Skip to content

test: add terratest infrastructure and module integration tests#117

Merged
l50 merged 4 commits intomainfrom
feat/terraform-updates
Apr 16, 2026
Merged

test: add terratest infrastructure and module integration tests#117
l50 merged 4 commits intomainfrom
feat/terraform-updates

Conversation

@l50
Copy link
Copy Markdown
Contributor

@l50 l50 commented Apr 16, 2026

Key Changes:

  • Introduced comprehensive Go-based Terratest suites for module validation
  • Added pre-commit hooks to enforce Go formatting and vetting in module tests
  • Implemented robust resource cleanup utilities for test isolation
  • Integrated Terratest into CI with a dedicated GitHub Actions workflow

Added:

  • Terratest test suites for module validation:
    • Created Go test suites under modules/terraform-aws-instance-factory/test and
      modules/terraform-aws-net/test to cover EC2, ASG, storage, and networking
      scenarios with AWS SDK v2 and Terratest.
    • Implemented test helpers for resource creation, subnet discovery, security group
      handling, and output validation.
    • Defined resource cleanup utilities to reliably remove test artifacts (instances,
      ASGs, subnets, security groups, IAM roles/profiles, etc.).
    • Introduced Go module files (go.mod, go.sum) for test dependencies.
  • Pre-commit hooks for module test hygiene:
    • Added steps to run gofmt, go vet, and go build on all module test
      directories to enforce code quality.
  • Terratest GitHub Actions workflow:
    • Added .github/workflows/terratest.yaml to run Terratest on PRs, pushes,
      schedules, and merge groups.
    • Detects changed modules and runs only relevant tests; supports concurrency
      control and AWS OIDC credentials.

Changed:

  • Enhanced syntax-check workflow for environment variable handling and cache key
    precision.
  • Updated GoReleaser workflow to only trigger on vX.Y.Z tags, reducing noise.
  • Improved meta-labeler workflow with security documentation and warnings against
    unsafe usage.
  • Refined pre-commit configuration to include new test-related Go hooks.

…modules

**Added:**

- Introduced `.github/workflows/terratest.yaml` workflow to run module-level
  Terratest integration tests for `terraform-aws-net` and `terraform-aws-instance-factory`
- Added `.github/workflows/semgrep.yaml` for automated security analysis on
  pull requests, merges, and scheduled runs
- Added module-specific `go.mod` and `go.sum` for Terratest dependencies to both
  `terraform-aws-instance-factory/test` and `terraform-aws-net/test`
- Implemented complete Go test suite for `terraform-aws-instance-factory`:
  - Extensive helpers for AWS resource setup, teardown, validation, and cleanup
  - Automated tests for instance, ASG, and storage configurations
  - Robust cleanup logic for EC2, IAM, VPC, network, and security resources
  - Types and validation logic for structured test configurations
- Implemented Go test suite for `terraform-aws-net` with validation for VPC,
  subnets, NAT, route tables, and VPC endpoints
- Added `.hooks/terratest.sh` helper script for running module Terratests locally
- New pre-commit hooks for Go module test formatting, vetting, and build checks
- Security comments and guidance for `meta-labeler.yaml` referencing recent
  GitHub Actions security CVEs

**Changed:**

- Updated `.github/workflows/goreleaser.yaml` to only trigger on tags matching
  semantic version patterns (`vX.Y.Z`)
- Enhanced caching and environment variable handling in
  `.github/workflows/syntax-check.yaml` for better reliability
- Improved variable passing for dependency installation, collection builds, and
  pip requirements in syntax check workflow
- Expanded pre-commit config to run `gofmt`, `go vet`, and build checks on all
  module test directories
@dreadnode-renovate-bot dreadnode-renovate-bot Bot added area/github Changes made to github actions area/pre-commit Changes made to pre-commit hooks labels Apr 16, 2026
l50 added 2 commits April 16, 2026 13:58
**Removed:**

- Eliminated setting of `aws-access-key-id`, `aws-secret-access-key`, and
  `aws-session-token` from OIDC role steps, as these secrets are not required
  when using OIDC authentication in the terratest GitHub Actions workflow
**Changed:**

- Added `environment: terratest` to terratest jobs to specify deployment environment
  in the GitHub Actions workflow, supporting environment-specific controls and
  visibility for the `net` and `instance-factory` test jobs
**Changed:**

- Updated `returntocorp/semgrep` container image to v1.160.0 in the Semgrep
  workflow for improved security and features
- Changed concurrency `cancel-in-progress` logic to only apply on pull requests
  in the Semgrep workflow to prevent cancellation on other event types
- Added SARIF upload step using `github/codeql-action/upload-sarif` for
  security integration with GitHub in the Semgrep workflow
- Updated `aws-actions/configure-aws-credentials` action to v6.1.0 in the
  Terratest workflow for both jobs to leverage the latest improvements and fixes
@github-advanced-security
Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@l50 l50 merged commit 0db0df6 into main Apr 16, 2026
12 checks passed
@l50 l50 deleted the feat/terraform-updates branch April 16, 2026 21:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/github Changes made to github actions area/pre-commit Changes made to pre-commit hooks

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants