Skip to content

Commit 49c502e

Browse files
general-kroll-4-lifeCopilot
general-kroll-4-life
and
Copilot
committed
test-run
Co-authored-by: Copilot <copilot@github.com>
1 parent 4aaf639 commit 49c502e

6 files changed

Lines changed: 125 additions & 9 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -817,6 +817,39 @@ jobs:
817817
python cicd/python/build.py --robot-test --config='{ "variables": { "SHOULD_RUN_DOCKER_EXTERNAL_TESTS": "true" } }'
818818
fi
819819
820+
- name: Run mocked ID federation traffic light tests
821+
if: ((startsWith(github.ref_name, 'build-traffic-lights') && github.ref_type == 'tag') || (github.repository == 'stackql/stackql' && github.event_name == 'push' && github.ref == 'refs/heads/main')) && matrix.registry == 'test/registry'
822+
env:
823+
PYTHONPATH: '${{ env.PYTHONPATH }}:${{ github.workspace }}/test/python'
824+
run: |
825+
echo "## Stray flask apps to be killed before robot tests ##"
826+
pgrep -f flask | xargs kill -9 || true
827+
echo "## End ##"
828+
if robot \
829+
--variable 'SUNDRY_CONFIG:{"registry_path": "test/registry"}' \
830+
--variable RUN_ID_FED_TRAFFIC_LIGHTS:true \
831+
--include id_fed_traffic_lightANDtls_proxied \
832+
-d test/robot/reports-id-fed-traffic-lights \
833+
test/robot/functional/stackql_mocked_from_cmd_line.robot; then
834+
echo "✅ Mocked ID federation traffic light tests **all** passed"
835+
else
836+
rv="$?"
837+
echo "🟡 **some** mocked ID federation traffic light tests failed code = $rv"
838+
fi
839+
{
840+
echo "ID_FED_TRAFFIC_LIGHTS_COMPLETED=true"
841+
} >> "$GITHUB_ENV"
842+
843+
- name: Output from mocked ID federation traffic light tests
844+
if: env.ID_FED_TRAFFIC_LIGHTS_COMPLETED == 'true'
845+
run: |
846+
cat ./test/robot/reports-id-fed-traffic-lights/output.xml || true
847+
848+
- name: Output from mocked ID federation traffic lights tmp dir
849+
if: env.ID_FED_TRAFFIC_LIGHTS_COMPLETED == 'true'
850+
run: |
851+
cat ./test/robot/functional/tmp/ID-Fed-* || true
852+
820853
- name: Output from mocked functional tests
821854
if: always()
822855
run: |

