feat(servicediscovery): add the AWS::ServiceDiscovery (Cloud Map) res… #647
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| run_conformance: | |
| description: 'Run conformance tests' | |
| required: false | |
| default: 'false' | |
| type: boolean | |
| # Workflow-level group: holds the lock for the entire run so the matrix | |
| # entries inside conformance-tests share one claim instead of competing. | |
| # Job-level concurrency on a matrix job mass-cancels its own entries | |
| # ("higher priority waiting request" wins for each new pending matrix | |
| # entry). Shared with nightly so CI and nightly serialize on the same | |
| # AWS test account. | |
| concurrency: | |
| group: aws-conformance-tests | |
| cancel-in-progress: false | |
| jobs: | |
| checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.26" | |
| - name: Set up Pkl | |
| uses: pkl-community/setup-pkl@v0.0.8 | |
| with: | |
| pkl-version: 0.30.0 | |
| - name: Build | |
| run: make build | |
| - name: Lint | |
| uses: golangci/golangci-lint-action@v9.2.0 | |
| with: | |
| version: latest | |
| - name: Unit tests | |
| run: make test-unit | |
| - name: Validate Pkl manifest | |
| run: | | |
| pkl eval formae-plugin.pkl --format json > /dev/null | |
| echo "Manifest validated successfully" | |
| - name: Verify schema | |
| run: make verify-schema | |
| - name: Verify examples | |
| run: make verify-examples | |
| # Integration tests run against real AWS resources (Route53, EC2, etc.) | |
| # These are self-contained: each test creates and cleans up its own resources. | |
| test-integration: | |
| # Isolation from formae-e2e's aws-nuke is enforced in the nuke config | |
| # (region split + global allowlist), not via concurrency — GitHub | |
| # concurrency groups are per-repo and cannot serialize across repos. | |
| needs: [checks] | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| timeout-minutes: 30 | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.26" | |
| - name: Configure AWS Credentials | |
| uses: ./.github/actions/aws-credentials | |
| with: | |
| role-to-assume: arn:aws:iam::942849037363:role/admin-test-pel | |
| role-session-name: IntegrationTests | |
| - name: Run integration tests | |
| run: make test-integration | |
| # Discover test cases from testdata/ directory for matrix strategy | |
| discover-tests: | |
| needs: [checks, test-integration] | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| outputs: | |
| test-cases: ${{ steps.discover.outputs.test-cases }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Discover test cases | |
| id: discover | |
| run: | | |
| # Find all *.pkl files in testdata/, exclude -update.pkl and -replace.pkl variants, | |
| # and extract the base test case name | |
| TEST_CASES=$(ls testdata/*.pkl 2>/dev/null \ | |
| | xargs -n1 basename \ | |
| | grep -v '\-update\.pkl$' \ | |
| | grep -v '\-replace\.pkl$' \ | |
| | sed 's/\.pkl$//' \ | |
| | jq -R -s -c 'split("\n") | map(select(length > 0))') | |
| echo "Discovered test cases: ${TEST_CASES}" | |
| echo "test-cases=${TEST_CASES}" >> "$GITHUB_OUTPUT" | |
| # Clean up test resources before running any conformance tests | |
| pre-cleanup: | |
| needs: [discover-tests] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Configure AWS Credentials | |
| uses: ./.github/actions/aws-credentials | |
| with: | |
| role-to-assume: arn:aws:iam::942849037363:role/admin-test-pel | |
| role-session-name: CIPreCleanup | |
| - name: Clean test resources | |
| run: ./scripts/ci/clean-environment.sh | |
| # Conformance tests run the full CRUD lifecycle against real AWS resources. | |
| # Each test case runs in its own isolated job via matrix strategy. | |
| # Cleanup is handled by separate pre/post-cleanup jobs, NOT per test. | |
| conformance-tests: | |
| needs: [discover-tests, pre-cleanup] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| strategy: | |
| matrix: | |
| test-case: ${{ fromJson(needs.discover-tests.outputs.test-cases) }} | |
| # Mirrors nightly.yml — see the comment there on quota headroom. | |
| max-parallel: 5 | |
| fail-fast: false | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.26" | |
| - name: Set up Pkl | |
| uses: pkl-community/setup-pkl@v0.0.8 | |
| with: | |
| pkl-version: 0.30.0 | |
