test(act): add argo, vault and github app token mocks (#502)

Author: xnyo

tests/act/internal/workflow/ci/ci.go

@@ -64,9 +64,7 @@ func NewWorkflow(opts ...WorkflowOption) (Workflow, error) {
 	testingWf := Workflow{workflow.NewTestingWorkflow("simple-ci", ciBaseWf)}
 
 	// Add the child workflow (ci) now, so further customization can be done on it via opts.
-	// Use the same UUID as the parent, so they have the same uuid in the file name
-	// and it is easier to correlate them.
-	childTestingWf := workflow.NewTestingWorkflow("ci", childBaseWf, workflow.WithUUID(testingWf.UUID()))
+	childTestingWf := workflow.NewTestingWorkflow("ci", childBaseWf)
 	testingWf.AddChild("ci", childTestingWf)
 
 	// Change the parent workflow so it calls the mocked child workflow

tests/act/internal/workflow/mock.go

@@ -2,6 +2,7 @@
 package workflow
 
 import (
+	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"strings"
@@ -10,6 +11,11 @@ import (
 const (
 	GCSLoginAction  = "google-github-actions/auth"
 	GCSUploadAction = "google-github-actions/upload-cloud-storage"
+
+	VaultSecretsAction = "grafana/shared-workflows/actions/get-vault-secrets"
+	ArgoWorkflowAction = "grafana/shared-workflows/actions/trigger-argo-workflow"
+
+	GitHubAppTokenAction = "actions/create-github-app-token"
 )
 
 // CopyMockFilesStep returns a Step that copies mock files from a source folder to a destination folder.
@@ -19,7 +25,6 @@ const (
 // You can use GitHub Actions expressions in destFolder, e.g., "${{ github.workspace }}/plugins/my-plugin/dist".
 func CopyMockFilesStep(sourceFolder string, destFolder string) Step {
 	return Step{
-		Name: "Copy mock files",
 		Run: Commands{
 			"set -x",
 			"mkdir -p " + destFolder,
@@ -33,10 +38,9 @@ func CopyMockFilesStep(sourceFolder string, destFolder string) Step {
 