‎test/robot/functional/stackql_mocked_from_cmd_line.robot‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4514,7 +4514,7 @@ ID Fed AWS S3 Buckets Traffic Light Canonical
45144514
Create File ${CURDIR}/tmp/id-fed-aws-subject-token.jwt mock-oidc-subject-token-aws
45154515
${authCfg} = Catenate
45164516
... {"aws":{"type":"aws_web_identity","aws_role_arn":"arn:aws:iam::123456789012:role/mock-idfed-role","aws_sts_region":"us-east-1","aws_sts_endpoint":"https://${LOCAL_HOST_ALIAS}:${MOCKSERVER_PORT_OAUTH_CLIENT_CREDENTIALS_TOKEN}/aws/sts","oidc_subject_token_file":"${CURDIR}/tmp/id-fed-aws-subject-token.jwt"}}
4517-
Should Stackql Exec Inline Contain Both Streams
4517+
Should Stackql Exec Inline Equal Both Streams
45184518
... ${STACKQL_EXE}
45194519
... ${OKTA_SECRET_STR}
45204520
... ${GITHUB_SECRET_STR}
@@ -4523,7 +4523,7 @@ ID Fed AWS S3 Buckets Traffic Light Canonical
45234523
... ${authCfg}
45244524
... ${SQL_BACKEND_CFG_STR_CANONICAL}
45254525
... ${SELECT_AWS_S3_BUCKETS}
4526-
... CreationDate
4526+
... ${SELECT_AWS_S3_BUCKETS_EXPECTED}
45274527
... ${EMPTY}
45284528
... stdout=${CURDIR}/tmp/ID-Fed-AWS-S3-Buckets-Traffic-Light-Canonical-stdout.tmp
45294529
... stderr=${CURDIR}/tmp/ID-Fed-AWS-S3-Buckets-Traffic-Light-Canonical-stderr.tmp
@@ -4535,18 +4535,16 @@ ID Fed Azure Public Keys Traffic Light Canonical
45354535
Create File ${CURDIR}/tmp/id-fed-azure-subject-token.jwt mock-oidc-subject-token-azure
45364536
${authCfg} = Catenate
45374537
... {"azure":{"type":"azure_federated","azure_tenant_id":"00000000-0000-0000-0000-000000000000","client_id":"11111111-1111-1111-1111-111111111111","scopes":["https://management.azure.com/.default"],"azure_federated_endpoint":"https://${LOCAL_HOST_ALIAS}:${MOCKSERVER_PORT_OAUTH_CLIENT_CREDENTIALS_TOKEN}/azure/federated/token","oidc_subject_token_file":"${CURDIR}/tmp/id-fed-azure-subject-token.jwt"}}
4538-
${inputStr} = Catenate
4539-
... select name from azure.network.virtual_networks where subscriptionId = 'subid' order by name asc;
4540-
Should Stackql Exec Inline Contain Both Streams
4538+
Should Stackql Exec Inline Equal Both Streams
45414539
... ${STACKQL_EXE}
45424540
... ${OKTA_SECRET_STR}
45434541
... ${GITHUB_SECRET_STR}
45444542
... ${K8S_SECRET_STR}
45454543
... ${REGISTRY_NO_VERIFY_CFG_STR}
45464544
... ${authCfg}
45474545
... ${SQL_BACKEND_CFG_STR_CANONICAL}
4548-
... ${inputStr}
4549-
... name
4546+
... ${SELECT_AZURE_COMPUTE_PUBLIC_KEYS}
4547+
... ${SELECT_AZURE_COMPUTE_PUBLIC_KEYS_EXPECTED}
45504548
... ${EMPTY}
45514549
... stdout=${CURDIR}/tmp/ID-Fed-Azure-Public-Keys-Traffic-Light-Canonical-stdout.tmp
45524550
... stderr=${CURDIR}/tmp/ID-Fed-Azure-Public-Keys-Traffic-Light-Canonical-stderr.tmp
@@ -4558,7 +4556,7 @@ ID Fed Google Container Agg Desc Traffic Light Canonical
45584556
Create File ${CURDIR}/tmp/id-fed-gcp-subject-token.jwt mock-oidc-subject-token-gcp
45594557
${authCfg} = Catenate
45604558
... {"google":{"type":"gcp_workload_identity","gcp_workload_identity_audience":"//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/mock-pool/providers/mock-provider","gcp_workload_identity_token_url":"https://${LOCAL_HOST_ALIAS}:${MOCKSERVER_PORT_OAUTH_CLIENT_CREDENTIALS_TOKEN}/gcp/sts/token","gcp_service_account_impersonation_url":"https://${LOCAL_HOST_ALIAS}:${MOCKSERVER_PORT_OAUTH_CLIENT_CREDENTIALS_TOKEN}/gcp/iamcredentials/generateAccessToken","scopes":["https://www.googleapis.com/auth/cloud-platform"],"oidc_subject_token_file":"${CURDIR}/tmp/id-fed-gcp-subject-token.jwt"}}
4561-
Should Stackql Exec Inline Contain Both Streams
4559+
Should Stackql Exec Inline Equal Both Streams
45624560
... ${STACKQL_EXE}
45634561
... ${OKTA_SECRET_STR}
45644562
... ${GITHUB_SECRET_STR}
@@ -4567,7 +4565,7 @@ ID Fed Google Container Agg Desc Traffic Light Canonical
45674565
... ${authCfg}
45684566
... ${SQL_BACKEND_CFG_STR_CANONICAL}
45694567
... ${SELECT_CONTAINER_SUBNET_AGG_DESC}
4570-
... ipCidrRange
4568+
... ${SELECT_CONTAINER_SUBNET_AGG_DESC_EXPECTED}
45714569
... ${EMPTY}
45724570
... stdout=${CURDIR}/tmp/ID-Fed-Google-Container-Agg-Desc-Traffic-Light-Canonical-stdout.tmp
45734571
... stderr=${CURDIR}/tmp/ID-Fed-Google-Container-Agg-Desc-Traffic-Light-Canonical-stderr.tmp

‎test/robot/id-fed-traffic-lights/stackql.resource‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
*** Variables ***
2+
${REPOSITORY_ROOT} ${CURDIR}/../../..
3+
${STACKQL_EXE} ${REPOSITORY_ROOT}/build/stackql
4+
5+
*** Keywords ***
6+
# Add any custom keywords here if needed for the id-fed traffic-light suite.