| - name: Configure AWS Credentials | |
| uses: ./.github/actions/aws-credentials | |
| with: | |
| role-to-assume: arn:aws:iam::942849037363:role/admin-test-pel | |
| role-session-name: ConformanceTests | |
| role-duration-seconds: 7200 | |
| - name: Install plugin | |
| run: make install | |
| - name: Run conformance test (${{ matrix.test-case }}) | |
| timeout-minutes: 60 | |
| env: | |
| AWS_REGION: us-east-1 | |
| FORMAE_TEST_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }} | |
| # Discovery polls inventory for the OOB-created resource. The 2-min | |
| # default is too tight when CloudControl ListResources gets throttled | |
| # in the shared test account (discovery scans every parent — e.g. each | |
| # EFS filesystem — so leftover resources from parallel jobs inflate the | |
| # list-call volume and trigger Rate exceeded backoffs). 5 min gives | |
| # discovery room to push past the throttling window. | |
| FORMAE_TEST_DISCOVERY_TIMEOUT: 5 | |
| POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }} | |
| run: make conformance-test-crud-run conformance-test-discovery-run TEST=${{ matrix.test-case }} PARALLEL=1 TIMEOUT=120 | |
| # Clean up test resources after all conformance tests (always runs) | |
| post-cleanup: | |
| needs: [conformance-tests] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Configure AWS Credentials | |
| uses: ./.github/actions/aws-credentials | |
| with: | |
| role-to-assume: arn:aws:iam::942849037363:role/admin-test-pel | |
| role-session-name: CIPostCleanup | |
| - name: Clean test resources | |
| run: ./scripts/ci/clean-environment.sh | |
| # Notify when build is fixed (was red, now green) | |
| notify-fixed: | |
| needs: [checks, conformance-tests, post-cleanup] | |
| runs-on: ubuntu-latest | |
| if: success() && github.event_name == 'push' | |
| steps: | |
| - name: Check if previous run failed | |
| id: check_previous | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const runs = await github.rest.actions.listWorkflowRuns({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| workflow_id: 'ci.yml', | |
| branch: context.ref.replace('refs/heads/', ''), | |
| per_page: 2, | |
| status: 'completed' | |
| }); | |
| // Get previous run (skip current which isn't completed yet) | |
| const previousRun = runs.data.workflow_runs.find(run => run.id !== context.runId); | |
| if (previousRun && previousRun.conclusion === 'failure') { | |
| return 'true'; | |
| } | |
| return 'false'; | |
| result-encoding: string | |
| - name: Notify Slack (Fixed) | |
| if: steps.check_previous.outputs.result == 'true' | |
| uses: slackapi/slack-github-action@v3.0.1 | |
| with: | |
| webhook: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| webhook-type: incoming-webhook | |
| payload: | | |
| { | |
| "text": ":white_check_mark: CI fixed on ${{ github.repository }}", | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": ":white_check_mark: *CI fixed* on `${{ github.repository }}`\n*Branch:* `${{ github.ref_name }}`\n*Commit:* `${{ github.sha }}`\n*Author:* ${{ github.actor }}" | |
| } | |
| }, | |
| { | |
| "type": "actions", | |
| "elements": [ | |
| { | |
| "type": "button", | |
| "text": { | |
| "type": "plain_text", | |
| "text": "View Run" | |
| }, | |
| "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| # Notify on failure | |
| notify-failure: | |
| needs: [checks, conformance-tests, post-cleanup] | |
| runs-on: ubuntu-latest | |
| if: failure() && github.event_name == 'push' | |
| steps: | |
| - name: Notify Slack | |
| uses: slackapi/slack-github-action@v3.0.1 | |
| with: | |
| webhook: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| webhook-type: incoming-webhook | |
| payload: | | |
| { | |
| "text": ":x: CI failed on ${{ github.repository }}", | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": ":x: *CI failed* on `${{ github.repository }}`\n*Branch:* `${{ github.ref_name }}`\n*Commit:* `${{ github.sha }}`\n*Author:* ${{ github.actor }}" | |
| } | |
| }, | |
| { | |
| "type": "actions", | |
| "elements": [ | |
| { | |
| "type": "button", | |
| "text": { | |
| "type": "plain_text", | |
| "text": "View Run" | |
| }, | |
| "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| } | |
| ] | |
| } | |
| ] | |
| } |