtime` action
# (mode: env) to surface them — exactly the wiring documented at
# /ci/planfile-storage.
#
# The IaC binary is also dogfooded through the Atmos toolchain: the fixture
# declares `dependencies.tools.opentofu` (+ `command: tofu`), so
# `atmos terraform plan/apply` auto-installs OpenTofu and resolves it from the
# toolchain PATH — no hashicorp/setup-terraform action required.
name: Planfile Artifacts E2E

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - 'pkg/ci/artifact/**'
      - 'cmd/terraform/planfile/**'
      - 'pkg/ci/plugins/terraform/**'
      - 'actions/github-runtime/**'
      - 'tests/fixtures/scenarios/planfile-artifacts-e2e/**'
      - '.github/workflows/planfile-artifacts-e2e.yml'

permissions:
  contents: read
  actions: read # Required for the GITHUB_TOKEN to list/download artifacts via the REST API.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  ATMOS_BOOTSTRAP_VERSION: "1.223.0"
  # Pin the SHA so the plan upload and the apply download derive the identical
  # planfile key across both jobs.
  ATMOS_CI_SHA: ${{ github.sha }}
  GITHUB_TOKEN: ${{ github.token }}
  FIXTURE_DIR: tests/fixtures/scenarios/planfile-artifacts-e2e

jobs:
  plan:
    name: plan (upload planfile)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: "go.mod"

      - name: Set up Atmos
        uses: cloudposse/github-action-setup-atmos@82ed6d959532148e602fbbbe28b95c4628081561 # v3.1.0
        with:
          atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
          install-wrapper: false

      - name: Build atmos
        run: |
          sh scripts/build-atmos.sh default test
          echo "$PWD/build" >> "$GITHUB_PATH"

      # Surface the runner's ACTIONS_* credentials to every later run step.
      # This is the entire reason github/artifacts works from a `run:` step.
      - name: Expose GitHub Actions runtime credentials
        uses: ./actions/github-runtime
        with:
          mode: env

      - name: Plan and upload the planfile
        working-directory: tests/fixtures/scenarios/planfile-artifacts-e2e
        run: atmos terraform plan mycomponent -s prod --ci

  apply:
    name: apply (consume planfile)
    needs: plan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: "go.mod"

      - name: Set up Atmos
        uses: cloudposse/github-action-setup-atmos@82ed6d959532148e602fbbbe28b95c4628081561 # v3.1.0
        with:
          atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
          install-wrapper: false

      - name: Build atmos
        run: |
          sh scripts/build-atmos.sh default test
          echo "$PWD/build" >> "$GITHUB_PATH"

      - name: Expose GitHub Actions runtime credentials
        uses: ./actions/github-runtime
        with:
          mode: env

      - name: Download the planfile uploaded by the plan job
        working-directory: tests/fixtures/scenarios/planfile-artifacts-e2e
        run: |
          set -euo pipefail
          # The named "github" store carries prefix=planfile and resolves owner/repo
          # from GITHUB_REPOSITORY — matching exactly what the plan job's --ci upload
          # hook wrote (planfile-<stack>--<component>--<sha>.tfplan.tar in this run).
          # Artifacts are run-scoped, so the plan job's upload is visible here.
          atmos terraform planfile download mycomponent -s prod \
            --store=github -o "$RUNNER_TEMP/downloaded.planfile"
          test -s "$RUNNER_TEMP/downloaded.planfile"

      - name: Apply the downloaded planfile
        working-directory: tests/fixtures/scenarios/planfile-artifacts-e2e
        run: |
          set -euo pipefail
          # Apply exactly the plan that was reviewed in the plan job — no re-plan.
          atmos terraform apply mycomponent -s prod --planfile="$RUNNER_TEMP/downloaded.planfile"
          echo "Round-trip OK: planfile uploaded by the plan job was applied by the apply job."