test-unlock-state.yaml

name: Test terraform-unlock-state

on:
  - pull_request

permissions:
  contents: read

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  default_workspace:
    runs-on: ubuntu-24.04
    name: Default workspace
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Check state is not locked
        uses: ./terraform-apply
        with:
          path: tests/workflows/test-unlock-state
          auto_approve: true

      - name: Intentionally lock the state
        uses: ./terraform-apply
        id: failed-apply
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          auto_approve: true
          variables:
            lock=true

      # State is now locked

      - name: Check apply-failed
        env:
          OUTCOME: ${{ steps.failed-apply.outcome }}
          FAILURE_REASON: ${{ steps.failed-apply.outputs.failure-reason }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "apply-failed" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi

      # Check state-locked
      - name: Try using locked state using terraform-apply
        uses: ./terraform-apply
        id: locked-state-apply
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          auto_approve: true

      - name: Check terraform-apply state locked failure-reason
        env:
          OUTCOME: ${{ steps.locked-state-apply.outcome }}
          FAILURE_REASON: ${{ steps.locked-state-apply.outputs.failure-reason }}
          LOCK_INFO: ${{ steps.locked-state-apply.outputs.lock-info }}
          LOCK_ID: ${{ fromJson(steps.locked-state-apply.outputs.lock-info).ID }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "state-locked" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi
          
          echo "$LOCK_INFO"          
          echo "Lock id is $LOCK_ID"

      - name: Try using locked state using terraform-destroy
        uses: ./terraform-destroy
        id: locked-state-destroy
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state

      - name: Check terraform-destroy state locked failure-reason
        env:
          OUTCOME: ${{ steps.locked-state-destroy.outcome }}
          FAILURE_REASON: ${{ steps.locked-state-destroy.outputs.failure-reason }}
          LOCK_INFO: ${{ steps.locked-state-destroy.outputs.lock-info }}
          LOCK_ID: ${{ fromJson(steps.locked-state-destroy.outputs.lock-info).ID }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "state-locked" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi
          
          echo "$LOCK_INFO"          
          echo "Lock id is $LOCK_ID"

      - name: Unlock the state
        uses: ./terraform-unlock-state
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          lock_id: ${{ fromJson(steps.locked-state-apply.outputs.lock-info).ID }}

      - name: Check state is not locked
        uses: ./terraform-apply
        with:
          path: tests/workflows/test-unlock-state
          auto_approve: true

  nondefault_workspace:
    runs-on: ubuntu-24.04
    name: Non Default workspace
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Create first workspace
        uses: ./terraform-new-workspace
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello

      - name: Check state is not locked
        uses: ./terraform-apply
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello
          auto_approve: true

      - name: Intentionally lock the state
        uses: ./terraform-apply
        id: failed-apply-workspace
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello
          auto_approve: true
          variables:
            lock=true

      # State is now locked

      - name: Check apply-failed
        env:
          OUTCOME: ${{ steps.failed-apply-workspace.outcome }}
          FAILURE_REASON: ${{ steps.failed-apply-workspace.outputs.failure-reason }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "apply-failed" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi

      # Check state-locked
      - name: Try using locked state
        uses: ./terraform-apply
        id: locked-state-workspace
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello
          auto_approve: true

      - name: Check state locked failure-reason
        env:
          OUTCOME: ${{ steps.locked-state-workspace.outcome }}
          FAILURE_REASON: ${{ steps.locked-state-workspace.outputs.failure-reason }}
          LOCK_INFO: ${{ steps.locked-state-workspace.outputs.lock-info }}
          LOCK_ID: ${{ fromJson(steps.locked-state-workspace.outputs.lock-info).ID }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "state-locked" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi
          
          echo "$LOCK_INFO"          
          echo "Lock id is $LOCK_ID"

      - name: Try using locked state using terraform-destroy-workspace
        uses: ./terraform-destroy-workspace
        id: locked-state-destroy-workspace
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello

      - name: Check terraform-destroy-workspace state locked failure-reason
        env:
          OUTCOME: ${{ steps.locked-state-destroy-workspace.outcome }}
          FAILURE_REASON: ${{ steps.locked-state-destroy-workspace.outputs.failure-reason }}
          LOCK_INFO: ${{ steps.locked-state-destroy-workspace.outputs.lock-info }}
          LOCK_ID: ${{ fromJson(steps.locked-state-destroy-workspace.outputs.lock-info).ID }}
        run: |
          if [[ "$OUTCOME" != "failure" ]]; then
            echo "Apply did not fail correctly"
            exit 1
          fi

          if [[ "$FAILURE_REASON" != "state-locked" ]]; then
            echo "::error:: failure-reason not set correctly"
            exit 1
          fi
          
          echo "$LOCK_INFO"          
          echo "Lock id is $LOCK_ID"

      - name: Unlock the state
        uses: ./terraform-unlock-state
        continue-on-error: true
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello
          lock_id: ${{ fromJson(steps.locked-state-workspace.outputs.lock-info).ID }}

      - name: Check state is not locked
        uses: ./terraform-apply
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello
          auto_approve: true

      - name: Destroy workspace
        uses: ./terraform-destroy-workspace
        with:
          path: tests/workflows/test-unlock-state
          workspace: hello