integration-test.yml

name: Secure Integration test

on:
  pull_request_target:
    branches: main
  # workflow_call entry — TRUST INVARIANT.
  #
  # Lets another workflow in this repo reuse the integ tests against an
  # arbitrary `ref` while keeping AWS_*. The collaborator check below is
  # short-circuited on this path because the only caller (release.yml) is
  # workflow_dispatch-gated, which already requires repo write access.
  #
  # Before adding another caller, check all of:
  #   1. Cannot be triggered by an unauthenticated user or a fork
  #      (no pull_request; no pull_request_target without an auth gate;
  #      no push from non-main branches).
  #   2. Cannot be coerced into a fork-PR ref. validate-call-ref below is
  #      the runtime guard, but condition 1 should make that unnecessary.
  #   3. STRANDS_INTEG_TEST_ROLE is scoped to least privilege.
  workflow_call:
    inputs:
      ref:
        required: true
        type: string

jobs:
  validate-call-ref:
    name: Validate workflow_call ref
    if: inputs.ref != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
    # Reject ref shapes that could check out untrusted code:
    # `refs/pull/*` (fork-PR merge refs) and `owner:branch` (cross-repo
    # refs) fail; plain branches and SHAs pass.
    steps:
      - name: Reject untrusted-shaped refs
        env:
          REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          case "$REF" in
            refs/pull/*|*:*)
              echo "::error::workflow_call ref '$REF' looks like a fork PR or cross-repo ref."
              exit 1
              ;;
          esac
          echo "ref '$REF' passed shape check."

  authorization-check:
    name: Check access
    needs: [validate-call-ref]
    # `needs` only runs after non-skipped predecessors. validate-call-ref is
    # skipped on pull_request_target (inputs.ref is empty), so use
    # `if: always()` to ensure this still runs there. On workflow_call,
    # validate-call-ref must have succeeded.
    if: |
      always() &&
      (needs.validate-call-ref.result == 'success' || needs.validate-call-ref.result == 'skipped')
    # Kept within what the workflow_call caller (release.yml's `integ` job)
    # grants — a called workflow's job cannot request more than the caller.
    # The collaborator lookup only needs repo read.
    permissions:
      contents: read
      pull-requests: read
    runs-on: ubuntu-latest
    outputs:
      approval-env: ${{ steps.collab-check.outputs.result }}
    steps:
      - name: Collaborator Check
        uses: actions/github-script@v9
        id: collab-check
        env:
          # Only a workflow_call caller (release.yml) sets this; empty on
          # pull_request_target. When set, skip the collaborator lookup — the
          # caller is workflow_dispatch-gated and already requires write access.
          CALL_REF: ${{ inputs.ref }}
        with:
          result-encoding: string
          script: |
            if (process.env.CALL_REF) {
              console.log("workflow_call path (release); skipping collaborator check.")
              return "auto-approve"
            }
            try {
              const permissionResponse = await github.rest.repos.getCollaboratorPermissionLevel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: context.payload.pull_request.user.login,
              });
              const permission = permissionResponse.data.permission;
              const hasWriteAccess = ['write', 'admin'].includes(permission);
              if (!hasWriteAccess) {
                console.log(`User ${context.payload.pull_request.user.login} does not have write access to the repository (permission: ${permission})`);
                return "manual-approval"
              } else {
                console.log(`Verifed ${context.payload.pull_request.user.login} has write access. Auto Approving PR Checks.`)
                return "auto-approve"
              }
            } catch (error) {
              console.log(`${context.payload.pull_request.user.login} does not have write access. Requiring Manual Approval to run PR Checks.`)
              return "manual-approval"
            }
  check-access-and-checkout:
    name: Run integration tests
    runs-on: ubuntu-latest
    needs: authorization-check
    if: always() && needs.authorization-check.result == 'success'
    environment: ${{ needs.authorization-check.outputs.approval-env }}
    permissions:
      id-token: write
      pull-requests: read
      contents: read
    steps:
      - name: Configure Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
         role-to-assume: ${{ secrets.STRANDS_INTEG_TEST_ROLE }}
         aws-region: us-east-1
         mask-aws-account-id: true
      - name: Checkout head commit
        uses: actions/checkout@v7
        with:
          # On workflow_call (release) use the pinned ref; on
          # pull_request_target pull the PR head from the forked repo.
          ref: ${{ inputs.ref || github.event.pull_request.head.sha }}
          persist-credentials: false  # Don't persist credentials for subsequent actions
          # Opt back into fork-PR checkout, blocked by default in checkout@v7.
          # Safe here: the authorization-check job gates external contributors
          # behind the manual-approval environment before this job runs.
          allow-unsafe-pr-checkout: true
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: |
          pip install --no-cache-dir hatch
      - name: Run integration tests
        env:
          AWS_REGION: us-east-1
          AWS_REGION_NAME: us-east-1
          STRANDS_TEST_API_KEYS_SECRET_NAME: ${{ secrets.STRANDS_TEST_API_KEYS_SECRET_NAME }}
        id: tests
        run: |
          hatch test tests_integ