test.yml

---
name: Test

concurrency:
  group: test
  cancel-in-progress: false

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest

    defaults:
      run:
        shell: bash

    container:
      image: public.ecr.aws/jsii/superchain:1-bookworm-slim-node20

    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 20.x

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Cache node modules
        id: cache-npm
        uses: actions/cache@v4
        env:
          cache-name: cache-node-modules
        with:
          path: .npm
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-build-${{ env.cache-name }}-
            ${{ runner.os }}-build-
            ${{ runner.os }}-

      - name: Install dependencies
        run: |
          set -euo pipefail
          make install
          (cd test && make install)
          sudo apt-get update
          sudo apt-get install -y tree

      - name: Linting
        run: make eslint

      - name: Set Build Permissions
        run: |
          set -euo pipefail
          mkdir $GITHUB_WORKSPACE/test/cdk.out
          chmod 777 $GITHUB_WORKSPACE/test/cdk.out --recursive
          chmod 777 $GITHUB_WORKSPACE/lambda --recursive

      - name: Deploy & Destroy
        run: |
          set -euo pipefail

          function get_secret_values() {
            AWS_REGION=us-east-1 aws secretsmanager describe-secret \
              --secret-id ec2-ssh-key/CFN-signing-key/private \
              --query 'Tags[?Key==`Test`].Value' --output text
          }

          cd test
          make deploy get-secret-values
          if [ "$(get_secret_values)" != "default" ]; then
            echo "Unexpected secret value"
            exit 1
          fi

          TAG_VALUE=working make deploy
          if [ "$(get_secret_values)" != "working" ]; then
            echo "Unexpected secret value"
            exit 1
          fi

          make DESTROY
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Build source w/ jsii
        run: |
          lambda/build
          npx jsii
          make validate-package

      - name: Build packages w/ jsii-pacmak
        run: |
          set -euo pipefail
          npx jsii-pacmak --verbose
          tree dist