 // NoOpStep returns a Step that does nothing (no-op) for testing purposes.
 // The step simply echoes a message indicating it is a no-op step.
-func NoOpStep(id string) Step {
+func NoOpStep(originalStep Step) Step {
 	return Step{
-		Name:  id + " (no-opp'ed for testing)",
-		ID:    id,
+		Name:  originalStep.nameOrID() + " (no-op'd for testing)",
 		Run:   "echo 'noop-ed step for testing'",
 		Shell: "bash",
 	}
@@ -90,3 +94,159 @@ func MockGCSUploadStep(originalStep Step) (Step, error) {
 func LocalMockdataPath(parts ...string) string {
 	return filepath.Join("tests", "act", "mockdata", filepath.Join(parts...))
 }
+
+// VaultSecrets allows defining the secret values that the mocked get-vault-secrets step should return.
+// The keys in the maps must match the secret reference used in the workflow step inputs
+// (the value on the right side of the equals sign).
+//
+// Example:
+//
+//	If the workflow has:
+//	  common_secrets: |
+//	    MY_SECRET=secret/path:key
+//
+//	Then the VaultSecrets should have:
+//	  CommonSecrets: map[string]string{
+//	    "secret/path:key": "mock-value",
+//	  }
+type VaultSecrets struct {
+	// CommonSecrets contains secrets that are referenced in the 'common_secrets' input.
+	CommonSecrets map[string]string
+	// RepoSecrets contains secrets that are referenced in the 'repo_secrets' input.
+	RepoSecrets map[string]string
+
+	// DefaultValue is the default value to use for secrets that are not defined in CommonSecrets or RepoSecrets.
+	// If nil, the step will fail to be constructed if a secret is not defined.
+	// If not nil, this value will be used for secrets that are not defined.
+	DefaultValue *string
+}
+
+// MockVaultSecretsStep returns a Step that mocks the grafana/shared-workflows/actions/get-vault-secrets action.
+// Instead of actually fetching secrets from Vault, it outputs the provided secrets in the expected format.
+// The originalStep parameter is the original Vault secrets step to be mocked.
+// The original step must use the `grafana/shared-workflows/actions/get-vault-secrets` action.
+// If those conditions are not met, an error is returned.
+//
+// The mocked step mimics the behavior of the original step, but instead of fetching secrets from Vault,
+// it outputs the provided secrets in the expected format.
+// If export_env is true, the secrets are exported as environment variables.
+// If export_env is false, the secrets are exported as a JSON object.
+//
+// If a secret is not found in the provided VaultSecrets:
+//   - If DefaultValue is nil, an error is returned.
+//   - If DefaultValue is not nil, the DefaultValue is used.
+func MockVaultSecretsStep(originalStep Step, secrets VaultSecrets) (Step, error) {
+	// Make sure the original step is indeed a Vault secrets step
+	if !strings.HasPrefix(originalStep.Uses, VaultSecretsAction) {
+		return Step{}, fmt.Errorf("cannot mock vault secrets for a step that uses %q action, must be %q", originalStep.Uses, VaultSecretsAction)
+	}
+
+	// Extract original inputs with safe type assertions and defaults
+	var commonSecretsInput, repoSecretsInput string
+	if v, ok := originalStep.With["common_secrets"].(string); ok {
+		commonSecretsInput = v
+	}
+	if v, ok := originalStep.With["repo_secrets"].(string); ok {
+		repoSecretsInput = v
+	}
+	exportEnvInput := true
+	if v, ok := originalStep.With["export_env"].(bool); ok {
+		exportEnvInput = v
+	}
+	output := map[string]string{}
+	for _, s := range []struct {
+		input   string
+		secrets map[string]string
+	}{
+		{commonSecretsInput, secrets.CommonSecrets},
+		{repoSecretsInput, secrets.RepoSecrets},
+	} {
+		for i, line := range strings.Split(s.input, "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" {
+				continue
+			}
+			parts := strings.Split(line, "=")
+			if len(parts) != 2 {
+				return Step{}, fmt.Errorf("invalid input, not enough parts on line %d: %s", i, line)
+			}
+			outputName := strings.TrimSpace(parts[0])
+			secretReference := strings.TrimSpace(parts[1])
+			secretValue, ok := s.secrets[secretReference]
+			if !ok && secrets.DefaultValue == nil {
+				return Step{}, fmt.Errorf("secret reference %q not found in provided fake secrets %+v", secretReference, secrets)
+			}
+			if !ok {
+				secretValue = *secrets.DefaultValue
+			}
+			output[outputName] = secretValue
+		}
+	}
+
+	step := Step{
+		Env:   map[string]string{},
+		Shell: "bash",
+	}
+	var stepCommands Commands
+	if exportEnvInput {
+		// Workflow-level env vars output
+		for k, v := range output {
+			stepCommands = append(stepCommands, fmt.Sprintf(`echo "%s=%s" >> "$GITHUB_ENV"`, k, v))
+		}
+	} else {
+		// JSON output
+		secretsJSON, err := json.Marshal(output)
+		if err != nil {
+			return Step{}, fmt.Errorf("marshal vault secrets to json: %w", err)
+		}
+		stepCommands = append(stepCommands, `echo "secrets=${SECRETS_JSON}" >> "$GITHUB_OUTPUT"`)
+		step.Env = map[string]string{"SECRETS_JSON": string(secretsJSON)}
+	}
+	step.Run = stepCommands.String()
+	return step, nil
+}
+
+// MockArgoWorkflowStep returns a Step that mocks the grafana/shared-workflows/actions/trigger-argo-workflow action.
+// Instead of actually triggering an Argo Workflow, it outputs a mock URI for the workflow.
+// The originalStep parameter is the original Argo Workflow trigger step to be mocked.
+// The original step must use the `grafana/shared-workflows/actions/trigger-argo-workflow` action.
+// If those conditions are not met, an error is returned.
+//
+// The mocked step outputs the `uri` output expected by subsequent steps.
+func MockArgoWorkflowStep(originalStep Step) (Step, error) {
+	// Make sure the original step is indeed an Argo Workflow trigger step
+	if !strings.HasPrefix(originalStep.Uses, ArgoWorkflowAction) {
+		return Step{}, fmt.Errorf("cannot mock argo workflow for a step that uses %q action, must be %q", originalStep.Uses, ArgoWorkflowAction)
+	}
+
+	return Step{
+		Run: Commands{
+			`echo "Mocking Argo Workflow trigger step"`,
+			`echo "uri=https://mock-argo-workflows.example.com/workflows/grafana-plugins-cd/mock-workflow-id" >> "$GITHUB_OUTPUT"`,
+		}.String(),
+		Shell: "bash",
+	}, nil
+}
+
+// MockGitHubAppTokenStep returns a Step that mocks the actions/create-github-app-token action.
+// Instead of actually creating a GitHub app token, it outputs a mock token.
+// The originalStep parameter is the original GitHub app token step to be mocked.
+// The original step must use the `actions/create-github-app-token` action.
+// If those conditions are not met, an error is returned.
+//
+// The mocked step outputs the `token` output expected by subsequent steps.
+func MockGitHubAppTokenStep(originalStep Step, token string) (Step, error) {
+	if !strings.HasPrefix(originalStep.Uses, GitHubAppTokenAction) {
+		return Step{}, fmt.Errorf("cannot mock github app token for a step that uses %q action, must be %q", originalStep.Uses, GitHubAppTokenAction)
+	}
+	return Step{
+		Run: Commands{
+			`echo "Mocking GitHub app token step"`,
+			`echo "token=${MOCK_TOKEN}" >> "$GITHUB_OUTPUT"`,
+		}.String(),
+		Shell: "bash",
+		Env: map[string]string{
+			"MOCK_TOKEN": token,
+		},
+	}, nil
+}

