[QTI-220] Add infrastructure integration testing (#2282)

* [QTI-275] Add infrastructure integration testing

On pull requests that originate from branches of the `hashicorp/boundary`
repo, we now conditionally dispatch infrastructure integration tests using
the Enos framework. The `integration` Enos scenario includes two `builder`
variants which allow developers or CI to deploy a Boundary cluster in AWS
using either a local `boundary` install bundle or that which is produced
in the `build` workflow for CRT. The `test` variants determine which type
of infrastructure integration test to run. At present those options are
`cli_ui` (Bats CLI tests) or `smoke` (creates target instances and a
target host catalog and verifies that `boundary` works).

In addition to the new workflow and quality scenarios, we simplified the
some `build` workflow steps and added Go module caching to speed up the
build pipeline.

See the [enos/README.md](https://github.com/hashicorp/boundary/blob/main/enos/README.md)
for a detailed explanation on how to configure and execute Enos scenarios
from your machine.

Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Rebecca Willett <rwillett@hashicorp.com>
Co-authored-by: Josh Branch <jbrand@hashicorp.com>

.github/workflows/build.yml

@@ -1,38 +1,55 @@
 name: build
 
-on: [ workflow_dispatch, push, workflow_call ]
+on:
+  - workflow_dispatch
+  - push
+  - workflow_call
 
 env:
   PKG_NAME: "boundary"
 
 jobs:
-  get-go-version:
+  product-metadata:
     runs-on: ubuntu-latest
     outputs:
+      product-version: ${{ steps.get-product-version.outputs.product-version }}
+      product-minor-version: ${{ steps.get-product-version.outputs.product-minor-version }}
+      product-edition: ${{ steps.get-product-edition.outputs.product-edition }}
       go-version: ${{ steps.get-go-version.outputs.go-version }}
     steps:
       - uses: actions/checkout@v3
-      - name: 'Determine Go version'
+      - name: Determine Go version
         id: get-go-version
         # We use .go-version as our source of truth for current Go
         # version, because "goenv" can react to it automatically.
         run: |
           echo "Building with Go $(cat .go-version)"
           echo "::set-output name=go-version::$(cat .go-version)"
-
-  get-product-version:
-    needs: get-go-version
-    runs-on: ubuntu-latest
-    outputs:
-      product-version: ${{ steps.get-product-version.outputs.product-version }}
-      product-minor-version: ${{ steps.get-product-version.outputs.product-minor-version }}
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup go
+      - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "${{ needs.get-go-version.outputs.go-version }}"
-      - name: get product version
+          go-version: "${{ steps.get-go-version.outputs.go-version }}"
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "::set-output name=go-build::$(go env GOCACHE)"
+          echo "::set-output name=go-mod::$(go env GOMODCACHE)"
+      - name: Set up Go modules cache
+        uses: actions/cache@v3
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: Determine product edition
+        id: get-product-edition
+        # Run make edition twice to ensure that extra go output isn't included
+        run: |
+          make edition
+          echo "::set-output name=product-edition::$(make edition)"
+      - name: Determine product version
         id: get-product-version
         run: |
           VERSION=$(make version)
@@ -40,62 +57,15 @@ jobs:
           echo "::set-output name=product-version::$VERSION"
           echo "::set-output name=product-minor-version::$MINOR_VERSION"
 
