OpenTofuPlayground/.gitlab/workflows/test.gitlab-ci.yml

# ─────────────────────────────────────────────────────────────────────────────
# Test pipeline — mirrors .gitea/workflows/test.yml
#
# Level 1 (static)      — fmt check + validate, all MRs and feature branches
# Level 2 (unit)        — tofu test with mock_provider, all MRs and branches
# Level 3 (integration) — real k3d cluster apply/destroy, main branch only
# ─────────────────────────────────────────────────────────────────────────────

# ─── Shared template: installs OpenTofu and common tools ─────────────────────
.tofu_setup:
  image: ubuntu:22.04
  before_script:
    - apt-get update -qq && apt-get install -y -qq curl git jq
    - |
      curl -fsSL https://get.opentofu.org/install-opentofu.sh \
        | sh -s -- --install-method=standalone --opentofu-version=$TOFU_VERSION

# ─── Level 1: Static Analysis ────────────────────────────────────────────────
static-analysis:
  extends: .tofu_setup
  stage: static
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
  script:
    - tofu fmt -check -recursive
    - |
      echo "── Validating Docker stack ──"
      tofu init -backend=false -input=false
      tofu validate
    - |
      echo "── Validating K8s stack ──"
      cd k8s
      tofu init -backend=false -input=false
      tofu validate

# ─── Level 2: Unit Tests (mocked providers) ──────────────────────────────────
unit-tests-docker:
  extends: .tofu_setup
  stage: unit
  needs: [static-analysis]
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
  script:
    - echo "── Docker stack unit tests ──"
    - tofu init -backend=false -input=false
    - tofu test

unit-tests-k8s:
  extends: .tofu_setup
  stage: unit
  needs: [static-analysis]
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
  script:
    - echo "── K8s stack unit tests ──"
    - cd k8s
    - tofu init -backend=false -input=false
    - tofu test

# ─── Level 3: Integration Test — K8s (k3d) ───────────────────────────────────
# Runs only on push to main. Creates a real k3d cluster, applies the example
# app, verifies resources exist, then destroys. Skipped on MRs for fast feedback.
integration-k8s:
  extends: .tofu_setup
  stage: integration
  needs: [unit-tests-docker, unit-tests-k8s]
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
  # Full clone needed so git show works for the integration workspace
  variables:
    GIT_DEPTH: "0"
  script:
    - |
      echo "── Installing k3d ──"
      curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
    - |
      echo "── Installing kubectl ──"
      curl -fsSL \
        "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
        -o /usr/local/bin/kubectl
      chmod +x /usr/local/bin/kubectl
    - |
      echo "── Creating k3d cluster (Traefik disabled — CRDs installed manually) ──"
      k3d cluster create tofu-test \
        --agents 1 \
        --k3s-arg "--disable=traefik@server:0" \
        --wait
      # GitLab CI runners run inside a Docker container. k3d creates its own
      # bridge network (k3d-tofu-test); the runner isn't on it, so we
      # join the runner container to that network, then patch the kubeconfig
      # to use the server container's IP on that network directly (port 6443).
      docker network connect k3d-tofu-test "$(hostname)"
      SERVER_IP=$(docker inspect k3d-tofu-test-server-0 \
        --format '{{(index .NetworkSettings.Networks "k3d-tofu-test").IPAddress}}')
      k3d kubeconfig get tofu-test \
        | sed "s|https://0\.0\.0\.0:[0-9]*|https://${SERVER_IP}:6443|g" \
        | sed "s|https://127\.0\.0\.1:[0-9]*|https://${SERVER_IP}:6443|g" \
        > /tmp/test-kubeconfig
      chmod 600 /tmp/test-kubeconfig
    - |
      echo "── Installing Traefik CRDs ──"
      kubectl --kubeconfig /tmp/test-kubeconfig apply --validate=false \
        -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
      kubectl --kubeconfig /tmp/test-kubeconfig wait \
        --for=condition=established --timeout=60s \
        crd/ingressroutes.traefik.io crd/middlewares.traefik.io
    - |
      echo "── tofu init + workspace ──"
      cd k8s
      tofu init -backend=false -input=false
      tofu workspace select integration-test 2>/dev/null \
        || tofu workspace new integration-test
    - |
      echo "── tofu apply ──"
      cd k8s
      tofu apply -auto-approve \
        -var-file="apps/example-nodered.tfvars" \
        -var="kubeconfig_path=/tmp/test-kubeconfig" \
        -var="app_name=integration-test" \
        -var="rabbitmq_password=testpass-ci" \
        -var="loki_auth_token="
    - |
      echo "── Verify K8s resources ──"
      NS="integration-test"
      KC=/tmp/test-kubeconfig
      echo "── Namespace ──"
      kubectl --kubeconfig $KC get namespace $NS
      echo "── Deployment ──"
      kubectl --kubeconfig $KC get deployment -n $NS
      echo "── Services ──"
      kubectl --kubeconfig $KC get service -n $NS
      echo "── PVCs ──"
      kubectl --kubeconfig $KC get pvc -n $NS
      echo "── IngressRoutes ──"
      kubectl --kubeconfig $KC get ingressroute.traefik.io -n $NS 2>/dev/null || \
        kubectl --kubeconfig $KC get ingressroute.traefik.containo.us -n $NS
    - |
      echo "── tofu destroy ──"
      cd k8s
      tofu destroy -auto-approve \
        -var-file="apps/example-nodered.tfvars" \
        -var="kubeconfig_path=/tmp/test-kubeconfig" \
        -var="app_name=integration-test" \
        -var="rabbitmq_password=testpass-ci" \
        -var="loki_auth_token="
  after_script:
    - k3d cluster delete tofu-test 2>/dev/null || true
    - rm -f /tmp/test-kubeconfig