‎test/robot/id-fed-traffic-lights/stackql_idfed_traffic_light_integration_from_cmd_line.robot‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
*** Settings ***
2+
Resource ${CURDIR}/stackql.resource
3+
4+
*** Test Cases ***
5+
6+
IDFed AWS S3 Buckets List
7+
Sleep 2s
8+
${awsRoleArn} = OperatingSystem.Get Environment Variable STACKQL_IDFED_ROLE_ARN
9+
Should Not Be Empty ${awsRoleArn}
10+
${awsAuthCfg} = Catenate
11+
... { "aws": { "type":"aws_web_identity", "aws_role_arn": "${awsRoleArn}", "aws_sts_region": "us-east-1", "oidc_subject_token_file_env_var": "OIDC_SUBJECT_TOKEN_FILE" } }
12+
${bucketsListQuery} = Catenate
13+
... select * from aws.s3.buckets where region = 'ap-southeast-2';
14+
${result} = Run Process
15+
... ${STACKQL_EXE}
16+
... \-\-auth
17+
... ${awsAuthCfg}
18+
... \-\-registry
19+
... { "url": "file://${REPOSITORY_ROOT}/test/registry", "localDocRoot": "${REPOSITORY_ROOT}/test/registry", "verifyConfig": { "nopVerify": true } }
20+
... exec
21+
... ${bucketsListQuery}
22+
... cwd=${REPOSITORY_ROOT}
23+
... stdout=${CURDIR}/tmp/IDFed-AWS-S3-Buckets-List.tmp
24+
... stderr=${CURDIR}/tmp/IDFed-AWS-S3-Buckets-List-stderr.tmp
25+
Should Be Equal As Integers ${result.rc} 0
26+
Should Be Empty ${result.stderr}
27+
Should Contain ${result.stdout} stackql-trial-bucket-02
28+
29+
IDFed Azure VNETs List
30+
Sleep 2s
31+
${azureTargetSubscription} = OperatingSystem.Get Environment Variable AZURE_TARGET_SUBSCRIPTION_ID
32+
Should Not Be Empty ${azureTargetSubscription}
33+
${azureAuthCfg} = Catenate
34+
... { "azure": { "type": "azure_federated", "azure_tenant_id": "${AZURE_TENANT_ID}", "client_id": "${AZURE_CLIENT_ID}", "scopes": ["https://management.azure.com/.default"], "oidc_subject_token_file_env_var": "OIDC_SUBJECT_TOKEN_FILE" } }
35+
${bucketsListQuery} = Catenate
36+
... select location, name from azure.network.virtual_networks where subscriptionId = '${azureTargetSubscription}';
37+
${result} = Run Process
38+
... ${STACKQL_EXE}
39+
... \-\-auth
40+
... ${azureAuthCfg}
41+
... \-\-registry
42+
... { "url": "file://${REPOSITORY_ROOT}/test/registry", "localDocRoot": "${REPOSITORY_ROOT}/test/registry", "verifyConfig": { "nopVerify": true } }
43+
... exec
44+
... ${bucketsListQuery}
45+
... cwd=${REPOSITORY_ROOT}
46+
... stdout=${CURDIR}/tmp/IDFed-Azure-VNETs-List.tmp
47+
... stderr=${CURDIR}/tmp/IDFed-Azure-VNETs-List-stderr.tmp
48+
Should Be Equal As Integers ${result.rc} 0
49+
Should Be Empty ${result.stderr}
50+
Should Contain ${result.stdout} inspector-network
51+
52+
IDFed Google Buckets List
53+
Sleep 2s
54+
${gcpAudience} = OperatingSystem.Get Environment Variable GCP_OIDC_AUDIENCE
55+
${gcpServiceAccount} = OperatingSystem.Get Environment Variable GCP_SERVICE_ACCOUNT_EMAIL
56+
Should Not Be Empty ${gcpAudience}
57+
Should Not Be Empty ${gcpServiceAccount}
58+
${gcpAuthCfg} = Catenate
59+
... { "google": { "type": "gcp_workload_identity", "gcp_workload_identity_audience": "${gcpAudience}", "gcp_service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${gcpServiceAccount}:generateAccessToken", "scopes": ["https://www.googleapis.com/auth/cloud-platform"], "oidc_subject_token_file_env_var": "OIDC_SUBJECT_TOKEN_FILE" } }
60+
${bucketsListQuery} = Catenate
61+
... select location, name from google.storage.buckets where project = 'stackql-demo';
62+
${result} = Run Process
63+
... ${STACKQL_EXE}
64+
... \-\-auth
65+
... ${gcpAuthCfg}
66+
... \-\-registry
67+
... { "url": "file://${REPOSITORY_ROOT}/test/registry", "localDocRoot": "${REPOSITORY_ROOT}/test/registry", "verifyConfig": { "nopVerify": true } }
68+
... exec
69+
... ${bucketsListQuery}
70+
... cwd=${REPOSITORY_ROOT}
71+
... stdout=${CURDIR}/tmp/IDFed-Google-Buckets-List.tmp
72+
... stderr=${CURDIR}/tmp/IDFed-Google-Buckets-List-stderr.tmp
73+
Should Be Equal As Integers ${result.rc} 0
74+
Should Be Empty ${result.stderr}
75+
Should Contain ${result.stdout} stackql-demo-bucket

‎test/robot/id-fed-traffic-lights/tmp/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*
2+
!.gitignore

‎test/robot/reports-id-fed-traffic-lights-local/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*
2+
!.gitignore

0 commit comments

Comments
 (0)