test.yml

---
# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Tests
on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  terraform:
    runs-on: ubuntu-latest
    name: Integration (Terraform ${{ matrix.terraform_version }})

    strategy:
      fail-fast: false
      matrix:
        terraform_version:
          # - "1.0"
          # - "1.1"
          # - "1.2"
          # - "1.3"
          # - "1.4"
          # - "1.5"
          - "1.6"
          - "1.7"
          - "1.8-rc1"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block # audit
          allowed-endpoints: >
            api.github.com:443
            checkpoint-api.hashicorp.com:443
            ec2.us-east-2.amazonaws.com:443
            get.opentofu.org:443
            github.com:443
            golang.org:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            registry.terraform.io:443
            releases.hashicorp.com:443
            storage.googleapis.com:443
            sts.us-east-2.amazonaws.com:443

      - name: Checkout Source
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 0

      - name: Install Go
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ">= 1.22.1"
          cache: true

      - name: Install Terraform ${{ matrix.terraform_version }}
        uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
        with:
          terraform_version: ${{ matrix.terraform_version }}
          terraform_wrapper: false

      - name: Run module tests with Terraform ${{ matrix.terraform_version }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ vars.AWS_REGION }}
        run: |
          cd tests && TF_PATH=$(which terraform) make

  opentofu:
    runs-on: ubuntu-latest
    name: Integration (OpenTofu ${{ matrix.opentofu_version }})

    strategy:
      fail-fast: false
      matrix:
        opentofu_version:
          - "1.6"
          - "1.7.0-alpha1"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block # audit
          allowed-endpoints: >
            api.github.com:443
            checkpoint-api.hashicorp.com:443
            ec2.us-east-2.amazonaws.com:443
            get.opentofu.org:443
            github.com:443
            golang.org:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            registry.opentofu.org:443
            releases.hashicorp.com:443
            storage.googleapis.com:443
            sts.us-east-2.amazonaws.com:443

      - name: Checkout Source
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 0

      - name: Install Go
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ">= 1.22.1"
          cache: true

      - name: Install OpenTofu ${{ matrix.opentofu_version }}
        uses: opentofu/setup-opentofu@ae80d4ecaab946d8f5ff18397fbf6d0686c6d46a # v1.0.3
        with:
          tofu_version: ~${{ matrix.opentofu_version }}
          tofu_wrapper: false

      - name: Run module tests with OpenTofu ${{ matrix.opentofu_version }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ vars.AWS_REGION }}
        run: |
          cd tests && TF_PATH=$(which tofu) make