-  verify-product-version:
-    needs: get-product-version
-    runs-on: ubuntu-latest
-    steps:
-      - name: Verify version strings
-        run: |
-          echo product-version: ${{ needs.get-product-version.outputs.product-version }}
-          echo minor-version: ${{ needs.get-product-version.outputs.product-minor-version }}
-
-  generate-metadata-file:
-    needs: get-product-version
-    runs-on: ubuntu-latest
-    outputs:
-      filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
-    steps:
-      - name: 'Checkout directory'
-        uses: actions/checkout@v3
-      - name: Generate metadata file
-        id: generate-metadata-file
-        uses: hashicorp/actions-generate-metadata@main
-        with:
-          version: ${{ needs.get-product-version.outputs.product-version }}
-          product: ${{ env.PKG_NAME }}
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: metadata.json
-          path: ${{ steps.generate-metadata-file.outputs.filepath }}
-
-  get-product-edition:
-    runs-on: ubuntu-latest
-    outputs:
-      product-edition: ${{ steps.get-product-edition.outputs.product-edition}}
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.18.4"
-      - name: Get product edition
-        id: get-product-edition
-        run: |
-          make edition
-          echo "::set-output name=product-edition::$(make edition)"
-
   build-other:
     needs:
-      - get-product-version
-      - get-product-edition
-      - get-go-version
+      - product-metadata
     runs-on: ubuntu-latest
     strategy:
       matrix:
         goos: [ freebsd, windows, netbsd, openbsd, solaris ]
         goarch: [ "386", "amd64", "arm" ]
-        go: [ "${{ needs.get-go-version.outputs.go-version }}" ]
+        go: [ "${{ needs.product-metadata.outputs.go-version }}" ]
         exclude:
           - goos: solaris
             goarch: 386
@@ -111,13 +81,27 @@ jobs:
       GO111MODULE: on
     steps:
       - uses: actions/checkout@v3
-      - name: Setup go
+      - name: Set up go
         uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}
-      - name: Setup Git
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "::set-output name=go-build::$(go env GOCACHE)"
+          echo "::set-output name=go-mod::$(go env GOMODCACHE)"
+      - name: Set up Go modules cache
+        uses: actions/cache@v3
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ matrix.goarch }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: Set up Git
         run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com".insteadOf "https://github.com"
-      - name: Set sha
+      - name: Determine SHA
         id: set-sha
         run: echo "::set-output name=sha::$(head -n1 internal/ui/VERSION | cut -d ' ' -f1)"
       - name: Download UI artifact
@@ -126,9 +110,9 @@ jobs:
           workflow: build-admin-ui.yaml
           commit: ${{ steps.set-sha.outputs.sha }}
           repo: "hashicorp/boundary-ui"
-          name: admin-ui-${{ needs.get-product-edition.outputs.product-edition }}
+          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
           path: internal/ui/.tmp/boundary-ui/ui/admin/dist
-      - name: Go Build
+      - name: Go build
         env:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
@@ -136,23 +120,21 @@ jobs:
         run: |
           mkdir out
           make build
-          zip -r -j out/${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip bin/
+          zip -r -j out/${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip bin/
       - uses: actions/upload-artifact@v3
         with:
-          name: ${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
-          path: out/${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
+          name: ${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
+          path: out/${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
 
   build-linux:
     needs:
-      - get-product-version
-      - get-product-edition
-      - get-go-version
+      - product-metadata
     runs-on: ubuntu-latest
     strategy:
       matrix:
         goos: [linux]
         goarch: ["arm", "arm64", "386", "amd64"]
-        go: [ "${{ needs.get-go-version.outputs.go-version }}" ]
+        go: [ "${{ needs.product-metadata.outputs.go-version }}" ]
       fail-fast: true
 
     name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build
@@ -163,13 +145,27 @@ jobs:
 
