ci.yaml

name: ci
on: pull_request
jobs:
  go-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.22.x
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run linters
        uses: golangci/golangci-lint-action@v4
        with:
          version: latest
          args: --timeout=3m
  go-test:
    strategy:
      matrix:
        go-version: [1.22.x]
        platform: [ubuntu-latest]
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Install Go
        if: success()
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
      - name: Checkout code
        uses: actions/checkout@v4
      - name: go tests
        run: go test -v -covermode=count -json ./... > test.json
      - name: annotate go tests
        if: always()
        uses: guyarb/golang-test-annotations@v0.5.1
        with:
          test-results: test.json

  test:
    runs-on: ubuntu-latest
    env:
      BATON_LOG_LEVEL: debug
      # Change these to the correct IDs for your test data
      CONNECTOR_GRANT: ''
      CONNECTOR_ENTITLEMENT: ''
      CONNECTOR_PRINCIPAL: ''
      CONNECTOR_PRINCIPAL_TYPE: ''
      VGS_VAULT: 'tnturck9vro'
    steps:
      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.22.x
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Build baton-vgs
        run: go build ./cmd/baton-vgs
      # - name: Run baton-vgs
      #   run: ./baton-vgs --vault ${{ env.VGS_VAULT }} 
      - name: Install baton
        run: ./scripts/get-baton.sh && mv baton /usr/local/bin
      - name: Get baton resources
        run: baton resources
      - name: Check for grant before revoking
        if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
        run: |
          ./baton-vgs --vault ${{ env.VGS_VAULT }} 
          baton grants --entitlement ${{ env.CONNECTOR_ENTITLEMENT }} --output-format=json | jq -e ".grants | any(.principal.id.resource ==\"${{ env.CONNECTOR_PRINCIPAL }}\")"
      - name: Revoke grants
        if: env.CONNECTOR_GRANT != ''
        run: |
          ./baton-vgs --vault ${{ env.VGS_VAULT }}  
          ./baton-vgs --vault ${{ env.VGS_VAULT }} --revoke-grant ${{ env.CONNECTOR_GRANT }}
      - name: Check grant was revoked
        if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
        run: |
           ./baton-vgs --vault ${{ env.VGS_VAULT }}
           baton grants --entitlement ${{ env.CONNECTOR_ENTITLEMENT }} --output-format=json | jq -e ".grants | any(.principal.id.resource !=\"${{ env.CONNECTOR_PRINCIPAL }}\")"
      - name: Grant entitlement
        if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != '' && env.CONNECTOR_PRINCIPAL_TYPE != ''
        run: | 
          ./baton-vgs --vault ${{ env.VGS_VAULT }} 
          ./baton-vgs --vault ${{ env.VGS_VAULT }} --grant-entitlement ${{ env.CONNECTOR_ENTITLEMENT }} --grant-principal ${{ env.CONNECTOR_PRINCIPAL }} --grant-principal-type ${{ env.CONNECTOR_PRINCIPAL_TYPE }}
      - name: Check grant was re-granted
        if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
        run: |
          ./baton-vgs --vault ${{ env.VGS_VAULT }} 
          baton grants --entitlement ${{ env.CONNECTOR_ENTITLEMENT }} --output-format=json | jq -e ".grants | any(.principal.id.resource ==\"${{ env.CONNECTOR_PRINCIPAL }}\")"