test: call venom tests in github-action CI

Signed-off-by: Pierre-Henri Symoneaux <[email protected]>
ovh · Nov 19, 2024 · e1a9e96 · e1a9e96
1 parent 298e2f6
commit e1a9e96
Show file tree

Hide file tree

Showing 17 changed files with 314 additions and 8 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -4,8 +4,6 @@
 name: build
 
 on:
-  push:
-    branches: ["main"]
   workflow_call: {}
 
 jobs:

diff --git a/.github/workflows/main-branch.yaml b/.github/workflows/main-branch.yaml
@@ -0,0 +1,23 @@
+name: release
+
+on:
+  push:
+    # run only against tags
+    branches: 
+      - main
+
+permissions:
+  contents: write
+  packages: write
+  # issues: write
+
+jobs:
+  build:
+    uses: ./.github/workflows/build.yaml
+    secrets: inherit
+
+  integration-tests:
+    needs: build
+    uses: ./.github/workflows/test.yaml
+    secrets: inherit
+
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
@@ -28,4 +28,9 @@ jobs:
     needs:
       - commitlint
     uses: ./.github/workflows/build.yaml
+    secrets: inherit
+
+  test:
+    needs: build
+    uses: ./.github/workflows/test.yaml
     secrets: inherit
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -15,9 +15,14 @@ jobs:
   build:
     uses: ./.github/workflows/build.yaml
     secrets: inherit
+
+  integration-tests:
+    needs: build
+    uses: ./.github/workflows/test.yaml
+    secrets: inherit
 
   docker-build:
-    needs: build
+    needs: integration-tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -37,7 +42,7 @@ jobs:
       - run: KO_DOCKER_REPO=ghcr.io/ovh/okms-cli ko build --tags ${{ github.ref_name }},latest --push --bare --platform=linux/arm64,linux/amd64 ./cmd/okms
 
   goreleaser:
-    needs: build
+    needs: integration-tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -0,0 +1,56 @@
+name: test
+
+on:
+  workflow_call: {}
+
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-build-env
+      - name: Build CLI
+        run: go build -cover ./cmd/okms
+      - name: Setup Venom
+        run: |
+          wget https://github.com/ovh/venom/releases/download/v1.2.0/venom.linux-amd64
+          mv venom.linux-amd64 venom
+          chmod +x venom
+      - name: Setup okms config file
+        run: |
+          echo "${{secrets.CERTIFICATE}}" > tls.crt
+          echo "${{secrets.PRIVATE_KEY}}" > tls.key
+
+          cat > okms.yaml <<-EOF
+          version: 1
+          profile: default
+          profiles:
+            default: # default profile
+              http:
+                endpoint: ${{secrets.KMS_HTTP_ENDPOINT}}
+                auth:
+                  type: mtls
+                  cert: $(pwd)/tls.crt
+                  key: $(pwd)/tls.key
+          EOF
+      - name: Test connectivity to KMS dmain
+        run: ./okms keys ls -d -c okms.yaml
+      - name: Execute tests
+        run: make -C tests
+      - uses: actions/upload-artifact@v4
+        with:
+          name: test_results
+          path: |
+            ./tests/out/test_results.html
+            ./tests/out/venom.log
+          retention-days: 5
+        if: always()
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: |
+            ./tests/out/coverage.txt
+            ./tests/out/coverage.html
+          retention-days: 5
+
diff --git a/README.md b/README.md
@@ -1,5 +1,5 @@
 # okms-cli
-[![build](https://github.com/ovh/okms-cli/actions/workflows/build.yaml/badge.svg?branch=main)](https://github.com/ovh/okms-cli/actions/workflows/build.yaml)
+[![build](https://github.com/ovh/okms-cli/actions/workflows/main-branch.yaml/badge.svg?branch=main)](https://github.com/ovh/okms-cli/actions/workflows/main-branch.yaml)
 [![license](https://img.shields.io/badge/license-Apache%202.0-red.svg?style=flat)](https://raw.githubusercontent.com/ovh/okms-sdk-go/master/LICENSE) [![Go Report Card](https://goreportcard.com/badge/github.com/ovh/okms-cli)](https://goreportcard.com/report/github.com/ovh/okms-cli)
 
