ci.yml

name: "CI unit and integration tests"

on:
  pull_request:
    branches:
      - main

permissions:
  contents: read
  id-token: write

jobs:
  python-test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        module:
          - notify_slack/lambda
          - rds_activity_stream/lambda
          - schedule_shutdown/lambda
          - sentinel_forwarder/wrapper
          - waf_ip_blocklist/lambda
    
    steps:
      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            module:
              - '${{ matrix.module }}/**'

      - name: Setup Python
        if: steps.changes.outputs.module == 'true'
        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
        with:
          python-version: "3.11"

      - name: Python tests
        if: steps.changes.outputs.module == 'true'
        working-directory: ${{ matrix.module }}
        run: |
          make install
          make ARGS=--check fmt
          make lint
          make test

  terraform-test:
    runs-on: ubuntu-latest
    env:
      AWS_REGION: ca-central-1
      TERRAFORM_VERSION: 1.7.0
      CONFTEST_VERSION: 0.27.0
    strategy:
      fail-fast: false
      matrix:
        module:
          - athena_access_logs
          - client_vpn
          - ecs
          - gh_oidc_role
          - notify_slack
          - S3_scan_object
          - schedule_shutdown
          - rds
          - rds_activity_stream
          - resolver_dns
          - S3
          - S3_log_bucket
          - sentinel_forwarder   
          - vpc
          - waf_ip_blocklist

    steps:
      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            module:
              - '${{ matrix.module }}/**/*.tf'
              - '${{ matrix.module }}/tests/**'

      - name: Configure AWS credentials using OIDC
        if: steps.changes.outputs.module == 'true'
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: arn:aws:iam::124044056575:role/terraform-modules-test
          role-session-name: TFTest
          aws-region: ${{ env.AWS_REGION }}

      - name: Setup Terraform tools
        if: steps.changes.outputs.module == 'true'
        uses: cds-snc/terraform-tools-setup@v1

      - name: Terraform tests
        if: steps.changes.outputs.module == 'true'
        working-directory: ${{ matrix.module }}
        run: |
          make test