From 8ab79afd9f3e2340b7a329e9ffb18f45dec8a791 Mon Sep 17 00:00:00 2001 From: Veronika Gnilitska Date: Tue, 21 Oct 2025 16:29:41 +0300 Subject: [PATCH 1/4] fix: mock aws data sources in tests --- README.md | 3 +++ tests/locals.tftest.hcl | 8 ++++++++ tests/outputs.tftest.hcl | 8 ++++++++ 3 files changed, 19 insertions(+) diff --git a/README.md b/README.md index 5c36ecb..90b53ab 100644 --- a/README.md +++ b/README.md @@ -51,12 +51,14 @@ While the current version is specific to SOPS, future mixins will support other | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.3 | +| [aws](#requirement\_aws) | >= 4.0 | | [sops](#requirement\_sops) | >= 0.7 | ## Providers | Name | Version | |------|---------| +| [aws](#provider\_aws) | >= 4.0 | | [sops](#provider\_sops) | >= 0.7 | ## Modules @@ -67,6 +69,7 @@ No modules. | Name | Type | |------|------| +| [aws_ssm_parameter.ssm_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source | | [sops_file.sops_secrets](https://registry.terraform.io/providers/carlpett/sops/latest/docs/data-sources/file) | data source | ## Inputs diff --git a/tests/locals.tftest.hcl b/tests/locals.tftest.hcl index e0683af..8e64b20 100644 --- a/tests/locals.tftest.hcl +++ b/tests/locals.tftest.hcl @@ -6,6 +6,14 @@ mock_provider "sops" { } } +mock_provider "aws" { + mock_data "aws_ssm_parameter" { + defaults = { + value = "mock-ssm-value" + } + } +} + run "test_empty_secret_mapping" { command = plan diff --git a/tests/outputs.tftest.hcl b/tests/outputs.tftest.hcl index 317557f..0007c53 100644 --- a/tests/outputs.tftest.hcl +++ b/tests/outputs.tftest.hcl @@ -6,6 +6,14 @@ mock_provider "sops" { } } +mock_provider "aws" { + mock_data "aws_ssm_parameter" { + defaults = { + value = "mock-ssm-value" + } + } +} + run "test_output_structure_and_content" { command = plan From 94b59732eda608f04f42a03b8a7da5f6a84080cc Mon Sep 17 00:00:00 2001 From: Veronika Gnilitska Date: Tue, 21 Oct 2025 16:57:28 +0300 Subject: [PATCH 2/4] fix: checkout the PR head, not the default branch --- .github/workflows/test.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 330fbbb..e38043e 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -21,6 +21,12 @@ jobs: matrix: tf: [tofu, terraform] steps: + - name: Checkout PR Head + if: github.event_name == 'pull_request_target' + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 - uses: masterpointio/github-action-tf-test@c3b619f3bca9e4f482b9e0fb3166ab3f02d9d54c # v1.0.0 with: tf_type: ${{ matrix.tf }} From 17617408b0377598863a56c0d3e11141eaacf408 Mon Sep 17 00:00:00 2001 From: Veronika Gnilitska Date: Tue, 21 Oct 2025 18:31:06 +0300 Subject: [PATCH 3/4] fix: checkout step --- .github/workflows/test.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index e38043e..e765125 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -21,8 +21,11 @@ jobs: matrix: tf: [tofu, terraform] steps: + # Only checkout for pull_request_target events (not for push to main) + # pull_request_target runs in the context of the base branch for security, + # so we must explicitly checkout the PR's head commit to test the actual changes - name: Checkout PR Head - if: github.event_name == 'pull_request_target' + if: github.event_name != 'push' uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: ref: ${{ github.event.pull_request.head.sha }} From cd20e55f677e29e9df21966b1e8af553a3fca6e6 Mon Sep 17 00:00:00 2001 From: Veronika Gnilitska Date: Tue, 21 Oct 2025 18:52:58 +0300 Subject: [PATCH 4/4] fix: bump masterpointio/github-action-tf-test version --- .github/workflows/test.yaml | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index e765125..6016be1 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -21,16 +21,7 @@ jobs: matrix: tf: [tofu, terraform] steps: - # Only checkout for pull_request_target events (not for push to main) - # pull_request_target runs in the context of the base branch for security, - # so we must explicitly checkout the PR's head commit to test the actual changes - - name: Checkout PR Head - if: github.event_name != 'push' - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - ref: ${{ github.event.pull_request.head.sha }} - fetch-depth: 0 - - uses: masterpointio/github-action-tf-test@c3b619f3bca9e4f482b9e0fb3166ab3f02d9d54c # v1.0.0 + - uses: masterpointio/github-action-tf-test@c1e41998f67925ac3f34e0bbcfcaa4a44d1f0cd9 # v1.0.1 with: tf_type: ${{ matrix.tf }} aws_role_arn: ${{ vars.TF_TEST_AWS_ROLE_ARN }}