     steps:
       - uses: actions/checkout@v3
-      - name: Setup Git
+      - name: Set up Git
         run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com".insteadOf "https://github.com"
-      - name: Setup go
+      - name: Set up Go
         uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}
-      - name: Set sha
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "::set-output name=go-build::$(go env GOCACHE)"
+          echo "::set-output name=go-mod::$(go env GOMODCACHE)"
+      - name: Set up Go modules cache
+        uses: actions/cache@v3
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ matrix.goarch }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: Determine SHA
         id: set-sha
         run: echo "::set-output name=sha::$(head -n1 internal/ui/VERSION | cut -d ' ' -f1)"
       - name: Download UI artifact
@@ -178,9 +174,9 @@ jobs:
           workflow: build-admin-ui.yaml
           commit: ${{ steps.set-sha.outputs.sha }}
           repo: "hashicorp/boundary-ui"
-          name: admin-ui-${{ needs.get-product-edition.outputs.product-edition }}
+          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
           path: internal/ui/.tmp/boundary-ui/ui/admin/dist
-      - name: Go Build
+      - name: Go build
         env:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
@@ -188,19 +184,18 @@ jobs:
         run: |
           mkdir out
           make build
-          zip -r -j out/${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip bin/
+          zip -r -j out/${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip bin/
       - uses: actions/upload-artifact@v3
         with:
-          name: ${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
-          path: out/${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
-
+          name: ${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
+          path: out/${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
       - name: Linux Packaging
         uses: hashicorp/actions-packaging-linux@v1
         with:
           name: ${{ github.event.repository.name }}
           description: "HashiCorp Boundary - Identity-based access management for dynamic infrastructure"
           arch: ${{ matrix.goarch }}
-          version: ${{ needs.get-product-version.outputs.product-version }}
+          version: ${{ needs.product-metadata.outputs.product-version }}
           maintainer: "HashiCorp"
           homepage: "https://github.com/hashicorp/boundary"
           license: "MPL-2.0"
@@ -214,41 +209,54 @@ jobs:
         run: |
           echo "RPM_PACKAGE=$(basename out/*.rpm)" >> $GITHUB_ENV
           echo "DEB_PACKAGE=$(basename out/*.deb)" >> $GITHUB_ENV
-      - uses: actions/upload-artifact@v3
+      - name: Upload RPM package
+        uses: actions/upload-artifact@v3
         with:
           name: ${{ env.RPM_PACKAGE }}
           path: out/${{ env.RPM_PACKAGE }}
-      - uses: actions/upload-artifact@v3
+      - name: Upload DEB package
+        uses: actions/upload-artifact@v3
         with:
           name: ${{ env.DEB_PACKAGE }}
           path: out/${{ env.DEB_PACKAGE }}
 
   build-darwin:
     needs:
-      - get-product-version
-      - get-product-edition
-      - get-go-version
+      - product-metadata
     runs-on: macos-latest
     strategy:
       matrix:
         goos: [ darwin ]
         goarch: [ "amd64", "arm64" ]
-        go: [ "${{ needs.get-go-version.outputs.go-version }}" ]
+        go: [ "${{ needs.product-metadata.outputs.go-version }}" ]
       fail-fast: true
     name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build
 
     env:
       GOPRIVATE: "github.com/hashicorp"
       GO111MODULE: on
-      LD_FLAGS: ${{ needs.set-ld-flags.outputs.ldflags }}
 
     steps:
       - uses: actions/checkout@v3
-      - name: Setup go
+      - name: Set up go
         uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}
-      - name: Set sha
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "::set-output name=go-build::$(go env GOCACHE)"
+          echo "::set-output name=go-mod::$(go env GOMODCACHE)"
+      - name: Set up Go modules cache
+        uses: actions/cache@v3
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: Determine SHA
         id: set-sha
         run: echo "::set-output name=sha::$(head -n1 internal/ui/VERSION | cut -d ' ' -f1)"
       - name: Download UI artifact
@@ -257,9 +265,9 @@ jobs:
           workflow: build-admin-ui.yaml
           commit: ${{ steps.set-sha.outputs.sha }}
           repo: "hashicorp/boundary-ui"
-          name: admin-ui-${{ needs.get-product-edition.outputs.product-edition }}
+          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
           path: internal/ui/.tmp/boundary-ui/ui/admin/dist
-      - name: Go Build
+      - name: Go build
         env:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
@@ -267,16 +275,16 @@ jobs:
         run: |
           mkdir out
           make build
-          zip -r -j out/${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip bin/
+          zip -r -j out/${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip bin/
       - uses: actions/upload-artifact@v3
         with:
-          name: ${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
-          path: out/${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
+          name: ${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
+          path: out/${{ env.PKG_NAME }}_${{ needs.product-metadata.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
 
