[MAINT] Add enterprise EMU testing config (integrations#3179)

* Add test config for EMU enterprise and helper functions to skip tests

Signed-off-by: Timo Sand <timo.sand@f-secure.com>

* Introduce `testAcc` setting for repo visibility

This enables GHEC EMU to run tests without having to manually skip everything public

Signed-off-by: Timo Sand <timo.sand@f-secure.com>

---------

Signed-off-by: Timo Sand <timo.sand@f-secure.com>

Author: deiga

CONTRIBUTING.md

@@ -33,9 +33,9 @@ This section describes a typical sequence performed when developing locally. Ful
 Once you have the repository cloned, there's a couple of additional steps you'll need to take. Since most of the testing is acceptance or integration testing, we need to manipulate real GitHub resources in order to run it. Useful setup steps are listed below:
 
 - If you haven't already, [create a GitHub organization you can use for testing](#github-organization).
-  - Optional: you may find it beneficial to create a test user as well in order to avoid potential rate-limiting issues on your main account.
-  - Your organization _must_ have a repository called `terraform-template-module`. The [terraformtesting/terraform-template-module](https://github.com/terraformtesting/terraform-template-module) repo is a good, re-usable example.
-    - You _must_ make sure that the "Template Repository" item in Settings is checked for this repo.
+    - Optional: you may find it beneficial to create a test user as well in order to avoid potential rate-limiting issues on your main account.
+    - Your organization _must_ have a repository called `terraform-template-module`. The [terraformtesting/terraform-template-module](https://github.com/terraformtesting/terraform-template-module) repo is a good, re-usable example.
+        - You _must_ make sure that the "Template Repository" item in Settings is checked for this repo.
 - If you haven't already, generate a Personal Access Token (PAT) for authenticating your test runs.
 - Export the necessary configuration for authenticating your provider with GitHub
 
@@ -52,7 +52,7 @@ Once you have the repository cloned, there's a couple of additional steps you'll
 ### Local Development Iteration
 
 1. Write a test describing what you will fix. See [`github_label`](./github/resource_github_issue_label_test.go) for an example format.
-1. Run your test and observe it fail. Enabling debug output allows for observing the underlying requests and responses made as well as viewing state (search `STATE:`) generated during the acceptance test run.
+2. Run your test and observe it fail. Enabling debug output allows for observing the underlying requests and responses made as well as viewing state (search `STATE:`) generated during the acceptance test run.
 
 ```sh
 TF_LOG=DEBUG TF_ACC=1 go test -v ./... -run ^TestAccGithubIssueLabel
@@ -182,6 +182,9 @@ export GH_TEST_ENTERPRISE_EMU_GROUP_ID=
 
 # Configure test options
 export GH_TEST_ADVANCED_SECURITY=
+
+# Configure if the enterprise is an EMU enterprise
+export GH_TEST_ENTERPRISE_IS_EMU=
 ```
 
 There are also a small amount of unit tests in the provider. Due to the nature of the provider, such tests are currently only recommended for exercising functionality completely internal to the provider. These may be executed by running `make test`.

github/acc_test.go

@@ -43,7 +43,8 @@ type testAccConfig struct {
 	token    string
 
 	// Enterprise configuration
-	enterpriseSlug string
+	enterpriseSlug  string
+	enterpriseIsEMU bool
 
 	// Global test configuration
 	testPublicRepository              string
@@ -76,6 +77,9 @@ type testAccConfig struct {
 
