github.com/w3security/driftctl@v0.38.0/.circleci/config.yml

version: 2.1
only_branches: &only_branches
  filters:
    branches:
      ignore:
        - main
only_maintainers: &only_maintainers
  filters:
    branches:
      # Forked pull requests have CIRCLE_BRANCH set to pull/XXX
      ignore: /pull\/[0-9]+/
orbs:
  go: circleci/go@1.7.0
  w3security: w3security/w3security@1.1.2
  gh: circleci/github-cli@1.1.0
  slack: circleci/slack@4.12.5
parameters:
  ACC_TESTS:
    type: string
    description: manually run acceptance tests
    default: "0"
commands:
  notify_slack_on_failure:
    steps:
      - slack/notify:
          channel: team-cloud-context-alerts
          event: fail
          custom: |
            {
              "blocks": [
                  {
                      "type": "header",
                      "text": {
                          "type": "plain_text",
                          "text": ":warning: Driftctl acceptance tests failed :warning:",
                          "emoji": true
                      }
                  },
                  {
                      "type": "divider"
                  },
                  {
                      "type": "section",
                      "fields": [
                          {
                              "type": "mrkdwn",
                              "text": "*Suite*: ${ACC_PATTERN}"
                          },
                          {
                              "type": "mrkdwn",
                              "text": "*Branch*: ${CIRCLE_BRANCH}"
                          }
                      ],
                      "accessory": {
                          "type": "button",
                          "text": {
                              "type": "plain_text",
                              "emoji": true,
                              "text": "View Job"
                          },
                          "url": "${CIRCLE_BUILD_URL}"
                      }
                  }
              ]
            }
jobs:
  test_acc:
    parameters:
      pattern:
        type: string
    resource_class: large
    machine:
      image: ubuntu-2004:202010-01
    environment:
      ACC_PATTERN: << parameters.pattern >>
      AWS_DEFAULT_REGION: us-east-1
      CHECKPOINT_DISABLE: "true" # Disable terraform version check
      CLOUDSDK_CORE_PROJECT: driftctl-qa-1
      GOOGLE_APPLICATION_CREDENTIALS: /tmp/google.json
      ACC_GOOGLE_CREDENTIALS: /tmp/google-admin.json
    steps:
      - checkout
      - go/install:
          version: "1.18.3"
      - go/load-cache:
          key: test_acc
      - run: make install-tools
      - run:
          name: Setup Google credentials
          command: |
            echo ${GCLOUD_KEYFILE} | base64 -d > /tmp/google.json
            echo ${ACC_GCLOUD_KEYFILE} | base64 -d > /tmp/google-admin.json
      - run:
          name: Run acceptance tests
          command: make acc
          no_output_timeout: 30m
      - notify_slack_on_failure
      - go/save-cache:
          key: test_acc
          path: /home/circleci/.go_workspace/pkg/mod
      - store_test_results:
          path: ./
  lint:
    docker:
      - image: golang:1.18
    steps:
      - checkout
      - run:
          name: Ensure go mod is tidy
          command: |
            go mod tidy
            git diff --exit-code go.mod go.sum
      - run:
          name: Enforce Go Formatted Code
          command: |
            go fmt ./...
            if [[ -z $(git status --porcelain) ]]; then
              echo "Git directory is clean."
            else
              echo "Git directory is dirty. Run make fmt locally and commit any formatting fixes or generated code."
              git status --porcelain
              exit 1
            fi
      - run: make install-tools
      - run: make lint

