google.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Google Cloud Test

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

env:
  RUST_LOG: DEBUG
  RUST_BACKTRACE: full

permissions: {}

jobs:
  # Unit tests - always run, no secrets needed
  unit_test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Run unit tests
        working-directory: ./services/google
        run: |
          echo "::group::Running unit tests"
          cargo test --lib --no-fail-fast
          cargo test --doc --no-fail-fast
          echo "::endgroup::"

  # Check if we can run integration tests
  check_secrets:
    runs-on: ubuntu-latest
    outputs:
      has_secrets: ${{ steps.check.outputs.has_secrets }}
    steps:
      - name: Check if secrets are available
        id: check
        run: |
          if [[ "${{ github.event_name }}" == "push" || ( "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.fork }}" == "false" && "${{ github.actor }}" != "dependabot[bot]" ) ]]; then
            echo "has_secrets=true" >> $GITHUB_OUTPUT
            echo "::notice::Integration tests will be executed (base repository and non-dependabot PR)"
          else
            echo "has_secrets=false" >> $GITHUB_OUTPUT
            echo "::warning::Integration tests will be skipped (forked repository, dependabot PR, or no secrets available)"
          fi

  # Signing tests - test signature algorithm with static credentials
  signing_test:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup 1Password Connect
        uses: 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          connect-host: ${{ secrets.OP_CONNECT_HOST }}
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
      - name: Load secrets
        uses: 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          export-env: true
        env:
          REQSIGN_GOOGLE_TEST: on
          REQSIGN_GOOGLE_CREDENTIAL: op://reqsign/google/credential_base64
          REQSIGN_GOOGLE_CLOUD_STORAGE_SCOPE: op://reqsign/google/storage_scope
          REQSIGN_GOOGLE_CLOUD_STORAGE_URL: op://reqsign/google/storage_url
      - name: Test signing
        working-directory: ./services/google
        run: |
          echo "::group::Running signing tests"
          cargo test signing:: --no-fail-fast -- --no-capture
          echo "::endgroup::"

  # DefaultCredentialProvider test
  test_default_provider:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup 1Password Connect
        uses: 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          connect-host: ${{ secrets.OP_CONNECT_HOST }}
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
      - name: Load secrets
        id: load_secrets
        uses: 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        env:
          REQSIGN_GOOGLE_TEST_DEFAULT: on
          GOOGLE_APPLICATION_CREDENTIALS_BASE64: op://reqsign/google/credential_base64
      - name: Setup test credentials file
        run: |
          echo "${STEPS_LOAD_SECRETS_OUTPUTS_GOOGLE_APPLICATION_CREDENTIALS_BASE64}" | base64 -d > /tmp/gcp_credentials.json
          echo "GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp_credentials.json" >> $GITHUB_ENV
        env:
          STEPS_LOAD_SECRETS_OUTPUTS_GOOGLE_APPLICATION_CREDENTIALS_BASE64: ${{ steps.load_secrets.outputs.GOOGLE_APPLICATION_CREDENTIALS_BASE64 }}
      - name: Test DefaultCredentialProvider
        working-directory: ./services/google
        run: |
          echo "::group::Testing DefaultCredentialProvider"
          cargo test test_default_credential_provider --no-fail-fast -- --no-capture
          echo "::endgroup::"

  # StaticCredentialProvider test
  test_static_provider:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup 1Password Connect
        uses: 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          connect-host: ${{ secrets.OP_CONNECT_HOST }}
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
      - name: Load secrets
        uses: 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          export-env: true
        env:
          REQSIGN_GOOGLE_TEST_STATIC: on
          REQSIGN_GOOGLE_CREDENTIAL: op://reqsign/google/credential_base64
          REQSIGN_GOOGLE_CLOUD_STORAGE_SCOPE: op://reqsign/google/storage_scope
      - name: Test StaticCredentialProvider
        working-directory: ./services/google
        run: |
          echo "::group::Testing StaticCredentialProvider"
          cargo test test_static_credential_provider --no-fail-fast -- --no-capture
          echo "::endgroup::"