 	// Test options
 	testAdvancedSecurity bool
+
+	// Test repository configuration
+	testRepositoryVisibility string
 }
 
 var testAccConf *testAccConfig
@@ -130,6 +134,8 @@ func TestMain(m *testing.M) {
 		testExternalUserToken:             os.Getenv("GH_TEST_EXTERNAL_USER_TOKEN"),
 		testExternalUser2:                 os.Getenv("GH_TEST_EXTERNAL_USER2"),
 		testAdvancedSecurity:              os.Getenv("GH_TEST_ADVANCED_SECURITY") == "true",
+		testRepositoryVisibility:          "public",
+		enterpriseIsEMU:                   authMode == enterprise && os.Getenv("GH_TEST_ENTERPRISE_IS_EMU") == "true",
 	}
 
 	if config.authMode != anonymous {
@@ -165,6 +171,10 @@ func TestMain(m *testing.M) {
 		if err == nil {
 			config.testEnterpriseEMUGroupId = i
 		}
+
+		if config.enterpriseIsEMU {
+			config.testRepositoryVisibility = "private"
+		}
 	}
 
 	i, err := strconv.Atoi(os.Getenv("GH_TEST_ORG_APP_INSTALLATION_ID"))
@@ -318,6 +328,18 @@ func skipUnlessHasAppInstallations(t *testing.T) {
 	}
 }
 
+func skipUnlessEMUEnterprise(t *testing.T) {
+	if !testAccConf.enterpriseIsEMU {
+		t.Skip("Skipping as test mode is not EMU enterprise")
+	}
+}
+
+func skipIfEMUEnterprise(t *testing.T) {
+	if testAccConf.enterpriseIsEMU {
+		t.Skip("Skipping as this test is not supported for EMU enterprise")
+	}
+}
+
 func skipUnlessMode(t *testing.T, testModes ...testMode) {
 	if !slices.Contains(testModes, testAccConf.authMode) {
 		t.Skip("Skipping as not supported test mode")

github/resource_github_emu_group_mapping_test.go

@@ -21,7 +21,7 @@ func TestAccGithubEMUGroupMapping(t *testing.T) {
 		teamName := fmt.Sprintf("%steam-emu-%s", testResourcePrefix, randomID)
 
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { skipUnlessMode(t, enterprise) },
+			PreCheck:          func() { skipUnlessEMUEnterprise(t) },
 			ProviderFactories: providerFactories,
 			CheckDestroy:      testAccCheckGithubEMUGroupMappingDestroy,
 			Steps: []resource.TestStep{
@@ -43,7 +43,7 @@ func TestAccGithubEMUGroupMapping(t *testing.T) {
 		rn := "github_emu_group_mapping.test"
 
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { skipUnlessMode(t, enterprise) },
+			PreCheck:          func() { skipUnlessEMUEnterprise(t) },
 			ProviderFactories: providerFactories,
 			CheckDestroy:      testAccCheckGithubEMUGroupMappingDestroy,
 			Steps: []resource.TestStep{
@@ -84,7 +84,7 @@ func TestAccGithubEMUGroupMapping(t *testing.T) {
 `, teamName, teamName2, groupID)
 
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { skipUnlessMode(t, enterprise) },
+			PreCheck:          func() { skipUnlessEMUEnterprise(t) },
 			ProviderFactories: providerFactories,
 			CheckDestroy:      testAccCheckGithubEMUGroupMappingDestroy,
 			Steps: []resource.TestStep{
@@ -107,7 +107,7 @@ func TestAccGithubEMUGroupMapping(t *testing.T) {
 		teamName2 := fmt.Sprintf("%s-upd", teamName1)
 
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { skipUnlessMode(t, enterprise) },
+			PreCheck:          func() { skipUnlessEMUEnterprise(t) },
 			ProviderFactories: providerFactories,
 			CheckDestroy:      testAccCheckGithubEMUGroupMappingDestroy,
 			Steps: []resource.TestStep{
@@ -149,7 +149,7 @@ resource "github_emu_group_mapping" "test" {
 `
 
