tests.yml

name: Tests

on:
  push:
    branches:
      - master
  pull_request:

defaults:
  run:
    shell: bash

jobs:
  test-check:
    name: tfsec (github-check)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: ./
        continue-on-error: true
        id: test
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-check
          level: info
          working_directory: testdata

      # The check is expected to fail on the test data
      - name: Check return codes
        if: success() || failure ()
        run: |
          tfsec_return="${{ steps.test.outputs.tfsec-return-code }}"
          reviewdog_return="${{ steps.test.outputs.reviewdog-return-code }}"

          if [[ "$tfsec_return" -eq 1 ]]; then
            echo "tfsec correctly returned failure ${tfsec_return}"
          else
            echo "tfsec returned ${tfsec_return}, expected '1'. Failing..."
            exit 1
          fi

          if [[ "$reviewdog_return" -eq 0 ]]; then
            echo "reviewdog correctly returned success: ${reviewdog_return}"
          else
            echo "reviewdog returned ${reviewdog_return}, expected '0'. Failing..."
            exit 1
          fi

  test-pr-check:
    if: github.event_name == 'pull_request'
    name: tfsec (github-pr-check)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: ./
        continue-on-error: true
        id: test
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-check
          level: info
          working_directory: testdata

      # The check is expected to fail on the test data
      - name: Check return codes
        if: success() || failure ()
        run: |
          tfsec_return="${{ steps.test.outputs.tfsec-return-code }}"
          reviewdog_return="${{ steps.test.outputs.reviewdog-return-code }}"

          if [[ "$tfsec_return" -eq 1 ]]; then
            echo "tfsec correctly returned failure ${tfsec_return}"
          else
            echo "tfsec returned ${tfsec_return}, expected '1'. Failing..."
            exit 1
          fi

          if [[ "$reviewdog_return" -eq 0 ]]; then
            echo "reviewdog correctly returned success: ${reviewdog_return}"
          else
            echo "reviewdog returned ${reviewdog_return}, expected '0'. Failing..."
            exit 1
          fi

  test-pr-review:
    if: github.event_name == 'pull_request'
    name: tfsec (github-pr-review)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: ./
        continue-on-error: true
        id: test
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-review
          level: info
          working_directory: testdata

      # The check is expected to fail on the test data
      #  but for forked PRs reviewdog will just output
      #  on the PR and report success
      - name: Check return codes
        if: success() || failure ()
        run: |
          tfsec_return="${{ steps.test.outputs.tfsec-return-code }}"
          reviewdog_return="${{ steps.test.outputs.reviewdog-return-code }}"

          if [[ "$tfsec_return" -eq 1 ]]; then
            echo "tfsec correctly returned failure ${tfsec_return}"
          else
            echo "tfsec returned ${tfsec_return}, expected '1'. Failing..."
            exit 1
          fi

          if [[ "$reviewdog_return" -eq 0 ]]; then
            echo "reviewdog correctly returned success: ${reviewdog_return}"
          else
            echo "reviewdog returned ${reviewdog_return}, expected '0'. Failing..."
            exit 1
          fi

  test-operating-systems:
    strategy:
      fail-fast: false
      matrix:
        platform: [ubuntu-latest, macos-latest, windows-latest]
    name: tfsec (${{ matrix.platform }})
    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@v4

      - uses: ./
        continue-on-error: true
        id: test
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-check
          level: info
          working_directory: testdata

      # The check is expected to fail on the test data
      - name: Check return codes
        if: success() || failure ()
        run: |
          tfsec_return="${{ steps.test.outputs.tfsec-return-code }}"
          reviewdog_return="${{ steps.test.outputs.reviewdog-return-code }}"

          if [[ "$tfsec_return" -eq 1 ]]; then
            echo "tfsec correctly returned failure ${tfsec_return}"
          else
            echo "tfsec returned ${tfsec_return}, expected '1'. Failing..."
            exit 1
          fi

          if [[ "$reviewdog_return" -eq 0 ]]; then
            echo "reviewdog correctly returned success: ${reviewdog_return}"
          else
            echo "reviewdog returned ${reviewdog_return}, expected '0'. Failing..."
            exit 1
          fi