 The CLI to interact with your [OVHcloud KMS](https://help.ovhcloud.com/csm/en-ie-kms-quick-start?id=kb_article_view&sysparm_article=KB0063362) services.

diff --git a/tests/Makefile b/tests/Makefile
@@ -0,0 +1,6 @@
+test:
+	rm -Rf out
+	../venom run --html-report --output-dir=out --var-from-file cfg/vars.yaml -v .
+	go tool covdata percent -i out/coverage
+	go tool covdata textfmt -i out/coverage -o out/coverage.txt
+	go tool cover -html out/coverage.txt -o out/coverage.html
diff --git a/tests/keys.yaml b/tests/keys.yaml
@@ -54,6 +54,73 @@ testcases:
           - result.code ShouldEqual 0
           - result.systemoutjson.objects_list ShouldJSONContainWithKey id {{ .value.keyId }}
 
+  - name: Update key
+    steps:
+      - name: Check AES key current name
+        type: okms-cmd
+        args: keys get {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+          - result.systemoutjson.name ShouldEqual "test-aes-1"
+      - name: Update AES key name
+        type: okms-cmd
+        args: keys update {{ .Create-Keys.aesKeyId }} --name test-aes-1-updated
+      - name: Check AES key new name
+        type: okms-cmd
+        args: keys get {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+          - result.systemoutjson.name ShouldEqual "test-aes-1-updated"
+
+  - name: Activate and Deactivate
+    steps:
+      - name: Check AES key is active
+        type: okms-cmd
+        args: keys get {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+          - result.systemoutjson.attributes.state ShouldEqual "active"
+      - name: Try activate AES key
+        type: okms-cmd
+        args: keys activate {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+      - name: Deactivate AES key
+        type: okms-cmd
+        args: keys deactivate {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+      - name: Check AES key is deactivated
+        type: okms-cmd
+        args: keys get {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+          - result.systemoutjson.attributes.state ShouldEqual "deactivated"
+      - name: Compromise AES key
+        type: okms-cmd
+        args: keys deactivate {{ .Create-Keys.aesKeyId }} --reason key_compromise
+        assertions:
+          - result.code ShouldEqual 0
+      - name: Check AES key is compromised
+        type: okms-cmd
+        args: keys get {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+          - result.systemoutjson.attributes.state ShouldEqual "compromised"
+          - result.systemoutjson.attributes.compromise_date ShouldNotBeNil
+      - name: Reactivate AES key
+        type: okms-cmd
+        args: keys activate {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+      - name: Check AES key is active
+        type: okms-cmd
+        args: keys get {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+          - result.systemoutjson.attributes.state ShouldEqual "active"
+          - result.systemoutjson.attributes.compromise_date ShouldBeNil
+
   - name: AES Encryption
     steps:
       - name: Encrypt data
@@ -281,6 +348,9 @@ testcases:
         args: keys import --usage encrypt,decrypt --symmetric test-import-aes YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=
         assertions:
           - result.code ShouldEqual 0
+        vars:
+          toDeleteAesKeyId:
+            from: result.systemoutjson.id
       - name: Import RSA PKCS1 key
         type: okms-cmd
         args: keys import --usage sign,verify test-import-rsa-pkcs1 @testdata/rsa_pkcs1.priv.pem
@@ -315,15 +385,45 @@ testcases:
 