   build-docker:
     name: Docker ${{ matrix.arch }} build
     needs:
-      - get-product-version
+      - product-metadata
       - build-linux
     runs-on: ubuntu-latest
     strategy:
@@ -284,8 +292,8 @@ jobs:
         arch: ["arm", "arm64", "386", "amd64"]
     env:
       repo: ${{ github.event.repository.name }}
-      version: ${{ needs.get-product-version.outputs.product-version }}
-      minor-version: ${{ needs.get-product-version.outputs.product-minor-version }}
+      version: ${{ needs.product-metadata.outputs.product-version }}
+      minor-version: ${{ needs.product-metadata.outputs.product-minor-version }}
     steps:
       - uses: actions/checkout@v3
       - name: Docker Build (Action)
@@ -302,3 +310,20 @@ jobs:
           dev_tags: |
             docker.io/hashicorppreview/${{ env.repo }}:${{ env.minor-version }}-dev
             docker.io/hashicorppreview/${{ env.repo }}:${{ env.minor-version }}-dev-${{ github.sha }}
+
+  enos:
+    name: Enos
+    # Only run the Enos workflow on pull requests that have been originated from
+    # the hashicorp/boundary repository. As Enos scenarios require access to
+    # Github Actions secrets, it only makes sense to run this workflow when those
+    # secrets are available. Any pull requests from forks will not trigger the
+    # workflow.
+    if: "! github.event.pull_request.head.repo.fork"
+    needs:
+      - product-metadata
+      - build-linux
+    uses: ./.github/workflows/enos-run.yml
+    with:
+      artifact-name: "boundary_${{ needs.product-metadata.outputs.product-version }}_linux_amd64.zip"
+      go-version: ${{ needs.product-metadata.outputs.go-version }}
+    secrets: inherit

.github/workflows/enos-fmt.yml

@@ -0,0 +1,27 @@
+---
+name: enos_fmt
+
+on:
+  pull_request:
+    paths:
+      - enos/**
+
+jobs:
+  fmt_check:
+    # Only run this workflow on pull requests from hashicorp/boundary branches
+    # as we need secrets to install enos.
+    if: "! github.event.pull_request.head.repo.fork"
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.SERVICE_USER_GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v3
+      - uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_wrapper: false
+      - uses: hashicorp/action-setup-enos@v1
+        with:
+          github-token: ${{ secrets.SERVICE_USER_GITHUB_TOKEN }}
+      - name: "check formatting"
+        working-directory: ./enos
+        run: make check-fmt

