name: test

on:
  - push
  - pull_request
  - workflow_dispatch
  - workflow_call

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    if: github.event.pull_request.head.repo.fork != 'true'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Determine go version
        id: get-go-version
        # We use .go-version as our source of truth for current Go
        # version, because "goenv" can react to it automatically.
        run: |
          echo "Building with Go $(cat .go-version)"
          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "${{ steps.get-go-version.outputs.go-version }}"
          cache: false
      - name: Determine Go cache paths
        id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
      - name: Set up Go modules cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ steps.go-cache-paths.outputs.go-build }}
            ${{ steps.go-cache-paths.outputs.go-mod }}
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go
      - name: Determine boundary version
        id: get-boundary-version
        run: |
          echo "Testing with boundary-enterprise $(cat .boundary-version)"
          echo "boundary-version=$(cat .boundary-version)" >> "$GITHUB_OUTPUT"
      - name: Download boundary-enterprise
        run: |
          VERSION="${{ steps.get-boundary-version.outputs.boundary-version }}"

          release=$(curl -s "https://api.releases.hashicorp.com/v1/releases/boundary/${VERSION}?license_class=enterprise")
          binary_url=$(echo "$release" | jq -r '.builds[] | select(.os == "linux" and .arch == "amd64") | .url')
          shasums_url=$(echo "$release" | jq -r '.url_shasums')
          shasums_sig_url=$(echo "$release" | jq -r '.url_shasums_signatures[0]')

          # Download boundary, checksums, and checksum signature
          echo "::group::Download files"
          wget -q --server-response "$binary_url"
          wget -q --server-response -O boundary_SHA256SUMS "$shasums_url"
          wget -q --server-response -O boundary_SHA256SUMS.sig "$shasums_sig_url"
          echo "::endgroup::"

          # Verify signature against HashiCorp's public key
          echo "::group::Verify signature"
          export GNUPGHOME=./.gnupg
          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
          curl -s https://www.hashicorp.com/.well-known/pgp-key.txt | gpg --import
          gpg --verify boundary_SHA256SUMS.sig boundary_SHA256SUMS
          grep "boundary_${VERSION}_linux_amd64.zip" boundary_SHA256SUMS | shasum --algorithm 256 --check
          echo "::endgroup::"

          echo "::group::Extract boundary executable"
          mkdir -p "$HOME/bin"
          unzip "boundary_${VERSION}_linux_amd64.zip" -d "$HOME/bin"
          echo "$HOME/bin" >> "${GITHUB_PATH}"
          echo "::endgroup::"
      - name: Verify boundary version
        run: |
          boundary version
      - name: Acceptance Tests
        env:
          BOUNDARY_ADDR: http://localhost:9200
          BOUNDARY_LICENSE: ${{ secrets.BOUNDARY_LICENSE }}
        run: |
          make testacc