tests/act/internal/workflow/mock_test.go

@@ -0,0 +1,139 @@
+package workflow
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMockVaultSecretsStep(t *testing.T) {
+	const (
+		vaultAction = "grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593"
+		bashOutput  = `echo "secrets=${SECRETS_JSON}" >> "$GITHUB_OUTPUT"`
+	)
+	vault := VaultSecrets{
+		CommonSecrets: map[string]string{
+			"common_secret_1:a": "value1",
+			"common_secret_2:b": "value2",
+		},
+		RepoSecrets: map[string]string{
+			"repo_secret_1:c": "value3",
+			"repo_secret_2:d": "value4",
+		},
+	}
+
+	t.Run("common secrets", func(t *testing.T) {
+		step := Step{
+			Name: "Get Vault Secrets",
+			Uses: vaultAction,
+			With: map[string]any{
+				"common_secrets": strings.Join([]string{
+					"SECRET1=common_secret_1:a",
+					"SECRET2=common_secret_2:b",
+				}, "\n"),
+				"export_env": false,
+			},
+		}
+		mockedStep, err := MockVaultSecretsStep(step, vault)
+		require.NoError(t, err)
+		require.Equal(t, "Get Vault Secrets (mocked)", mockedStep.Name)
+		require.Contains(t, mockedStep.Run, bashOutput)
+		exp := `{"SECRET1":"value1","SECRET2":"value2"}`
+		require.Equal(t, exp, mockedStep.Env["SECRETS_JSON"])
+	})
+
+	t.Run("repo secrets", func(t *testing.T) {
+		step := Step{
+			Name: "Get Vault Secrets",
+			Uses: vaultAction,
+			With: map[string]any{
+				"repo_secrets": strings.Join([]string{
+					"C=repo_secret_1:c",
+					"D=repo_secret_2:d",
+				}, "\n"),
+				"export_env": false,
+			},
+		}
+		mockedStep, err := MockVaultSecretsStep(step, vault)
+		require.NoError(t, err)
+		require.Equal(t, "Get Vault Secrets (mocked)", mockedStep.Name)
+		require.Contains(t, mockedStep.Run, bashOutput)
+		exp := `{"C":"value3","D":"value4"}`
+		require.Equal(t, exp, mockedStep.Env["SECRETS_JSON"])
+	})
+
+	t.Run("common + repo secrets", func(t *testing.T) {
+		step := Step{
+			Name: "Get Vault Secrets",
+			Uses: vaultAction,
+			With: map[string]any{
+				"common_secrets": strings.Join([]string{
+					"SECRET1=common_secret_1:a",
+					"SECRET2=common_secret_2:b",
+				}, "\n"),
+				"repo_secrets": strings.Join([]string{
+					"C=repo_secret_1:c",
+					"D=repo_secret_2:d",
+				}, "\n"),
+				"export_env": false,
+			},
+		}
+		mockedStep, err := MockVaultSecretsStep(step, vault)
+		require.NoError(t, err)
+		require.Equal(t, "Get Vault Secrets (mocked)", mockedStep.Name)
+		require.Contains(t, mockedStep.Run, bashOutput)
+		exp := `{"C":"value3","D":"value4","SECRET1":"value1","SECRET2":"value2"}`
+		require.Equal(t, exp, mockedStep.Env["SECRETS_JSON"])
+	})
+
+	t.Run("unexisting secret", func(t *testing.T) {
+		step := Step{
+			Name: "Get Vault Secrets",
+			Uses: vaultAction,
+			With: map[string]any{
+				"common_secrets": strings.Join([]string{
+					"SECRET1=this_secret_does_not_exist:a",
+				}, "\n"),
+				"export_env": false,
+			},
+		}
+		_, err := MockVaultSecretsStep(step, vault)
+		require.ErrorContains(t, err, "this_secret_does_not_exist")
+		require.ErrorContains(t, err, "not found in provided fake secrets")
+	})
+
+	t.Run("unexisting secret with default value", func(t *testing.T) {
+		step := Step{
+			Name: "Get Vault Secrets",
+			Uses: vaultAction,
+			With: map[string]any{
+				"common_secrets": strings.Join([]string{
+					"SECRET1=a:b",
+					"SECRET2=this_secret_does_not_exist:a",
+				}, "\n"),
+				"export_env": false,
+			},
+		}
+		defaultValue := "foo"
+		mockedStep, err := MockVaultSecretsStep(step, VaultSecrets{
+			CommonSecrets: map[string]string{
+				"a:b": "c",
+			},
+			DefaultValue: &defaultValue,
+		})
+		require.NoError(t, err)
+		require.Equal(t, `{"SECRET1":"c","SECRET2":"foo"}`, mockedStep.Env["SECRETS_JSON"])
+	})
+}
+
+func TestMockArgoWorkflowStep(t *testing.T) {
+	step := Step{
+		Name: "Trigger Argo Workflow",
+		Uses: "grafana/shared-workflows/actions/trigger-argo-workflow@e100806688f1209051080dfea5719fbbd1d18cc0",
+	}
+	mockedStep, err := MockArgoWorkflowStep(step)
+	require.NoError(t, err)
+	require.Equal(t, "Trigger Argo Workflow (mocked)", mockedStep.Name)
+	require.Contains(t, mockedStep.Run, `echo "uri=https://mock-argo-workflows.example.com/workflows/grafana-plugins-cd/mock-workflow-id" >> "$GITHUB_OUTPUT"`)
+}