  # AuthorizedUserCredentialProvider test
  test_authorized_user_provider:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup 1Password Connect
        uses: 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          connect-host: ${{ secrets.OP_CONNECT_HOST }}
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
      - name: Load secrets
        id: load_secrets
        uses: 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        env:
          REQSIGN_GOOGLE_TEST_AUTHORIZED_USER: on
          AUTHORIZED_USER_CREDENTIALS_BASE64: op://reqsign/google/authorized_user_base64
      - name: Setup test credentials file
        run: |
          echo "${STEPS_LOAD_SECRETS_OUTPUTS_AUTHORIZED_USER_CREDENTIALS_BASE64}" | base64 -d > /tmp/authorized_user.json
          echo "REQSIGN_GOOGLE_AUTHORIZED_USER_CREDENTIALS=/tmp/authorized_user.json" >> $GITHUB_ENV
        env:
          STEPS_LOAD_SECRETS_OUTPUTS_AUTHORIZED_USER_CREDENTIALS_BASE64: ${{ steps.load_secrets.outputs.AUTHORIZED_USER_CREDENTIALS_BASE64 }}
      - name: Test AuthorizedUserCredentialProvider
        working-directory: ./services/google
        run: |
          echo "::group::Testing AuthorizedUserCredentialProvider"
          cargo test test_authorized_user_credential_provider --no-fail-fast -- --no-capture
          echo "::endgroup::"

  # ExternalAccountCredentialProvider test (Workload Identity)
  test_external_account_provider:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup 1Password Connect
        uses: 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          connect-host: ${{ secrets.OP_CONNECT_HOST }}
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
      - name: Load secrets
        uses: 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          export-env: true
        env:
          REQSIGN_GOOGLE_TEST_WORKLOAD_IDENTITY: on
          GOOGLE_WORKLOAD_IDENTITY_PROVIDER: op://reqsign/google/workload_identity_provider
          GOOGLE_SERVICE_ACCOUNT: op://reqsign/google/service_account_email
      - name: Setup Workload Identity with Google Auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          create_credentials_file: true
          workload_identity_provider: ${{ env.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.GOOGLE_SERVICE_ACCOUNT }}
      - name: Test ExternalAccountCredentialProvider
        working-directory: ./services/google
        run: |
          echo "::group::Testing ExternalAccountCredentialProvider"
          # The google-github-actions/auth action sets GOOGLE_APPLICATION_CREDENTIALS
          # reqsign should be able to use this external_account configuration
          cargo test test_external_account_with_workload_identity --no-fail-fast -- --no-capture
          echo "::endgroup::"

  # ImpersonatedServiceAccountCredentialProvider test
  test_impersonated_service_account_provider:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup 1Password Connect
        uses: 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        with:
          connect-host: ${{ secrets.OP_CONNECT_HOST }}
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
      - name: Load secrets
        id: load_secrets
        uses: 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
        env:
          REQSIGN_GOOGLE_TEST_IMPERSONATED_SERVICE_ACCOUNT: on
          IMPERSONATED_SA_CREDENTIALS_BASE64: op://reqsign/google/impersonated_sa_base64
      - name: Setup test credentials file
        run: |
          echo "${STEPS_LOAD_SECRETS_OUTPUTS_IMPERSONATED_SA_CREDENTIALS_BASE64}" | base64 -d > /tmp/impersonated_sa.json
          echo "REQSIGN_GOOGLE_IMPERSONATED_SERVICE_ACCOUNT_CREDENTIALS=/tmp/impersonated_sa.json" >> $GITHUB_ENV
        env:
          STEPS_LOAD_SECRETS_OUTPUTS_IMPERSONATED_SA_CREDENTIALS_BASE64: ${{ steps.load_secrets.outputs.IMPERSONATED_SA_CREDENTIALS_BASE64 }}
      - name: Test ImpersonatedServiceAccountCredentialProvider
        working-directory: ./services/google
        run: |
          echo "::group::Testing ImpersonatedServiceAccountCredentialProvider"
          cargo test test_impersonated_service_account_credential_provider --no-fail-fast -- --no-capture
          echo "::endgroup::"