   - name: Delete the keys
     steps:
+      - name: Try delete active AES key
+        type: okms-cmd
+        args: keys delete {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 1
+      - name: Deactivate AES key
+        type: okms-cmd
+        args: keys deactivate {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
+      - name: Delete deactivated AES key
+        type: okms-cmd
+        args: keys delete {{ .Create-Keys.aesKeyId }}
+        assertions:
+          - result.code ShouldEqual 0
       - name: Force delete the {{ .value.kind }} key
         type: okms-cmd
         range:
-          - keyId: "{{ .Create-Keys.aesKeyId }}"
-            kind: AES
           - keyId: "{{ .Create-Keys.rsaKeyId }}"
             kind: RSA
           - keyId: "{{ .Create-Keys.ecKeyId }}"
             kind: ECDSA
         args: keys delete {{ .value.keyId }} --force
         assertions:
           - result.code ShouldEqual 0
+
+  - name: Cleanup Domain
+    steps:
+      - name: List all keys
+        type: okms-cmd
+        args: keys ls
+        assertions:
+          - result.code ShouldEqual 0
+        vars:
+          allKeys:
+            from: result.systemoutjson.objects_list
+      - name: Force delete {{ .value.type }} key {{ .value.name }}
+        type: okms-cmd
+        range: "{{.allKeys}}"
+        args: keys delete {{ .value.id }} --force
+        assertions:
+          - result.code ShouldEqual 0
diff --git a/tests/lib/okms-cmd.yml b/tests/lib/okms-cmd.yml
@@ -4,7 +4,6 @@ input:
   format: json
 steps:
   - script: mkdir -p ./out/coverage && GOCOVERDIR=./out/coverage {{ .cmd_path }} -c {{ .cfg_path }} --output {{ .input.format }} {{ .input.args }}
-    # info: "{{ .cmd_path }} -c {{ .cfg_path }} --output {{ .input.format }} {{ .input.args }}"
     vars:
       code:
         from: result.code

