test-destroy.yml

name: Test - Destroy
on:
#  # Uncomment when test added first time to register workflow and comment it back after workflow would be registered
#  #
#  # Added pull_request to register workflow from the PR.
#  # Read more https://stackoverflow.com/questions/63362126/github-actions-how-to-run-a-workflow-created-on-a-non-master-branch-from-the-wo
#  pull_request: {}
  workflow_dispatch:
    inputs:
      ref:
        description: "The fully-formed ref of the branch or tag that triggered the workflow run"
        required: false
        type: string
      sha:
        description: "The sha of the commit that triggered the workflow run"
        required: false
        type: string     

jobs:
  setup:
    runs-on: ubuntu-latest
    services:
      localstack:
        image: localstack/localstack:4.14.0
        ports:
          - 4566:4566
          - 4510-4559:4510-4559
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          path: ./action

      - run: |
          aws ${AWS_ENDPOINT_OVERRIDE:+--endpoint-url $AWS_ENDPOINT_OVERRIDE} ssm put-parameter \
            --name "/platform/default/staging/default_ingress_domain" \
            --type "SecureString" \
            --value "example.com"
          
          aws ${AWS_ENDPOINT_OVERRIDE:+--endpoint-url $AWS_ENDPOINT_OVERRIDE} ssm put-parameter \
            --name "/platform/default/staging/default_alb_ingress_group" \
            --type "SecureString" \
            --value "default" \
            --debug

          aws ${AWS_ENDPOINT_OVERRIDE:+--endpoint-url $AWS_ENDPOINT_OVERRIDE} ssm put-parameter \
            --name "/platform/default/_metadata/kube_version" \
            --type "SecureString" \
            --value "1.15" \
            --debug

        env:
          AWS_ACCESS_KEY_ID: test
          AWS_SECRET_ACCESS_KEY: test
          AWS_DEFAULT_REGION: us-east-1
          ## Use localhost to connect localstack because the commands runs not in a container
          AWS_ENDPOINT_OVERRIDE: http://localhost:4566

      - id: random
        shell: bash
        run: |-
          echo "password=$(echo $RANDOM | md5sum | head -c 20)" >> $GITHUB_OUTPUT

    outputs:
      random: ${{ steps.random.outputs.password }}


  test:
    runs-on: ubuntu-latest
    environment: terratest
    continue-on-error: true
    needs: [setup]
    services:
      localstack:
        image: localstack/localstack:4.14.0
        ports:
          - 4566:4566
          - 4510-4559:4510-4559
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          path: ./action

      - run: |
          aws ${AWS_ENDPOINT_OVERRIDE:+--endpoint-url $AWS_ENDPOINT_OVERRIDE} ssm put-parameter \
            --name "/platform/default/staging/default_ingress_domain" \
            --type "SecureString" \
            --value "example.com"
          
          aws ${AWS_ENDPOINT_OVERRIDE:+--endpoint-url $AWS_ENDPOINT_OVERRIDE} ssm put-parameter \
            --name "/platform/default/staging/default_alb_ingress_group" \
            --type "SecureString" \
            --value "default" \
            --debug

          aws ${AWS_ENDPOINT_OVERRIDE:+--endpoint-url $AWS_ENDPOINT_OVERRIDE} ssm put-parameter \
            --name "/platform/default/_metadata/kube_version" \
            --type "SecureString" \
            --value "1.15" \
            --debug

        env:
          AWS_ACCESS_KEY_ID: test
          AWS_SECRET_ACCESS_KEY: test
          AWS_DEFAULT_REGION: us-east-1
          ## Use localhost to connect localstack because the commands runs not in a container
          AWS_ENDPOINT_OVERRIDE: http://localhost:4566

      - uses: actions/create-github-app-token@v3
        id: github-app
        with:
          app-id: ${{ vars.BOT_GITHUB_APP_ID }}
          private-key: ${{ secrets.BOT_GITHUB_APP_PRIVATE_KEY }}
          owner: 'cloudposse-tests'

      - uses: ./action
        id: current
        with:
          cluster: https://github.com/cloudposse-tests/argocd-deploy-non-prod-test/blob/main/plat/ue2-sandbox/apps
          toolchain: helmfile
          environment: staging
          namespace: staging
          path: ./action/test/helmfile/helmfile.yaml.gotmpl
          application: test-app
          ssm-path: platform/default
          github-pat:  ${{ steps.github-app.outputs.token }}
          image: nginx
          image-tag: ${{ needs.setup.outputs.random }}
          operation: destroy
        env:
          AWS_ACCESS_KEY_ID: test
          AWS_SECRET_ACCESS_KEY: test
          AWS_DEFAULT_REGION: us-east-1
          ## Use localhost to connect localstack because the commands runs not in a container
          AWS_ENDPOINT_OVERRIDE: http://localhost:4566
          ## Use localhost to connect localstack because chamber does not run in a container
          CHAMBER_AWS_SSM_ENDPOINT: http://localhost:4566/

    outputs:
      sha: ${{ steps.current.outputs.sha }}

  assert:
    runs-on: ubuntu-latest
    environment: terratest    
    needs: [setup, test]
    steps:
      - uses: nick-fields/assert-action@v2
        with:
          expected: ""
          actual: "${{ needs.test.outputs.sha }}"
          comparison: notEqual

      - uses: actions/create-github-app-token@v3
        id: github-app
        with:
          app-id: ${{ vars.BOT_GITHUB_APP_ID }}
          private-key: ${{ secrets.BOT_GITHUB_APP_PRIVATE_KEY }}
          owner: 'cloudposse-tests'

      - uses: jiangxin/file-exists-action@v1
        id: resources
        with:
          repository: cloudposse-tests/argocd-deploy-non-prod-test
          ref: ${{ needs.test.outputs.sha }}
          path: plat/ue2-sandbox/apps/staging/test-app/manifests/resources.yaml
          type: file
          token: ${{ steps.github-app.outputs.token }}

      - uses: nick-fields/assert-action@v2
        with:
          expected: "false"
          actual: "${{ steps.resources.outputs.exists }}"

  teardown:
    runs-on: ubuntu-latest
    needs: [assert]
    if: ${{ always() }}
    steps:
      - name: Tear down
        run: echo "Do Tear down"