terraform-provider-grafana/.github/workflows/cloud-acc-tests.yml at main · dennismdejong/terraform-provider-grafana · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: cloud acceptance tests
on:
  workflow_dispatch:
    inputs:
      tests:
        description: 'Tests to run (regex passed to -run)'
        default: '.*'
  workflow_call:
    inputs:
      tests:
        type: string
        description: 'Tests to run (regex passed to -run)'
        default: '.*'


# Keep workflow-level permissions minimal; grant elevated scopes at job level.
permissions:
  contents: read

jobs:
  cloud:
    concurrency: cloud-api
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
      - name: Get Secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@f619a637e489e8e7749cf4966ee2776e4178a303
        with:
          repo_secrets: |
            GRAFANA_CLOUD_ACCESS_POLICY_TOKEN=cloud-tests:api-key
            GRAFANA_CLOUD_ORG=cloud-tests:org
      - run: make testacc-cloud-api
        env:
          TESTARGS: -run='${{ github.event.inputs.tests }}' -parallel=2
          # Freshly-created Grafana Cloud stacks routinely return 503/504 from
          # individual stack-side microservices (teams, service-accounts) for
          # tens of seconds even after `/api/health` returns 200. Use a longer
          # retry budget than the provider's defaults so the cloud acceptance
          # tests survive that warm-up window.
          GRAFANA_RETRIES: 10
          GRAFANA_RETRY_WAIT: 5

  refresh-pr-gate-check:
    name: refresh pull_request gate check
    needs: cloud
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: write
    steps:
      - name: Re-run pull_request gate workflow for this commit (if present)
        env:
          GH_TOKEN: ${{ github.token }}
          THIS_REPO: ${{ github.repository }}
          HEAD_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail

          run_id=$(gh api \
            -H "Accept: application/vnd.github+json" \
            "repos/${THIS_REPO}/actions/workflows/cloud-acc-tests-gate.yml/runs?event=pull_request&head_sha=${HEAD_SHA}&per_page=1" \
            --jq '.workflow_runs[0].id // empty')

          if [ -z "${run_id}" ]; then
            echo "No pull_request gate run found for this commit; nothing to re-run."
            exit 0
          fi

          echo "Re-running pull_request gate workflow run id=${run_id}"
          gh api \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            "repos/${THIS_REPO}/actions/runs/${run_id}/rerun"