ci.yaml

name: ci
on: 
  workflow_dispatch:
  pull_request:
jobs:
  go-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.22.x
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run linters
        uses: golangci/golangci-lint-action@v4
        with:
          version: latest
          args: --timeout=3m
  go-test:
    strategy:
      matrix:
        go-version: [1.22.x]
        platform: [ubuntu-latest]
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Install Go
        if: success()
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
      - name: Checkout code
        uses: actions/checkout@v4
      - name: go tests
        run: go test -v -covermode=count -json ./... > test.json
      - name: annotate go tests
        if: always()
        uses: guyarb/golang-test-annotations@v0.5.1
        with:
          test-results: test.json

  test:
    permissions:
      id-token: write # permission is required or Machine ID will not authenticate with the cluster.
      contents: read
      pages: write
    runs-on: ubuntu-latest
    env:
      BATON_LOG_LEVEL: debug
      # The following parameters are passed to grant/revoke commands
      CONNECTOR_GRANT: 'role:requester:member:user:homime2188@sfpixel.com'
      CONNECTOR_ENTITLEMENT: 'role:requester:member'
      CONNECTOR_PRINCIPAL: 'homime2188@sfpixel.com'
      CONNECTOR_PRINCIPAL_TYPE: 'user'
      TELEPORT_PROXY: 'd3v-conductorone.teleport.sh:443'
    steps:
      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.22.x
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Fetch Teleport binaries
        uses: teleport-actions/setup@v1
        with:
          version: 15.1.1
      - name: Fetch credentials using Machine ID
        id: auth
        uses: teleport-actions/auth@v2
        with:
          proxy: ${{ env.TELEPORT_PROXY }}
          token: github-actions-cd
          anonymous-telemetry: 1
      - name: Check tsh status
        run: tsh status
      - name: Check tctl status
        run: tctl status
      - name: Add identity file
        run: cp ${{ steps.auth.outputs.identity-file }} auth.pem
      - name: Build baton-teleport
        run: go build ./cmd/baton-teleport
      - name: Run baton-teleport
        run: ./baton-teleport --proxyAddr ${{ env.TELEPORT_PROXY }}
      - name: Install baton
        run: ./scripts/get-baton.sh && mv baton /usr/local/bin
      - name: Get teleport resources
        run: baton resources
      # - name: Check for grant before revoking
      #   if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
      #   run: baton grants --entitlement ${{ env.CONNECTOR_ENTITLEMENT }} --output-format=json | jq --exit-status ".grants[].principal.id.resource == \"${{ env.CONNECTOR_PRINCIPAL }}\""
      - name: Revoke grants
        if: env.CONNECTOR_GRANT != ''
        run: |
          ./baton-teleport --proxyAddr ${{ env.TELEPORT_PROXY }}  
          ./baton-teleport --proxyAddr ${{ env.TELEPORT_PROXY }} --revoke-grant ${{ env.CONNECTOR_GRANT }}
      # - name: Check grant was revoked
      #   if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
      #   run: ./baton-teleport && baton grants --proxyAddr ${{ env.TELEPORT_PROXY }} --entitlement ${{ env.CONNECTOR_ENTITLEMENT }}  --output-format=json | jq --exit-status "if .grants then .grants[]?.principal.id.resource != \"${{ env.CONNECTOR_PRINCIPAL }}\" else . end"
      - name: Grant entitlement
        if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != '' && env.CONNECTOR_PRINCIPAL_TYPE != ''
        run: | 
          ./baton-teleport --proxyAddr ${{ env.TELEPORT_PROXY }} 
          ./baton-teleport --proxyAddr ${{ env.TELEPORT_PROXY }} --grant-entitlement ${{ env.CONNECTOR_ENTITLEMENT }} --grant-principal ${{ env.CONNECTOR_PRINCIPAL }} --grant-principal-type ${{ env.CONNECTOR_PRINCIPAL_TYPE }}
      # - name: Check grant was re-granted
      #   if: env.CONNECTOR_ENTITLEMENT != '' && env.CONNECTOR_PRINCIPAL != ''
      #   run: baton grants --entitlement ${{ env.CONNECTOR_ENTITLEMENT }}  --output-format=json | jq --exit-status ".grants[].principal.id.resource == \"${{ env.CONNECTOR_PRINCIPAL }}\""