source_aws.yml

name: Source Plugin AWS Workflow

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - "plugins/source/aws/**"
      - ".github/workflows/source_aws.yml"
  push:
    branches:
      - main
    paths:
      - "plugins/source/aws/**"
      - ".github/workflows/source_aws.yml"

jobs:
  plugins-source-aws:
    timeout-minutes: 45
    name: "plugins/source/aws"
    permissions:
      id-token: write
      contents: read
    runs-on: large-ubuntu-monorepo
    defaults:
      run:
        working-directory: ./plugins/source/aws
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 2
      - name: Set up Go 1.x
        uses: erezrokah/setup-go@feat/add_cache_prefix
        with:
          go-version-file: plugins/source/aws/go.mod
          cache: true
          cache-dependency-path: plugins/source/aws/go.sum
          cache-key-prefix: test-cache-
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          version: v1.52.2
          working-directory: plugins/source/aws
          args: "--config ../../.golangci.yml"
          skip-pkg-cache: true
          skip-build-cache: true
      - name: Setup CloudQuery
        uses: cloudquery/setup-cloudquery@v3
        with:
          version: 'v3.13.0'
      - name: gen
        if: github.event_name == 'pull_request'
        run: make gen
      - name: Fail if generation updated files
        if: github.event_name == 'pull_request'
        run: test "$(git status -s | wc -l)" -eq 0 || (git status -s; exit 1)
      - name: Build
        run: go build .
      - name: Test
        run: make test
      # Sanity integration test, only for release PRs
      - name: Configure AWS credentials
        if: startsWith(github.head_ref, 'release-please--branches--main--components')
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: arn:aws:iam::615713231484:role/cq-playground-aws-github-action
          aws-region: us-east-1
      - name: Run sync
        if: startsWith(github.head_ref, 'release-please--branches--main--components')
        run: cloudquery sync test/sanity.yml --log-console
  validate-release:
    timeout-minutes: 60
    runs-on: large-ubuntu-monorepo
    env:
      CGO_ENABLED: 0
    steps:
      - name: Checkout
        if: startsWith(github.head_ref, 'release-please--branches--main--components') || github.event_name == 'push'
        uses: actions/checkout@v3
      - uses: actions/cache@v3
        if: startsWith(github.head_ref, 'release-please--branches--main--components') || github.event_name == 'push'
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-1.20.5-release-cache-${{ hashFiles('plugins/source/aws/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-1.20.5-release-cache-plugins-source-aws
      - name: Set up Go
        if: startsWith(github.head_ref, 'release-please--branches--main--components') || github.event_name == 'push'
        uses: actions/setup-go@v3
        with:
          go-version-file: plugins/source/aws/go.mod
      - name: Install GoReleaser
        if: startsWith(github.head_ref, 'release-please--branches--main--components') || github.event_name == 'push'
        uses: goreleaser/goreleaser-action@v3
        with:
          distribution: goreleaser-pro
          version: latest
          install-only: true
      - name: Run GoReleaser Dry-Run
        if: startsWith(github.head_ref, 'release-please--branches--main--components') || github.event_name == 'push'
        run: goreleaser release --timeout 50m --snapshot --clean --skip-validate --skip-publish --skip-sign -f ./plugins/source/aws/.goreleaser.yaml
        env:
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
  test-policies:
    timeout-minutes: 30
    runs-on: large-ubuntu-monorepo
    defaults:
      run:
        working-directory: ./plugins/source/aws
    services:
      postgres:
        image: postgres:11
        env:
          POSTGRES_PASSWORD: pass
          POSTGRES_USER: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up Go 1.x
        uses: erezrokah/setup-go@feat/add_cache_prefix
        with:
          go-version-file: plugins/source/aws/go.mod
          cache: true
          cache-dependency-path: plugins/source/aws/go.sum
          cache-key-prefix: policies-cache-
      - name: Build
        run: go build .
      - name: Setup CloudQuery
        uses: cloudquery/setup-cloudquery@v3
        with:
          version: 'v3.10.1'
      - name: Migrate DB
        run: cloudquery migrate test/policy_cq_config.yml
        env:
          CQ_DSN: postgresql://postgres:pass@localhost:5432/postgres
      - name: Run all policies
        run: cd policies && psql -h localhost -p 5432 -U postgres -d postgres -w -f ./policy.sql
        env:
          PGPASSWORD: pass