OpenTofuPlayground/.gitea/workflows/test.yml

name: Test

on:
  push:
    branches:
      - main
      - "feature/**"
  pull_request:
    branches:
      - main

env:
  TOFU_VERSION: "1.9.0"

jobs:
  # ─── Level 1: Static Analysis ─────────────────────────────────────────────
  static:
    name: Static Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install OpenTofu
        run: |
          curl -fsSL https://get.opentofu.org/install-opentofu.sh \
            | sh -s -- --install-method standalone --opentofu-version ${{ env.TOFU_VERSION }}

      - name: tofu fmt check (all .tf files)
        run: tofu fmt -check -recursive

      - name: tofu validate — Docker stack
        run: |
          tofu init -backend=false -input=false
          tofu validate

      - name: tofu validate — K8s stack
        run: |
          cd k8s
          tofu init -backend=false -input=false
          tofu validate

  # ─── Level 2: Unit Tests (mocked providers) ───────────────────────────────
  unit-docker:
    name: Unit Tests — Docker Stack
    runs-on: ubuntu-latest
    needs: static
    steps:
      - uses: actions/checkout@v4

      - name: Install OpenTofu
        run: |
          curl -fsSL https://get.opentofu.org/install-opentofu.sh \
            | sh -s -- --install-method standalone --opentofu-version ${{ env.TOFU_VERSION }}

      - name: tofu test — Docker stack
        run: |
          tofu init -backend=false -input=false
          tofu test

  unit-k8s:
    name: Unit Tests — K8s Stack
    runs-on: ubuntu-latest
    needs: static
    steps:
      - uses: actions/checkout@v4

      - name: Install OpenTofu
        run: |
          curl -fsSL https://get.opentofu.org/install-opentofu.sh \
            | sh -s -- --install-method standalone --opentofu-version ${{ env.TOFU_VERSION }}

      - name: tofu test — K8s stack
        run: |
          cd k8s
          tofu init -backend=false -input=false
          tofu test

  # ─── Level 3: Integration — K8s (k3d) ────────────────────────────────────
  # Runs on push to main only. Creates a real k3d cluster, applies, verifies,
  # then destroys. Skipped on PRs to keep feedback fast.
  integration-k8s:
    name: Integration Test — K8s (k3d)
    runs-on: ubuntu-latest
    needs: [unit-docker, unit-k8s]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Install OpenTofu
        run: |
          curl -fsSL https://get.opentofu.org/install-opentofu.sh \
            | sh -s -- --install-method standalone --opentofu-version ${{ env.TOFU_VERSION }}

      - name: Install k3d
        run: |
          curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash

      - name: Install kubectl
        run: |
          curl -fsSL "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl" \
            -o /usr/local/bin/kubectl
          chmod +x /usr/local/bin/kubectl

      - name: Create k3d cluster (Traefik disabled — we install CRDs manually)
        run: |
          k3d cluster create tofu-test \
            --agents 1 \
            --k3s-arg "--disable=traefik@server:0" \
            --wait
          # Gitea runners run inside a Docker container. k3d creates its own
          # bridge network (k3d-tofu-test); the runner isn't on it, so we
          # join the runner container to that network, then patch the kubeconfig
          # to use the server container's IP on that network directly (port 6443).
          docker network connect k3d-tofu-test "$(hostname)"
          SERVER_IP=$(docker inspect k3d-tofu-test-server-0 \
            --format '{{(index .NetworkSettings.Networks "k3d-tofu-test").IPAddress}}')
          k3d kubeconfig get tofu-test \
            | sed "s|https://0\.0\.0\.0:[0-9]*|https://${SERVER_IP}:6443|g" \
            | sed "s|https://127\.0\.0\.1:[0-9]*|https://${SERVER_IP}:6443|g" \
            > /tmp/test-kubeconfig
          chmod 600 /tmp/test-kubeconfig

      - name: Install Traefik CRDs
        run: |
          kubectl --kubeconfig /tmp/test-kubeconfig apply --validate=false \
            -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
          kubectl --kubeconfig /tmp/test-kubeconfig wait \
            --for=condition=established --timeout=60s \
            crd/ingressroutes.traefik.io crd/middlewares.traefik.io

      - name: tofu init — K8s stack
        working-directory: k8s
        run: tofu init -backend=false -input=false

      - name: Select or create workspace
        working-directory: k8s
        run: |
          tofu workspace select integration-test \
            || tofu workspace new integration-test

      - name: tofu apply
        working-directory: k8s
        run: |
          tofu apply -auto-approve \
            -var-file="apps/example-nodered.tfvars" \
            -var="kubeconfig_path=/tmp/test-kubeconfig" \
            -var="app_name=integration-test" \
            -var="rabbitmq_password=testpass-ci" \
            -var="loki_auth_token="

      - name: Verify K8s resources exist
        run: |
          NS="integration-test"
          KC=/tmp/test-kubeconfig
          echo "── Namespace ──"
          kubectl --kubeconfig $KC get namespace $NS
          echo "── Deployment ──"
          kubectl --kubeconfig $KC get deployment -n $NS
          echo "── Services ──"
          kubectl --kubeconfig $KC get service -n $NS
          echo "── PVCs ──"
          kubectl --kubeconfig $KC get pvc -n $NS
          echo "── IngressRoutes ──"
          kubectl --kubeconfig $KC get ingressroute.traefik.io -n $NS 2>/dev/null || \
            kubectl --kubeconfig $KC get ingressroute.traefik.containo.us -n $NS

      - name: tofu destroy
        working-directory: k8s
        if: always()
        run: |
          tofu destroy -auto-approve \
            -var-file="apps/example-nodered.tfvars" \
            -var="kubeconfig_path=/tmp/test-kubeconfig" \
            -var="app_name=integration-test" \
            -var="rabbitmq_password=testpass-ci" \
            -var="loki_auth_token="

      - name: Cleanup
        if: always()
        run: |
          k3d cluster delete tofu-test 2>/dev/null || true
          rm -f /tmp/test-kubeconfig