_test-acceptance.tmpl.yaml

name: Acceptance Test

on:
  workflow_call:
    inputs:
      project-name:
        required: false
        type: string
        default: "vault-plugin-secrets-nexus-repository"
      vault-version:
        required: false
        type: string
        default: "latest"
      vault-plugin-dir:
        required: false
        type: string
        default: "./test/plugins"
      nxr-version:
        required: false
        type: string
        default: "latest"

permissions:
  contents: read

jobs:
  test:
    name: 'Test plugin on Vault v${{ inputs.vault-version }} + Nexus Repository v${{ inputs.nxr-version }}'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup Vault CLI
        run: |
          curl -LO 'https://releases.hashicorp.com/vault/${{ inputs.vault-version }}/vault_${{ inputs.vault-version }}_linux_amd64.zip' &&\
            unzip 'vault_${{ inputs.vault-version }}_linux_amd64.zip' &&\
            install vault /usr/local/bin &&\
            rm -rf ./vault*

      - name: Setup Bats and bats libs
        id: setup-bats
        uses: bats-core/bats-action@2104b40bb7b6c2d5110b23a26b0bf265ab8027db # 3.0.0
        with:
          support-install: false
          detik-install: false
          file-install: false

      - name: Download plugin from build
        if: github.ref_type != 'tag'
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: ${{ inputs.project-name }}
          path: ${{ inputs.vault-plugin-dir }}

      - name: Download plugin from release
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VAULT_PLUGIN_DIR: ${{ inputs.vault-plugin-dir }}
          PROJECT_NAME: ${{ inputs.project-name }}
          VERSION: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          gh release download "${VERSION}" -p "${PROJECT_NAME}_${VERSION}_linux-amd64.tar.gz"
          tar xzf "${PROJECT_NAME}_${VERSION}_linux-amd64.tar.gz"
          mkdir -p "${VAULT_PLUGIN_DIR}"
          mv "${PROJECT_NAME}_${VERSION}" "${VAULT_PLUGIN_DIR}/${PROJECT_NAME}"

      - name: Run test
        shell: bash
        env:
          # BATS_LIB_PATH: ${{ steps.setup-bats.outputs.lib-path }}
          # TERM: xterm
          VAULT_VERSION: ${{ inputs.vault-version }}
          VAULT_PLUGIN_DIR: ${{ inputs.vault-plugin-dir }}
          NXR_VERSION: ${{ inputs.nxr-version }}
        #run: bats test/acceptance-tests.bats
        run: |
          chmod 755 -R "${VAULT_PLUGIN_DIR}"
          bats test/acceptance-tests.bats