localstack-utils/.github/workflows/test-bundle.yml at main · whummer/localstack-utils · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Bundle Test

on:
  pull_request:
    branches:
      - main
    paths:
      - 'cli-extensions/bundle-test/**'
      - 'cli-extensions/bin/ls-bundle'
      - '.github/workflows/test-bundle.yml'
  push:
    branches:
      - main
    paths:
      - 'cli-extensions/bundle-test/**'
      - 'cli-extensions/bin/ls-bundle'
      - '.github/workflows/test-bundle.yml'
  workflow_dispatch:

env:
  LOCALSTACK_AUTH_TOKEN: ${{ secrets.BUNDLE_LOCALSTACK_AUTH_TOKEN }}
  LOCALSTACK_DISABLE_EVENTS: "1"

jobs:
  bundle-test:
    name: Deploy infra and submit proof bundle
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: pip install localstack awscli-local terraform-local

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Start LocalStack
        run: |
          localstack start -d
          localstack wait

      - name: Deploy infrastructure via tflocal
        run: |
          cd cli-extensions/bundle-test
          tflocal init -input=false
          tflocal apply -auto-approve -input=false

      - name: Verify resources
        run: |
          awslocal s3 ls | grep bundle-test-artifacts
          awslocal s3 ls | grep bundle-test-logs
          awslocal sqs list-queues | grep bundle-test-events
          awslocal sqs list-queues | grep bundle-test-events-dlq
          awslocal ssm get-parameter --name /bundle-test/version --query Parameter.Value --output text
          awslocal ssm get-parameter --name /bundle-test/config --with-decryption --query Parameter.Value --output text
          awslocal dynamodb describe-table --table-name bundle-test-jobs --query Table.TableStatus --output text
          awslocal lambda get-function --function-name bundle-test-processor --query Configuration.State --output text
          awslocal iam get-role --role-name bundle-test-lambda-exec --query Role.RoleName --output text

      - name: Submit proof bundle
        run: |
          curl -fsSL "https://raw.githubusercontent.com/whummer/localstack-utils/refs/heads/main/cli-extensions/bin/ls-bundle" -o ls-bundle && chmod +x ls-bundle
          ./ls-bundle submit --project test-whu1 \
            --summary "Terraform infra deployed and verified" \
            --assertion "S3 buckets created=pass" \
            --assertion "SQS queue + DLQ created=pass" \
            --assertion "SSM parameters created=pass" \
            --assertion "DynamoDB table created=pass" \
            --assertion "Lambda function deployed=pass" \
            --assertion "IAM role and policies created=pass"

      - name: Print LocalStack logs
        if: always()
        run: localstack logs