  test:
    resource_class: large
    executor:
      name: go/default
      tag: "1.18.3"
    steps:
      - checkout
      - go/load-cache:
          key: test-docker
      - run: make install-tools
      - run:
          name: Run tests
          command: make test
      - go/save-cache:
          key: test-docker
      - store_test_results:
          path: ./
  release:
    resource_class: large
    docker:
      - image: cimg/go:1.18
    steps:
      - checkout
      - gh/setup:
          version: 2.2.0
      - run:
          name: "Ensure GnuPG is available"
          command: gpg --version
      - run:
          name: "Import signing key"
          command: |
            echo ${SIGNINGKEY} | base64 -d | gpg --import
      - run:
          name: "Build and publish release"
          command: make release
          no_output_timeout: 30m
      - persist_to_workspace:
          root: ~/project
          paths:
            - bin/driftctl_SHA256SUMS
  release-docs:
    docker:
      - image: cimg/base:2020.01
    steps:
      - checkout
      - attach_workspace:
          at: ~/project
      - run:
          name: Trigger driftctl-docs new version
          command: |
            curl -X POST https://api.github.com/repos/w3security/driftctl-docs/dispatches \
              -d '{"event_type": "new_version"}' \
              -H "Authorization: token $GITHUB_TOKEN"
  issue-tagging:
    machine:
      image: ubuntu-2004:202010-01
    steps:
      - checkout
      - gh/setup:
          version: 2.2.0
      - attach_workspace:
          at: ~/project
      - run:
          name: Auto label issues with the newly released version
          command: |
            ./scripts/issue-tagging.sh
  update-lambda:
    environment:
      FUNCTION_NAME: driftctl-version
    docker:
      - image: cimg/base:2021.04
    steps:
      - run:
          name: "Update Lambda version"
          command: |
            wget "https://github.com/w3security/lambda-env-updater/releases/download/v1.0.0/lambda-env-updater_linux_amd64" && chmod +x lambda-env-updater_linux_amd64
            ./lambda-env-updater_linux_amd64\
              -name ${FUNCTION_NAME}\
              -env "LATEST_VERSION=${CIRCLE_TAG}"
  security-oss:
    docker:
      - image: cimg/go:1.18
    steps:
      - checkout
      - w3security/scan:
          severity-threshold: high
          monitor-on-build: false
          project: ${CIRCLE_PROJECT_REPONAME}
          organization: cloud-cloud
  security-code:
    docker:
      - image: cimg/go:1.18.3
    steps:
      - checkout
      - w3security/scan:
          command: code test
          severity-threshold: high
          monitor-on-build: false
          project: ${CIRCLE_PROJECT_REPONAME}
          organization: cloud-cloud
workflows:
  nightly:
    jobs:
      - test_acc:
          name: "Acceptance tests: << matrix.pattern >>"
          matrix:
            parameters:
              pattern:
                - TestAcc_Aws
                - TestAcc_Google
                - TestAcc_Azure_
                - TestAcc_StateReader_

                # Disable this rather than create a new test org
                # - TestAcc_Github_
          context:
            - driftctl-acc
            - w3security-bot-slack
    triggers:
      - schedule:
          cron: "0 3 * * *"
          filters:
            branches:
              only:
                - main
  manual-acc-tests:
    when:
      equal: ["1", << pipeline.parameters.ACC_TESTS >>]
    jobs:
      - test_acc:
          name: "Acceptance tests: << matrix.pattern >>"
          matrix:
            parameters:
              pattern:
                - TestAcc_Aws
                - TestAcc_Google
                - TestAcc_Azure_
                - TestAcc_StateReader_

                # Disable this rather than create a new test org
                # - TestAcc_Github_
          context:
            - driftctl-acc
            - w3security-bot-slack
  pullrequest:
    jobs:
      - lint:
          <<: *only_branches
      - test:
          <<: *only_branches
      - security-code:
          name: W3Security code
          context:
            - driftctl-w3security
          <<: *only_maintainers
      - security-oss:
          name: W3Security test
          context:
            - driftctl-w3security
          <<: *only_maintainers
  # Disabled since it makes every PR to stay in "pending" state
  # https://ideas.circleci.com/cloud-feature-requests/p/show-overall-all-checks-have-passed-status-in-github-even-on-builds-with-incompl
  #  pullrequest_acc:
  #    jobs:
  #      - hold:
  #          type: approval # presents manual approval button in the UI
  #      - test_acc:
  #          name: "Acceptance tests: << matrix.pattern >>"
  #          requires:
  #            - hold
  #          matrix:
  #            parameters:
  #              pattern:
  #                - TestAcc_Aws
  #                - TestAcc_Github_
  #                - TestAcc_Google
  #                - TestAcc_Azure_
  #          context:
  #            - driftctl-acc
  push:
    jobs:
      - test:
          filters:
            branches:
              only:
                - main
  release:
    jobs:
      - lint:
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/
      - test:
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/
      - release:
          context:
            - driftctl
            - driftctl-w3security
            - driftctl-signing
          requires:
            - lint
            - test
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/
      - update-lambda:
          context: driftctl-version-lambda
          requires:
            - release
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/
      - release-docs:
          context:
            - driftctl
          requires:
            - release
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/
      - issue-tagging:
          context:
            - driftctl
          requires:
            - release
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/