.github/workflows/enos-run.yml

@@ -0,0 +1,176 @@
+---
+name: enos
+
+on:
+  # Only trigger this working using workflow_call. It assumes that secrets are
+  # being inherited from the caller.
+  workflow_call:
+    inputs:
+      artifact-name:
+        required: true
+        type: string
+      go-version:
+        required: true
+        type: string
+
+env:
+  PKG_NAME: boundary
+
+jobs:
+  enos:
+    name: Integration
+    strategy:
+      matrix:
+        include:
+          - test: smoke
+          - test: cli_ui
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.SERVICE_USER_GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ inputs.go-version }}
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          # the terraform wrapper will break Terraform execution in enos because
+          # it changes the output to text when we expect it to be JSON.
+          terraform_wrapper: false
+      - name: Import GPG key for Boundary pass keystore
+        if: matrix.test == 'cli_ui'
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v5
+        with:
+          gpg_private_key: ${{ secrets.ENOS_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.ENOS_GPG_PASSPHRASE }}
+      - name: Trust the pass keystore GPG key
+        if: matrix.test == 'cli_ui'
+        id: trust_gpg
+        run: |
+          gpg -a --encrypt -r ${{ secrets.ENOS_GPG_UID }} --trust-model always
+          echo "trusted-key ${{ secrets.ENOS_GPG_UID }}" >> ~/.gnupg/gpg.conf
+          cat ~/.gnupg/gpg.conf
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-skip-session-tagging: true
+          role-duration-seconds: 3600
+      - name: Set up Enos
+        uses: hashicorp/action-setup-enos@v1
+        with:
+          github-token: ${{ secrets.SERVICE_USER_GITHUB_TOKEN }}
+      - name: Set up AWS SSH private key
+        run: |
+          mkdir -p ./enos/support
+          echo "${{ secrets.ENOS_CI_SSH_KEYPAIR }}" > ./enos/support/private_key.pem
+          chmod 600 ./enos/support/private_key.pem
+      - name: Set up Bats CLI UI tests dependency cache
+        if: matrix.test == 'cli_ui'
+        id: dep-cache
+        uses: actions/cache@v3
+        with:
+          path: /tmp/bats-cli-ui-deps
+          key: enos-bats-cli-ui-deps-jq-1.6-password-store-1.7.4
+      - name: Set up Node for Bats install
+        if: matrix.test == 'cli_ui'
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: Install Bats via NPM
+        if: matrix.test == 'cli_ui'
+        # Use npm so this workflow is portable on multiple runner distros
+        run: npm install --location=global bats
+      - name: Download jq for Bats CLI UI tests
+        if: matrix.test == 'cli_ui' && steps.dep-cache.outputs.cache-hit != 'true'
+        # NOTE: if you update the jq version make sure to update the dep cache key
+        run: |
+          mkdir -p /tmp/bats-cli-ui-deps
+          wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -O /tmp/bats-cli-ui-deps/jq-bin
+      - name: Install jq for Bats CLI UI tests
+        if: matrix.test == 'cli_ui'
+        run: |
+          chmod +x /tmp/bats-cli-ui-deps/jq-bin
+          sudo cp /tmp/bats-cli-ui-deps/jq-bin /usr/local/bin/jq
+      - name: Download and unzip pass for Boundary keyring
+        if: matrix.test == 'cli_ui' && steps.dep-cache.outputs.cache-hit != 'true'
+        # NOTE: if you update the password store version make sure to update the dep cache key
+        run: |
+          mkdir -p /tmp/bats-cli-ui-deps/pass
+          wget https://git.zx2c4.com/password-store/snapshot/password-store-1.7.4.tar.xz -O /tmp/bats-cli-ui-deps/pass/pass.tar.xz
+          cd /tmp/bats-cli-ui-deps/pass
+          tar -xvf pass.tar.xz
+      - name: Install pass for Boundary keyring
+        if: matrix.test == 'cli_ui'
+        run: |
+          cd /tmp/bats-cli-ui-deps/pass/password-store-1.7.4
+          sudo make install
+          pass init ${{ secrets.ENOS_GPG_UID }}
+      - name: Download Linux AMD64 Boundary bundle
+        id: download
+        uses: actions/download-artifact@v3
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: ./enos/support/downloads
+      - name: Unzip and rename Boundary bundle
+        run: |
+          unzip ${{steps.download.outputs.download-path}}/*.zip -d enos/support
+          mv ${{steps.download.outputs.download-path}}/*.zip enos/support/boundary.zip
+      - name: Run Enos scenario
+        id: run
+        # Continue once and retry
+        continue-on-error: true
+        env:
+          ENOS_VAR_aws_region: us-east-1
+          ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-keypair
+          ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
+          ENOS_VAR_local_boundary_dir: ./support/
+          ENOS_VAR_crt_bundle_path: ./support/boundary.zip
+          ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
+          # Skip a few known failing bats tests
+          ENOS_VAR_skip_failing_bats_tests: "true"
+        run: |
+          mkdir -p ./enos/terraform-plugin-cache
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          enos scenario run --timeout 60m0s --chdir ./enos integration test:${{ matrix.test}} builder:crt
+      - name: Retry Enos scenario
+        id: run_retry
+        if: steps.run.outcome == 'failure'
+        env:
+          ENOS_VAR_aws_region: us-east-1
+          ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-keypair
+          ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
+          ENOS_VAR_local_boundary_dir: ./support/
+          ENOS_VAR_crt_bundle_path: ./support/boundary.zip
+          ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
+          # Skip a few known failing bats tests
+          ENOS_VAR_skip_failing_bats_tests: "true"
+        run: |
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          enos scenario run --timeout 60m0s --chdir ./enos integration test:${{ matrix.test}} builder:crt
+      - name: Destroy Enos scenario
+        if: ${{ always() }}
+        env:
+          ENOS_VAR_aws_region: us-east-1
+          ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-keypair
+          ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
+          ENOS_VAR_local_boundary_dir: ./support/
+          ENOS_VAR_crt_bundle_path: ./support/boundary.zip
+          ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
+          # Skip a few known failing bats tests
+          ENOS_VAR_skip_failing_bats_tests: "true"
+        run: |
+          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
+          enos scenario destroy --timeout 60m0s --chdir ./enos integration test:${{ matrix.test}} builder:crt
+      - name: Output debug information on failure
+        if: ${{ failure() }}
+        run: |
+          env
+          find ./enos -name "scenario.tf" -exec cat {} \;