Update test-validate workflow

dflook · Dec 20, 2024 · cec2b90 · cec2b90
1 parent c3dc19f
commit cec2b90
Showing 1 changed file with 36 additions and 12 deletions.
diff --git a/.github/workflows/test-validate.yaml b/.github/workflows/test-validate.yaml
@@ -3,13 +3,18 @@ name: Test terraform-validate
 on:
   - pull_request
 
+permissions:
+  contents: read
+
 jobs:
   valid:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: valid
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: validate
         uses: ./terraform-validate
@@ -18,18 +23,22 @@ jobs:
           path: tests/workflows/test-validate/valid
 
       - name: Check valid
+        env:
+          FAILURE_REASON: ${{ steps.validate.outputs.failure-reason }}
         run: |
-          if [[ "${{ steps.validate.outputs.failure-reason }}" != "" ]]; then
+          if [[ "$FAILURE_REASON" != "" ]]; then
             echo "::error:: failure-reason not set correctly"
             exit 1
           fi
 
   invalid:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Invalid terraform configuration
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: validate
         uses: ./terraform-validate
@@ -39,23 +48,28 @@ jobs:
           path: tests/workflows/test-validate/invalid
 
       - name: Check invalid
+        env:
+          OUTCOME: ${{ steps.validate.outcome }}
+          FAILURE_REASON: ${{ steps.validate.outputs.failure-reason }}
         run: |
-          if [[ "${{ steps.validate.outcome }}" != "failure" ]]; then
+          if [[ "$OUTCOME" != "failure" ]]; then
             echo "Validate did not fail correctly"
             exit 1
           fi
 
-          if [[ "${{ steps.validate.outputs.failure-reason }}" != "validate-failed" ]]; then
+          if [[ "$FAILURE_REASON" != "validate-failed" ]]; then
             echo "::error:: failure-reason not set correctly"
             exit 1
           fi
 
   validate_workspace:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Use workspace name during validation
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: validate prod
         uses: ./terraform-validate
@@ -77,23 +91,28 @@ jobs:
           path: tests/workflows/test-validate/workspace_eval
 
       - name: Check invalid
+        env:
+          OUTCOME: ${{ steps.validate.outcome }}
+          FAILURE_REASON: ${{ steps.validate.outputs.failure-reason }}
         run: |
-          if [[ "${{ steps.validate.outcome }}" != "failure" ]]; then
+          if [[ "$OUTCOME" != "failure" ]]; then
             echo "Validate did not fail correctly"
             exit 1
           fi
 
-          if [[ "${{ steps.validate.outputs.failure-reason }}" != "validate-failed" ]]; then
+          if [[ "$FAILURE_REASON" != "validate-failed" ]]; then
             echo "::error:: failure-reason not set correctly"
             exit 1
           fi
 
   validate_remote_workspace:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Use workspace name during validation
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: validate prod
         uses: ./terraform-validate
@@ -102,11 +121,13 @@ jobs:
           workspace: prod
 
   validate_unterminated_string:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Validate with unterminated string
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: validate
         uses: ./terraform-validate
@@ -116,13 +137,16 @@ jobs:
         continue-on-error: true
 
       - name: Check invalid
+        env:
+          OUTCOME: ${{ steps.validate.outcome }}
+          FAILURE_REASON: ${{ steps.validate.outputs.failure-reason }}
         run: |
-          if [[ "${{ steps.validate.outcome }}" != "failure" ]]; then
+          if [[ "$OUTCOME" != "failure" ]]; then
             echo "Validate did not fail correctly"
             exit 1
           fi
 
-          if [[ "${{ steps.validate.outputs.failure-reason }}" != "validate-failed" ]]; then
+          if [[ "$FAILURE_REASON" != "validate-failed" ]]; then
             echo "::error:: failure-reason not set correctly"
             exit 1
           fi