run-aws-tests.yml

name: Run AWS tests

on:
  pull_request_target:
    branches: [main]
    #opened, reopened and synchronize will cause the workflow to fail on forks due to permissions
    #once labeled, that will then be overridden by the is-collaborator job
    types: [opened, labeled, synchronize, reopened]

jobs:
  is-collaborator:
    runs-on: ubuntu-latest
    steps:
      - name: Get User Permission
        id: checkAccess
        uses: actions-cool/check-user-permission@cd622002ff25c2311d2e7fb82107c0d24be83f9b
        with:
          require: write
          username: ${{ github.actor }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Check User Permission
        if: steps.checkAccess.outputs.require-result == 'false'
        run: |
          echo "${{ github.actor }} does not have permissions on this repo."
          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
          exit 1

  publish-branch-image:
    if: contains( github.event.pull_request.labels.*.name, 'run-aws-tests' )
    needs: is-collaborator
    uses: ./.github/workflows/docker-ecs-worker-image.yml
    permissions:
      contents: read
      id-token: write
    secrets:
      ECR_WORKER_IMAGE_PUSH_ROLE_ARN: ${{ secrets.ECR_WORKER_IMAGE_PUSH_ROLE_ARN }}
    with:
      ref: ${{ github.event.pull_request.head.sha || null }} # this should only be run with this ref if is-collaborator has been run and passed

  run-tests:
    if: contains( github.event.pull_request.labels.*.name, 'run-aws-tests' )
    needs: publish-branch-image
    timeout-minutes: 40
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha || null }} # this should only be run with this ref if is-collaborator has been run and passed
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        env:
          SHOW_STACK_TRACE: true
        with:
          aws-region: eu-west-1
          role-to-assume: ${{ secrets.ARTILLERY_AWS_CLI_ROLE_ARN_TEST1 }}
          role-session-name: OIDCSession
          mask-aws-account-id: true
      - name: Use Node.js 18.x
        uses: actions/setup-node@v2
        with:
          node-version: 18.x
      - run: npm install
      - run: npm run build
      - run: npm run test:aws --workspace artillery
        env:
          FORCE_COLOR: 1
          ECR_IMAGE_VERSION: ${{ github.sha }} # the image is published with the sha of the commit within this repo
          ARTILLERY_CLOUD_ENDPOINT: ${{ secrets.ARTILLERY_CLOUD_ENDPOINT_TEST }}
          ARTILLERY_CLOUD_API_KEY: ${{ secrets.ARTILLERY_CLOUD_API_KEY_TEST }}
          GITHUB_REPO: ${{ github.repository }}
          GITHUB_ACTOR: ${{ github.actor }}