integration-tests.yml

name: Integration Tests

on:
  workflow_dispatch:
  push:
    branches:
      - "integration/*"

permissions:
  id-token: write # This is required for Az CLI Login
  contents: read # This is required for actions/checkout

jobs:
  terraform-get-outputs-dev:
    environment: Development
    runs-on: ubuntu-latest

    concurrency: # This is required to prevent multiple GitHub Actions invocations against stateful resources. e.g. Terraform state file / Database / Deployed Apps
      group: ${{ github.repository }}-dev

    steps:
    - uses: actions/checkout@v4

    - name: "Az CLI Login"
      uses: azure/login@v2
      with:
        client-id: ${{ vars.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_wrapper: false

    - name: Terraform Init
      shell: bash
      run: |
        cd terraform
        terraform init -backend-config=backends/dev.backend.hcl -var-file=tfvars/dev.tfvars
      env:
        ARM_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
        ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
        ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
        ARM_USE_AZUREAD: true
        ARM_USE_OIDC: true

    - id: terraform-output
      shell: bash
      run: |
        cd terraform
        echo "workload_public_url=$(terraform output -raw workload_public_url)" >> $GITHUB_OUTPUT
        echo "key_vault_name=$(terraform output -raw key_vault_name)" >> $GITHUB_OUTPUT
        echo "integration_tests_account_name=$(terraform output -raw integration_tests_account_name)" >> $GITHUB_OUTPUT
        echo "api_audience=$(terraform output -raw api_audience)" >> $GITHUB_OUTPUT
      env:
        ARM_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
        ARM_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
        ARM_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
        ARM_USE_AZUREAD: true
        ARM_USE_OIDC: true

    outputs:
      workload_public_url: ${{ steps.terraform-output.outputs.workload_public_url }}
      key_vault_name: ${{ steps.terraform-output.outputs.key_vault_name }}
      integration_tests_account_name: ${{ steps.terraform-output.outputs.integration_tests_account_name }}
      api_audience: ${{ steps.terraform-output.outputs.api_audience }}

  run-api-integration-tests-dev:
    environment: Development
    runs-on: ubuntu-latest
    needs: [terraform-get-outputs-dev]

    concurrency: # This is required to prevent multiple GitHub Actions invocations against stateful resources. e.g. Terraform state file / Database / Deployed Apps
      group: ${{ github.repository }}-dev

    steps:
    - name: "Az CLI Login"
      uses: azure/login@v2
      with:
        client-id: ${{ vars.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

    - shell: bash
      run: |
        client_id=$(az keyvault secret show --name "${{ needs.terraform-get-outputs-dev.outputs.integration_tests_account_name }}-client-id" --vault-name "${{ needs.terraform-get-outputs-dev.outputs.key_vault_name }}" --query value -o tsv)
        client_secret=$(az keyvault secret show --name "${{ needs.terraform-get-outputs-dev.outputs.integration_tests_account_name }}-client-secret" --vault-name "${{ needs.terraform-get-outputs-dev.outputs.key_vault_name }}" --query value -o tsv)
        client_tenant_id=$(az keyvault secret show --name "${{ needs.terraform-get-outputs-dev.outputs.integration_tests_account_name }}-client-tenant-id" --vault-name "${{ needs.terraform-get-outputs-dev.outputs.key_vault_name }}" --query value -o tsv)
        api_key=$(az keyvault secret show --name "${{ needs.terraform-get-outputs-dev.outputs.integration_tests_account_name }}-api-key-primary" --vault-name "${{ needs.terraform-get-outputs-dev.outputs.key_vault_name }}" --query value -o tsv)

        echo "::add-mask::$client_id"
        echo "::add-mask::$client_secret"
        echo "::add-mask::$client_tenant_id"
        echo "::add-mask::$api_key"

        echo "int_test_client_id=$client_id" >> $GITHUB_ENV
        echo "int_test_client_secret=$client_secret" >> $GITHUB_ENV
        echo "int_test_client_tenant_id=$client_tenant_id" >> $GITHUB_ENV
        echo "int_test_api_key=$api_key" >> $GITHUB_ENV

    - uses: frasermolyneux/actions/run-api-integration-tests@main
      with:
        dotnet-version: 9.0.x
        src-folder: "src"
        api-base-url: ${{ needs.terraform-get-outputs-dev.outputs.workload_public_url }}
        api-key: ${{ env.int_test_api_key }}
        api-audience: ${{ needs.terraform-get-outputs-dev.outputs.api_audience }}
        AZURE_CLIENT_ID: ${{ env.int_test_client_id }}
        AZURE_CLIENT_SECRET: ${{ env.int_test_client_secret }}
        AZURE_TENANT_ID: ${{ env.int_test_client_tenant_id }}