diff --git a/tests/testdata/ecdsa_pkcs8.priv.pem b/tests/testdata/ecdsa_pkcs8.priv.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgKksp+sxRTdMBUnSK
+KLCLQX28FV3zjUmrvs10gK1ZFnuhRANCAASmwId0fcOWQ6DnskzMDVquh5FEqLeV
+6SW9kHs7FOW7t2u82fmkDl0z/X3L2D2IZ/aaGpOg3qQAKkvgYCO26HGm
+-----END PRIVATE KEY-----
diff --git a/tests/testdata/ecdsa_sec1.priv.pem b/tests/testdata/ecdsa_sec1.priv.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICpLKfrMUU3TAVJ0iiiwi0F9vBVd841Jq77NdICtWRZ7oAoGCCqGSM49
+AwEHoUQDQgAEpsCHdH3DlkOg57JMzA1aroeRRKi3leklvZB7OxTlu7drvNn5pA5d
+M/19y9g9iGf2mhqToN6kACpL4GAjtuhxpg==
+-----END EC PRIVATE KEY-----
diff --git a/tests/testdata/ecdsa_ssh.priv.pem b/tests/testdata/ecdsa_ssh.priv.pem
@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSlsnz7VFcaNPliN2lduCBW01hecfUL
+zjqE83PaNl29sSQe08TZEa2C94Mw851NGvwSSmGWk5m6ky+nZnnoLoYMAAAAsHvkvOJ75L
+ziAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKWyfPtUVxo0+WI3
+aV24IFbTWF5x9QvOOoTzc9o2Xb2xJB7TxNkRrYL3gzDznU0a/BJKYZaTmbqTL6dmeeguhg
+wAAAAgUDmUuoD7DVc+Dr70WqNZgPj++GDr5nnowfXzt7vpG7IAAAAVcHN5bW9uZWFAQzAy
+RkwwOE5NTDdMAQID
+-----END OPENSSH PRIVATE KEY-----
diff --git a/tests/testdata/ecdsa_ssh.pub.pem b/tests/testdata/ecdsa_ssh.pub.pem
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKWyfPtUVxo0+WI3aV24IFbTWF5x9QvOOoTzc9o2Xb2xJB7TxNkRrYL3gzDznU0a/BJKYZaTmbqTL6dmeeguhgw= psymonea@C02FL08NML7L
diff --git a/tests/testdata/rsa_pkcs1.priv.pem b/tests/testdata/rsa_pkcs1.priv.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAqDzr5t25wAd9qDnEEqwfLdGV5jTLbFRTQIP2rKIzqXGIqVnV
+ZWZwj1LOpJGVnzCCHQi60uHScouT0wLuqBXF7iGcw+STb2fWNXNUzohF1Dewp2MP
+rIK5OImF5TFzYwMdfK5W5EMSF4BpZ3P++yWsa4TPh5caN22fGBJpc8qYuDXqfB1C
+I6E7Fsz7TK2dBBGi665szd6iUReqcTI+yJH+QRVvUrwDE2RoKcMTFahZsZ5Zv+W1
+QaDcPq4lx4FEaWdBdVCp/qzZOfyNjjc9WNh5xTi/O4nXeLXFel66sTlnKp45dqmt
+fhZx8ttvZv4WxHdajcEYj9EdPWDK4gUfasog5wIDAQABAoIBAEslUxV+6k4symLO
+0paojRCxMexunoJXtAv4JcF8fejsjmdeeePd+t751NVLNfKx/xwq3w/80Dxbvf6d
+q64mc49nMheJzJURY2vihPnvgolFCsHpjIG4rjTjsIvsJ6cNKCmd0bAJiVY4BFyy
+Qi056abo3q2ov4wMieh9qN6QmuCEcsK9if0fcNqnkP8eLtjsV7hbgDQJzXgLAPDj
+VXoSg0lbZh0LOHDppr8KCgFn/g74OhuCxbqurEa6IttLAoRZKEu2uNhIYsl53MPp
+q2186OIj+5CMPS0W8PuJ9ipr4ObHZyg3759CGumSqAjx/UQdtV1IL+6JnqWakqL2
+vMKlyhkCgYEA3yvNJijkeS6kXUeANmD/kx/4fB/OWCZIry88WWF/VUwRTR4OT4cm
+L8gSJea7i2HUw4h+B8gzgelDZMnxVNS1jRjDwenoWJ8qwrs+GcAzUe/UZPVHvkq9
+CgyQXtKmUhC2stD/SZe85sjkU+iF8YBR7bFPbQK0PFYx9xQNkH4g+a0CgYEAwPxx
+eY6Cz8Iu3UuBUhxmj8ARnt0CFT4EiZ9o9E0OSv/IyL8jqXRimn9Up6VV+yhevIyX
