test.yml

name: test
on:
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**/*.md'

jobs:
  verify:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 2 # we want the HEAD commit and the previous commit to compare changed files

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: true

      - name: Verify
        run: |
          go mod download
          make vet
          make fmtcheck

      # we only want to run tests if any code changes (not for README or docs changes)
      - name: Check Changed Files
        id: files
        uses: tj-actions/changed-files@v45
        with:
          files: |
            .github
            go.mod
            go.sum
            main.go
            keycloak
            provider
            scripts

    outputs:
      code-files-changed: steps.files.outputs.any_changed

  acceptance:
    # this conditional is more verbose than I'd like it to be
    # https://github.com/actions/runner/issues/491
    if: |
      always() &&
      !cancelled() &&
      !contains(needs.verify.result, 'failure') &&
      !contains(needs.verify.result, 'cancelled') &&
      (needs.verify.outputs.code-files-changed || startsWith(github.ref, 'refs/tags/v'))
    needs:
      - verify
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        keycloak-version:
          - '26.0.8'
          - '25.0.6'
          - '24.0.5'
          - '23.0.7'
          - '22.0.5'
      fail-fast: false
    concurrency:
      group: ${{ github.head_ref || github.run_id }}-${{ matrix.keycloak-version }}
      cancel-in-progress: true
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: true

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false
          terraform_version: 1.9.8

      - name: Start Keycloak Container
        run: |
          docker run -d --name keycloak \
          -p 8080:8080 \
          -e KC_DB=dev-mem \
          -e KC_LOG_LEVEL=INFO \
          -e KEYCLOAK_ADMIN=keycloak \
          -e KEYCLOAK_ADMIN_PASSWORD=password \
          -e KC_FEATURES=preview \
          -v $PWD/provider/misc:/opt/keycloak/misc:z \
          quay.io/keycloak/keycloak:${{ matrix.keycloak-version }} start-dev

      - name: Initialize Keycloak
        run: ./scripts/wait-for-local-keycloak.sh && ./scripts/create-terraform-client.sh

      - name: Get Keycloak Version
        uses: actions/github-script@v7
        id: keycloak-version
        env:
          KEYCLOAK_VERSION: ${{ matrix.keycloak-version }}
        with:
          script: |
            return process.env.KEYCLOAK_VERSION.split("-")[0]
      - name: Test
        run: |
          terraform version
          go mod download
          make testacc
        env:
          KEYCLOAK_CLIENT_ID: terraform
          KEYCLOAK_CLIENT_SECRET: 884e0f95-0f42-4a63-9b1f-94274655669e
          KEYCLOAK_CLIENT_TIMEOUT: 120
          KEYCLOAK_REALM: master
          KEYCLOAK_URL: "http://localhost:8080"
          KEYCLOAK_TEST_PASSWORD_GRANT: "true"
          KEYCLOAK_VERSION: ${{ steps.keycloak-version.outputs.result }}
        timeout-minutes: 60
      - name: Clean up
        run: |
          docker stop keycloak
          docker rm keycloak