  # VmMetadataCredentialProvider test
  test_vm_metadata_provider:
    needs: check_secrets
    if: needs.check_secrets.outputs.has_secrets == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Start mock metadata server
        run: |
          python3 services/google/tests/mocks/vm_metadata_mock_server.py 8080 &
          echo "MOCK_PID=$!" >> $GITHUB_ENV
          sleep 2
          # Verify the mock server is running
          curl -f -H "Metadata-Flavor: Google" http://127.0.0.1:8080/computeMetadata/v1/instance/service-accounts/ || exit 1
      - name: Test VmMetadataCredentialProvider with mock
        working-directory: ./services/google
        run: |
          echo "::group::Testing VmMetadataCredentialProvider with mock"
          export REQSIGN_GOOGLE_TEST_VM_METADATA_MOCK=on
          export GCE_METADATA_HOST=127.0.0.1:8080
          cargo test test_vm_metadata_credential_provider_with_mock --no-fail-fast -- --no-capture
          echo "::endgroup::"
      - name: Stop mock server
        if: always()
        run: |
          if [ ! -z "$MOCK_PID" ]; then
            kill $MOCK_PID || true
          fi

  # Summary
  test_summary:
    needs:
      [
        unit_test,
        signing_test,
        test_default_provider,
        test_static_provider,
        test_authorized_user_provider,
        test_external_account_provider,
        test_impersonated_service_account_provider,
        test_vm_metadata_provider,
      ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Test Summary
        run: |
          echo "## Google Cloud Test Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # Unit tests status
          if [[ "${NEEDS_UNIT_TEST_RESULT}" == "success" ]]; then
            echo "✅ Unit tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_UNIT_TEST_RESULT}" == "skipped" ]]; then
            echo "⏭️ Unit tests skipped" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ Unit tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          # Integration tests status
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Integration Tests" >> $GITHUB_STEP_SUMMARY

          if [[ "${NEEDS_SIGNING_TEST_RESULT}" == "success" ]]; then
            echo "✅ Signing tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_SIGNING_TEST_RESULT}" == "skipped" ]]; then
            echo "⏭️ Signing tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ Signing tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "${NEEDS_TEST_DEFAULT_PROVIDER_RESULT}" == "success" ]]; then
            echo "✅ DefaultCredentialProvider tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_TEST_DEFAULT_PROVIDER_RESULT}" == "skipped" ]]; then
            echo "⏭️ DefaultCredentialProvider tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ DefaultCredentialProvider tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "${NEEDS_TEST_STATIC_PROVIDER_RESULT}" == "success" ]]; then
            echo "✅ StaticCredentialProvider tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_TEST_STATIC_PROVIDER_RESULT}" == "skipped" ]]; then
            echo "⏭️ StaticCredentialProvider tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ StaticCredentialProvider tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "${NEEDS_TEST_AUTHORIZED_USER_PROVIDER_RESULT}" == "success" ]]; then
            echo "✅ AuthorizedUserCredentialProvider tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_TEST_AUTHORIZED_USER_PROVIDER_RESULT}" == "skipped" ]]; then
            echo "⏭️ AuthorizedUserCredentialProvider tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ AuthorizedUserCredentialProvider tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "${NEEDS_TEST_EXTERNAL_ACCOUNT_PROVIDER_RESULT}" == "success" ]]; then
            echo "✅ ExternalAccountCredentialProvider tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_TEST_EXTERNAL_ACCOUNT_PROVIDER_RESULT}" == "skipped" ]]; then
            echo "⏭️ ExternalAccountCredentialProvider tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ ExternalAccountCredentialProvider tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "${NEEDS_TEST_IMPERSONATED_SERVICE_ACCOUNT_PROVIDER_RESULT}" == "success" ]]; then
            echo "✅ ImpersonatedServiceAccountCredentialProvider tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_TEST_IMPERSONATED_SERVICE_ACCOUNT_PROVIDER_RESULT}" == "skipped" ]]; then
            echo "⏭️ ImpersonatedServiceAccountCredentialProvider tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ ImpersonatedServiceAccountCredentialProvider tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          if [[ "${NEEDS_TEST_VM_METADATA_PROVIDER_RESULT}" == "success" ]]; then
            echo "✅ VmMetadataCredentialProvider tests passed" >> $GITHUB_STEP_SUMMARY
          elif [[ "${NEEDS_TEST_VM_METADATA_PROVIDER_RESULT}" == "skipped" ]]; then
            echo "⏭️ VmMetadataCredentialProvider tests skipped (no secrets)" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ VmMetadataCredentialProvider tests failed" >> $GITHUB_STEP_SUMMARY
          fi