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { skipUnlessEnterprise(t) },
+			PreCheck:          func() { skipUnlessEMUEnterprise(t) },
 			ProviderFactories: providerFactories,
 			CheckDestroy:      testAccCheckGithubEMUGroupMappingDestroy,
 			Steps: []resource.TestStep{

github/resource_github_repository_ruleset_test.go

@@ -12,13 +12,6 @@ import (
 )
 
 func TestAccGithubRepositoryRuleset(t *testing.T) {
-	baseRepoVisibility := "public"
-
-	if testAccConf.authMode == enterprise {
-		// This enables repos to be created even in GHEC EMU
-		baseRepoVisibility = "private"
-	}
-
 	t.Run("create_branch_ruleset", func(t *testing.T) {
 		randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
 		repoName := fmt.Sprintf("%srepo-ruleset-%s", testResourcePrefix, randomID)
@@ -120,7 +113,7 @@ resource "github_repository_ruleset" "test" {
 		non_fast_forward = true
 	}
 }
-`, repoName, baseRepoVisibility)
+`, repoName, testAccConf.testRepositoryVisibility)
 
 		resource.Test(t, resource.TestCase{
 			PreCheck:          func() { skipUnauthenticated(t) },
@@ -189,7 +182,7 @@ resource "github_repository_ruleset" "test" {
 			}
 		}
 	}
-`, repoName, baseRepoVisibility)
+`, repoName, testAccConf.testRepositoryVisibility)
 
 		resource.Test(t, resource.TestCase{
 			PreCheck:          func() { skipUnauthenticated(t) },
@@ -308,13 +301,13 @@ resource "github_repository_ruleset" "test" {
 			ProviderFactories: providerFactories,
 			Steps: []resource.TestStep{
 				{
-					Config: fmt.Sprintf(config, repoName, randomID, baseRepoVisibility, name),
+					Config: fmt.Sprintf(config, repoName, randomID, testAccConf.testRepositoryVisibility, name),
 					Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr("github_repository_ruleset.test", "name", name),
 					),
 				},
 				{
-					Config: fmt.Sprintf(config, repoName, randomID, baseRepoVisibility, nameUpdated),
+					Config: fmt.Sprintf(config, repoName, randomID, testAccConf.testRepositoryVisibility, nameUpdated),
 					Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr("github_repository_ruleset.test", "name", nameUpdated),
 					),
@@ -367,9 +360,9 @@ resource "github_repository_ruleset" "test" {
 	}
 }
 `
-		config := fmt.Sprintf(baseConfig, repoName, baseRepoVisibility, bypassActorsConfig)
+		config := fmt.Sprintf(baseConfig, repoName, testAccConf.testRepositoryVisibility, bypassActorsConfig)
 
-		configUpdated := fmt.Sprintf(baseConfig, repoName, baseRepoVisibility, "")
+		configUpdated := fmt.Sprintf(baseConfig, repoName, testAccConf.testRepositoryVisibility, "")
 		resource.Test(t, resource.TestCase{
 			PreCheck:          func() { skipUnauthenticated(t) },
 			ProviderFactories: providerFactories,
@@ -435,13 +428,13 @@ resource "github_repository_ruleset" "test" {
 			ProviderFactories: providerFactories,
 			Steps: []resource.TestStep{
 				{
-					Config: fmt.Sprintf(config, repoName, randomID, baseRepoVisibility, bypassMode),
+					Config: fmt.Sprintf(config, repoName, randomID, testAccConf.testRepositoryVisibility, bypassMode),
 					Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr("github_repository_ruleset.test", "bypass_actors.0.bypass_mode", bypassMode),
 					),
 				},
 				{
-					Config: fmt.Sprintf(config, repoName, randomID, baseRepoVisibility, bypassModeUpdated),
+					Config: fmt.Sprintf(config, repoName, randomID, testAccConf.testRepositoryVisibility, bypassModeUpdated),
 					Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr("github_repository_ruleset.test", "bypass_actors.0.bypass_mode", bypassModeUpdated),
 					),
@@ -486,7 +479,7 @@ resource "github_repository_ruleset" "test" {
 					creation = true
 				}
 			}
-		`, repoName, randomID, baseRepoVisibility)
+		`, repoName, randomID, testAccConf.testRepositoryVisibility)
 
 		resource.Test(t, resource.TestCase{
 			PreCheck:          func() { skipUnauthenticated(t) },
@@ -508,13 +501,6 @@ resource "github_repository_ruleset" "test" {
 }
 