+94Q3HXjOMyozAGvLoOwEKSnOgZ7T8QZ/GJEutx2PHpnUYfsiZxXffBMrC8Xi0lK7
+xLnClNkF3TR79OdroMOp8+c13LQQoLx9oCP4P2MCgYB4pg9kP9s0gDivjQYNX+cL
+PM9zGybMlPXab2jq0UCrdlIsJMGL0P6d+kWFY/Wj5qHFi7bGsj7WTqr2hA4J1GzJ
++Mdrv+6yamoNmHh8J2IXO9bRNaExiOol0qECAlOULiD3DvHUcUnYYma9zgkLhFnG
+bIMJ5dpWfCrK7nZe1TEyiQKBgQCPkwAFFE4jrO7aulLCuNhgt98kFn53OUV88bjO
+kAlDKNrC5tjsN+cn0/UyKCI4kYcxtVNV1OqAJaEalZmOBaRf21cZHL5C1twM4+1o
+ZJKhrv8MIBvOrVyh3rb+gvAyeQ1Ptjd1m1G1FWR0dpiF0inTV94309rRkLESNEkt
++7SzywKBgE6nJbK8YL30kyxqyz0pWB6CSfQEVCD+4nVpBlYrmiNpGDnfJOKW8tCW
+DexYna2ADOk54TU6kaRegPGKH1+FF6HMn20lUjqtQpu2mV3vbvVMcyj7ubz+Mc3H
+qE/XihloiUusYkcPi3+Ksrd/vatIBBFkTVH1TD16js7qK0GHzfo3
+-----END RSA PRIVATE KEY-----
diff --git a/tests/testdata/rsa_pkcs8.priv.pem b/tests/testdata/rsa_pkcs8.priv.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCxOpNU1lFtNH3s
+3w1SUubV0s8bLJqYHX4NEGjJPmY8Htiy4aI2qmf2emM+mbUALyTY8vGajmnpcDH9
+KcEAY2b/yV9F53Z5C8Z4FCyWiYXKutO9vP+xTX75IGjfzMrOAJAGqCaYvIA3j/3+
+xpSy1FeEgrjGKiSt8i9SSYogbk2B4EqKQZJfzK9/bbPVTwJRbLqC9pqc0ZZLnp5a
+mVSTIrlqmzHEMHdUB6zY1YUflEvGSvjhirUwrc8xBO4heqGb2ptUAND/6oVUwEfw
+j7xKt2uG93yFMNyBNsAqz088dN+t1Ybsj4bRBhITKShlkzwl6BpsSAlx/NicjxMD
+6E/x1GARAgMBAAECggEAAKuwEwoclMU2FMdjTYRyyyxZDElG7HxwFaySOPC7gk67
+kzG3Y22RpyUfawU54h5LjWad82/GhtOd3M9jo5S8twsUCTevAxZAUgQBhzBOCU5b
+rsQgU5Nvf5HX08D6o3ztDplkS/+qnIs28tfdiC+1hRLZkCZorR/VfgI5O5YvROaK
+xCHVyZwGJb2cwVqd9Wbfo99/1CUejxAzXABzBA3lrBdXol2Mq/SAgKYm9xBnywIY
+G/wOSqIgZSooN6SZib8M5IkAmw2eRyLld0DKPnMQA8qYn0gqo+U8zzo55eS/SnCk
+ZWx0vBYFHyCgqafG3wgPXR8t7UDrHq0QCcr5xa3i4QKBgQDjDMVHXTqnrC3wAZLI
+vuunq4YJOR4fE+OpndLAWy02GsTZe5D5tXIiRXVXSUJe4Ffr6BCf1fIyAeAyZTY1
+JnLlcHCu3hpjNhLTzyDlSVd5ZsRFAm5FxbyEo6lLXHyzaA0HUEA2KxR3BTcITNAV
+YIhwCtdyFJOOyl86I1VX2SY1bwKBgQDH05MV5+0exxwn/axrGec5S/DgNU2T7rAy
+dseX0+t5AFag1+rOpaF0vg3/KYzpX99RBbGKUgsRh1j78RnqCXFfm2nLXXPrqdpA
+XQoyoQ7zTw2g7Uz95OTcFIfzPDTiyfs/iun9ghFkMU0uQZlRSpsg5xKbDAXOXmK5
+BsDWY1sCfwKBgCFwXA2qmVzgatOSJ8AQ/jvvcwogs2L4VutAJy3VP89cGem93Rgp
+tOl/OUzlqTS37br8rpYbuFPNGuvRJC6nvvwzlyTp6RD7gcJYGwwpxQxIKlfPh9YW
+zTDruZ8zu9ngVSriktJnfdgZmIVMasj7Mpztu9U9Wo4JGAVD9um9PXdZAoGBAIel
+kAsmzUg/UVW0Vf6+LsAuVO1eQbNSLDmVeBgQu6AAIs48xCBTPy7IdSfpRMaHVkjh
+3ItQ9kKH5lfgav78OgH0tfRfE/m963IVtn535nY0C8RaUhFn+BONvFvZWu04v117
+Jyv3x2aEMShdT35nbrb/JRorJyXX3JxNgUoHWBhxAoGAXBsrEEif9jF02GDpnDsv
+WSheFEFl+iC4g8Pwj0J/PvIMddFZ5tDUYX3IapYT2hXOrwTTy5E3QwPBpxk1eKDp
+Dn6xoM6+dlHPPWA6l48GJK8nmEpgmqemJXwIQ8ODZi2TDE3kWvnZiR3SuP+UJEdS
+aZYApzOejZbQzdygUp7Xeg4=
+-----END PRIVATE KEY-----