          # Overall status
          echo "" >> $GITHUB_STEP_SUMMARY
          if [[ "${NEEDS_UNIT_TEST_RESULT}" == "success" ]] && \
             ( [[ "${NEEDS_SIGNING_TEST_RESULT}" == "success" ]] || [[ "${NEEDS_SIGNING_TEST_RESULT}" == "skipped" ]] ) && \
             ( [[ "${NEEDS_TEST_DEFAULT_PROVIDER_RESULT}" == "success" ]] || [[ "${NEEDS_TEST_DEFAULT_PROVIDER_RESULT}" == "skipped" ]] ) && \
             ( [[ "${NEEDS_TEST_STATIC_PROVIDER_RESULT}" == "success" ]] || [[ "${NEEDS_TEST_STATIC_PROVIDER_RESULT}" == "skipped" ]] ) && \
             ( [[ "${NEEDS_TEST_AUTHORIZED_USER_PROVIDER_RESULT}" == "success" ]] || [[ "${NEEDS_TEST_AUTHORIZED_USER_PROVIDER_RESULT}" == "skipped" ]] ) && \
             ( [[ "${NEEDS_TEST_EXTERNAL_ACCOUNT_PROVIDER_RESULT}" == "success" ]] || [[ "${NEEDS_TEST_EXTERNAL_ACCOUNT_PROVIDER_RESULT}" == "skipped" ]] ) && \
             ( [[ "${NEEDS_TEST_IMPERSONATED_SERVICE_ACCOUNT_PROVIDER_RESULT}" == "success" ]] || [[ "${NEEDS_TEST_IMPERSONATED_SERVICE_ACCOUNT_PROVIDER_RESULT}" == "skipped" ]] ) && \
             ( [[ "${NEEDS_TEST_VM_METADATA_PROVIDER_RESULT}" == "success" ]] || [[ "${NEEDS_TEST_VM_METADATA_PROVIDER_RESULT}" == "skipped" ]] ); then
            echo "### ✅ All tests completed successfully" >> $GITHUB_STEP_SUMMARY
          else
            echo "### ❌ Some tests failed" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi

        env:
          NEEDS_UNIT_TEST_RESULT: ${{ needs.unit_test.result }}

          NEEDS_SIGNING_TEST_RESULT: ${{ needs.signing_test.result }}

          NEEDS_TEST_DEFAULT_PROVIDER_RESULT: ${{ needs.test_default_provider.result }}

          NEEDS_TEST_STATIC_PROVIDER_RESULT: ${{ needs.test_static_provider.result }}

          NEEDS_TEST_AUTHORIZED_USER_PROVIDER_RESULT: ${{ needs.test_authorized_user_provider.result }}

          NEEDS_TEST_EXTERNAL_ACCOUNT_PROVIDER_RESULT: ${{ needs.test_external_account_provider.result }}

          NEEDS_TEST_IMPERSONATED_SERVICE_ACCOUNT_PROVIDER_RESULT: ${{ needs.test_impersonated_service_account_provider.result }}

          NEEDS_TEST_VM_METADATA_PROVIDER_RESULT: ${{ needs.test_vm_metadata_provider.result }}