 func TestAccGithubRepositoryRulesetArchived(t *testing.T) {
-	baseRepoVisibility := "public"
-
-	if testAccConf.authMode == enterprise {
-		// This enables repos to be created even in GHEC EMU
-		baseRepoVisibility = "private"
-	}
-
 	t.Run("skips update and delete on archived repository", func(t *testing.T) {
 		randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
 		repoName := fmt.Sprintf("%srepo-ruleset-arch-%s", testResourcePrefix, randomID)
@@ -543,9 +529,9 @@ func TestAccGithubRepositoryRulesetArchived(t *testing.T) {
 			PreCheck:          func() { skipUnauthenticated(t) },
 			ProviderFactories: providerFactories,
 			Steps: []resource.TestStep{
-				{Config: fmt.Sprintf(config, repoName, archivedBefore, baseRepoVisibility, enforcementBefore)},
-				{Config: fmt.Sprintf(config, repoName, archivedAfter, baseRepoVisibility, enforcementBefore)},
-				{Config: fmt.Sprintf(config, repoName, archivedAfter, baseRepoVisibility, enforcementAfter)},
+				{Config: fmt.Sprintf(config, repoName, archivedBefore, testAccConf.testRepositoryVisibility, enforcementBefore)},
+				{Config: fmt.Sprintf(config, repoName, archivedAfter, testAccConf.testRepositoryVisibility, enforcementBefore)},
+				{Config: fmt.Sprintf(config, repoName, archivedAfter, testAccConf.testRepositoryVisibility, enforcementAfter)},
 			},
 		})
 	})
@@ -577,10 +563,10 @@ resource "github_repository_ruleset" "test" {
 			ProviderFactories: providerFactories,
 			Steps: []resource.TestStep{
 				{
-					Config: fmt.Sprintf(repoConfig, repoName, false, baseRepoVisibility, ""),
+					Config: fmt.Sprintf(repoConfig, repoName, false, testAccConf.testRepositoryVisibility, ""),
 				},
 				{
-					Config:      fmt.Sprintf(repoConfig, repoName, true, baseRepoVisibility, rulesetConfig),
+					Config:      fmt.Sprintf(repoConfig, repoName, true, testAccConf.testRepositoryVisibility, rulesetConfig),
 					ExpectError: regexp.MustCompile("cannot create ruleset on archived repository"),
 				},
 			},
@@ -764,12 +750,6 @@ func TestAccGithubRepositoryRuleset_requiredReviewers(t *testing.T) {
 	repoName := fmt.Sprintf("%srepo-ruleset-req-rev-%s", testResourcePrefix, randomID)
 	teamName := fmt.Sprintf("%steam-req-rev-%s", testResourcePrefix, randomID)
 	rulesetName := fmt.Sprintf("%s-ruleset-req-rev-%s", testResourcePrefix, randomID)
-	baseRepoVisibility := "public"
-
-	if testAccConf.authMode == enterprise {
-		// This enables repos to be created even in GHEC EMU
-		baseRepoVisibility = "private"
-	}
 
 	config := fmt.Sprintf(`
 resource "github_repository" "test" {
@@ -822,7 +802,7 @@ resource "github_repository_ruleset" "test" {
 
 	depends_on = [github_team_repository.test]
 }
-`, repoName, baseRepoVisibility, teamName, rulesetName)
+`, repoName, testAccConf.testRepositoryVisibility, teamName, rulesetName)
 
 	// Updated config: change minimum_approvals from 1 to 2
 	configUpdated := fmt.Sprintf(`
@@ -876,7 +856,7 @@ resource "github_repository_ruleset" "test" {
 
 	depends_on = [github_team_repository.test]
 }
-`, repoName, baseRepoVisibility, teamName, rulesetName)
+`, repoName, testAccConf.testRepositoryVisibility, teamName, rulesetName)
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:          func() { skipUnlessHasOrgs(t) },