integration-tests.yml

name: Integration Tests

on:
  workflow_dispatch:
  workflow_call:
  push:
    branches: ["main"]
  pull_request_target:
    types: [labeled]

env:
  CARGO_TERM_COLOR: always

jobs:
  integration-tests:
    runs-on: ubuntu-latest
    
    # Run if:
    # 1. Manual trigger or push to main, OR
    # 2. PR with "safe-to-test" label
    if: |
      github.event_name != 'pull_request_target' ||
      contains(github.event.pull_request.labels.*.name, 'safe-to-test')
    
    permissions:
      id-token: write
      contents: read
      issues: write
      pull-requests: write

    env:
      LABEL_NAME: safe-to-test
      REPO: ${{ github.event.pull_request.base.repo.full_name }}
      PR_NUMBER: ${{ github.event.pull_request.number }}
    
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@v2.19.4
      with:
        egress-policy: audit

    - name: Remove label
      run: |
        echo "Removing label '$LABEL_NAME' from PR #$PR_NUMBER on repo $REPO" 
        gh_status=$(gh api "repos/$REPO/issues/$PR_NUMBER/labels/$LABEL_NAME" -X DELETE | jq 'if type == "object" then .status else empty end' --raw-output)
        case $gh_status in
          "") echo "Label removed" ;;
          404) echo "Label not found — ignoring" ;;
          *) echo "unexpected HTTP $gh_status" && exit 1 ;;
        esac
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Checkout
      uses: actions/checkout@v6
      with:
        ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
    
    - name: Install Rust
      uses: actions-rs/toolchain@v1
      with:
        toolchain: stable
        override: true
    
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v6
      with:
        role-to-assume: ${{ secrets.ROLE_ARN }}
        role-session-name: aws-workload-credentials-provider-ci-${{ github.run_id }}
        aws-region: us-west-2
    
    - name: Build provider binary
      run: cargo build
    
    - name: Run integration tests
      env:
        ACM_TEST_ROLE_ARN: ${{ secrets.ACM_TEST_ROLE_ARN }}
        ACM_TEST_CERTIFICATE_ARN: ${{ secrets.ACM_TEST_CERTIFICATE_ARN }}
      run: |
        cd integration-tests
        cargo test -- --test-threads=1