setup-gcloud-it.yml

name: setup-gcloud Integration

on:
  push:
    branches:
      - 'main'
  pull_request:
    branches:
      - 'main'
  workflow_dispatch:

concurrency:
  group: '${{github.workflow}}-${{ github.head_ref || github.ref }}'
  cancel-in-progress: true

jobs:
  versioned:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: setup-gcloud versioned
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: ${{ matrix.os }}

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: setup-gcloud
        uses: ./
        with:
          version: '374.0.0'

      - name: Integration Tests
        shell: bash
        run: ./tests/integration-tests.sh

  latest:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: setup-gcloud latest
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: ${{ matrix.os }}

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - name: Build dependency
        run: |-
          npm ci
          npm run build

      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: setup-gcloud
        uses: ./
        with:
          version: 'latest'

      - name: Integration Tests
        shell: bash
        run: ./tests/integration-tests.sh

  project_id:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: setup-gcloud with configured project
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: ${{ matrix.os }}

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3
      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: setup-gcloud
        uses: ./
        with:
          project_id: ${{ secrets.SETUP_GCLOUD_IT_PROJECT_ID }}

      - name: Verify project
        shell: bash
        run: gcloud config get-value project | grep ${{ secrets.SETUP_GCLOUD_IT_PROJECT_ID }}

  components:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: setup-gcloud with components
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: ${{ matrix.os }}

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3
      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: setup-gcloud
        uses: ./
        with:
          project_id: ${{ secrets.SETUP_GCLOUD_IT_PROJECT_ID }}
          install_components: alpha, beta

      - name: Verify install
        shell: bash
        run: |-
          gcloud components list
          if [[ $(gcloud components list --filter=name:alpha --format="value(Status)" | grep Not) -eq 1 ]]; then
            exit 1;
          fi
          if [[ $(gcloud components list --filter=name:beta --format="value(Status)" | grep Not) -eq 1 ]]; then
            exit 1;
          fi

  # This test ensures that the GOOGLE_APPLICATION_CREDENTIALS environment
  # variable is shared with the container and that the path of the file is on
  # the shared filesystem with the container and that the USER for the container
  # has permissions to read the file.
  docker:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: 'setup-gcloud with docker-based steps'
    runs-on: 'ubuntu-latest'
    strategy:
      fail-fast: false

    permissions:
      id-token: 'write'

    steps:
      - uses: 'actions/checkout@v3'

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - name: 'npm ci'
        run: 'npm ci'

      - name: 'npm build'
        run: 'npm run build'

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: 'setup-gcloud'
        uses: './'

      - name: 'docker'
        uses: 'docker://alpine:3'
        with:
          entrypoint: '/bin/sh'
          args: '-euc "test -n "${GOOGLE_APPLICATION_CREDENTIALS}" && test -r "${GOOGLE_APPLICATION_CREDENTIALS}"'

  wif:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: 'with wif'
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: '${{ matrix.os }}'

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: 'setup-gcloud'
        uses: './'

      - id: 'gcloud'
        shell: 'bash'
        run: |-
          gcloud secrets versions access "latest" --secret "${{ secrets.OIDC_AUTH_TEST_SECRET_NAME }}"

  credentials_json:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: 'with key and auth action'
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: '${{ matrix.os }}'

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          credentials_json: ${{ secrets.SETUP_GCLOUD_IT_KEY }}

      - name: 'setup-gcloud'
        uses: './'

      - id: 'gcloud'
        shell: 'bash'
        run: |-
          gcloud secrets versions access "latest" --secret "${{ secrets.OIDC_AUTH_TEST_SECRET_NAME }}"

  credentials_json_exported:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: 'auth action with json key and setup-gcloud export'
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: '${{ matrix.os }}'

    steps:
      - uses: 'actions/checkout@v3'

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - id: 'build'
        name: 'Build dist'
        run: 'npm ci && npm run build'

      - uses: 'google-github-actions/auth@main'
        with:
          credentials_json: '${{ secrets.SETUP_GCLOUD_IT_KEY }}'

      - name: 'setup-gcloud'
        uses: './'

      - id: 'gcloud'
        shell: 'bash'
        run: |-
          gcloud secrets versions access "latest" --secret "${{ secrets.OIDC_AUTH_TEST_SECRET_NAME }}"

  multi_credentials:
    if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
    name: 'with two setup gcloud with different SA'
    strategy:
      fail-fast: false
      matrix:
        os:
          - 'ubuntu-latest'
          - 'windows-latest'
          - 'macos-latest'
    runs-on: '${{ matrix.os }}'

    permissions:
      id-token: 'write'

    steps:
      - uses: actions/checkout@v3

      - uses: 'actions/setup-node@v3'
        with:
          node-version: '16.x'

      - id: build
        name: Build dist
        run: |-
          npm ci
          npm run build

      - uses: google-github-actions/auth@main
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER_NAME }}
          service_account: ${{ secrets.OIDC_AUTH_SA_EMAIL }}

      - name: 'setup-gcloud'
        uses: './'

      # current SA should be OIDC_AUTH_SA_EMAIL
      - name: 'check current SA'
        shell: 'bash'
        run: |-
          CURRENT_SA=$(gcloud auth list --format="value(account)" --filter="(status=ACTIVE)")
          if [ ${{ secrets.OIDC_AUTH_SA_EMAIL }} != $CURRENT_SA ]; then exit 1; fi

      - name: setup-gcloud
        uses: ./
        with:
          version: 'latest'

      # current SA should be SETUP_GCLOUD_IT_EMAIL
      - name: 'check current SA'
        shell: 'bash'
        run: |-
          CURRENT_SA=$(gcloud auth list --format="value(account)" --filter="(status=ACTIVE)")
          if [ ${{ secrets.SETUP_GCLOUD_IT_EMAIL }} != $CURRENT_SA ]; then exit 1; fi