Merge pull request #3274 from GoogleCloudPlatform/iam-deny

chore: update iam deny test

.github/workflows/iam-deny.yaml

@@ -19,65 +19,82 @@ on:
     - main
     paths:
     - 'iam/deny/**'
+    - '.github/workflows/iam-deny.yaml'
   pull_request:
     paths:
     - 'iam/deny/**'
+    - '.github/workflows/iam-deny.yaml'
   pull_request_target:
     types: [labeled]
     paths:
     - 'iam/deny/**'
+    - '.github/workflows/iam-deny.yaml'
   schedule:
   - cron:  '0 0 * * 0'
 jobs:
   test:
-    if: ${{ github.event.action != 'labeled' || github.event.label.name == 'actions:force-run' }}
+    if: github.event.action != 'labeled' || github.event.label.name == 'actions:force-run'
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 120
     permissions:
       contents: 'write'
       pull-requests: 'write'
       id-token: 'write'
+    defaults:
+      run:
+        working-directory: 'iam/deny'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v3.3.0
       with:
-        ref: ${{github.event.pull_request.head.ref}}
-        repository: ${{github.event.pull_request.head.repo.full_name}}
-    - uses: google-github-actions/auth@v1.1.1
+        ref: ${{github.event.pull_request.head.sha}}
+    - uses: 'google-github-actions/auth@v1.0.0'
       with:
         workload_identity_provider: 'projects/949737848314/locations/global/workloadIdentityPools/iam-deny-test-pool/providers/iam-deny-test-provider'
         service_account: 'kokoro-ca@isakovf-iam-deny-samples.iam.gserviceaccount.com'
         create_credentials_file: 'true'
         access_token_lifetime: 600s
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v3.6.0
       with:
-        node-version: 14
-    - run: npm install
-      working-directory: iam/deny
-    - run: npm test
-      working-directory: iam/deny
-      env:
-        MOCHA_REPORTER_SUITENAME: iam_deny
-        MOCHA_REPORTER_OUTPUT: iam_deny_sponge_log.xml
-        MOCHA_REPORTER: xunit
-    - if: ${{ github.event.action == 'labeled' && github.event.label.name == 'actions:force-run' }}
-      uses: actions/github-script@v6
+        node-version: 16
+    - name: Get npm cache directory
+      id: npm-cache-dir
+      shell: bash
+      run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}        
+    - uses: actions/cache@v3
+      id: npm-cache
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        script: |
-          try {
-            await github.rest.issues.removeLabel({
-              name: 'actions:force-run',
-              owner: 'GoogleCloudPlatform',
-              repo: 'nodejs-docs-samples',
-              issue_number: context.payload.pull_request.number
-            });
-          } catch (e) {
-            if (!e.message.includes('Label does not exist')) {
-              throw e;
-            }
-          }
-    - if: ${{ github.event_name == 'schedule' && always() }}
+        path: ${{ steps.npm-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-   
+    - name: install repo dependencies
+      run: npm install
+      working-directory: .
+    - name: install directory dependencies
+      run: npm install
+    - run: npm run build
+      continue-on-error: true
+    - name: set env vars for scheduled run
+      if: github.event.action == 'schedule'
       run: |
-        curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot -o flakybot -s -L
-        chmod +x ./flakybot
-        ./flakybot --repo GoogleCloudPlatform/nodejs-docs-samples --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}
+        echo "MOCHA_REPORTER_SUITENAME=iam-deny" >> $GITHUB_ENV
+        echo "MOCHA_REPORTER_OUTPUT=${{github.run_id}}_sponge_log.xml" >> $GITHUB_ENV
+        echo "MOCHA_REPORTER=xunit" >> $GITHUB_ENV
+    - run: npm test
+    - name: upload test results for FlakyBot workflow
+      if: github.event.action == 'schedule' && always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: test-results
+        path: iam/deny/${{ env.MOCHA_REPORTER_OUTPUT }}
+        retention-days: 1        
+  remove_label:
+    if: |
+      github.event.action == 'labeled' &&
+      github.event.label.name == 'actions:force-run' &&
+      always()
+    uses: ./.github/workflows/remove-label.yaml
+  flakybot:
+    if: github.event_name == 'schedule' && always() # always() submits logs even if tests fail
+    uses: ./.github/workflows/flakybot.yaml
+    needs: [test]

.github/workflows/utils/workflows-secrets.json

@@ -3,6 +3,7 @@
   "automl",
   "dialogflow-cx",
   "functions/slack",
+  "iam/deny",
   "security-center/snippets",
   "storagetransfer",
   "vision"

.github/workflows/utils/workflows.json

@@ -72,7 +72,6 @@
   "healthcare/dicom",
   "healthcare/fhir",
   "healthcare/hl7v2",
-  "iam",
   "kms",
   "media/livestream",
   "media/transcoder",

iam/package.json → iam/deny/package.json

@@ -11,7 +11,7 @@
         "node": ">=12.0.0"
     },
     "scripts": {
-        "test": "c8 mocha test/*.test.js --timeout=5000"
+        "test": "c8 mocha test/*.test.js --timeout=60000"
     },
     "dependencies": {
         "@google-cloud/iam": "^0.3.0"

iam/test/deny.test.js → iam/deny/test/deny.test.js

@@ -23,7 +23,7 @@ const iamClient = new PoliciesClient();
 
 const execSync = cmd => cp.execSync(cmd, {encoding: 'utf-8'});
 
-describe.skip('IAM deny samples', () => {
+describe('IAM deny samples', () => {
   let projectId;
   const policyId = `gcloud-test-policy-${uuid.v4().split('-')[0]}`;
   const policyName = `policies/cloudresourcemanager.googleapis.com%2Fprojects%2F949737848314/denypolicies/${policyId}`;
@@ -33,21 +33,19 @@ describe.skip('IAM deny samples', () => {
   });
 
   it('should create IAM policy', async () => {
-    const output = execSync(
-      `node deny/createDenyPolicy ${projectId} ${policyId}`
-    );
+    const output = execSync(`node createDenyPolicy ${projectId} ${policyId}`);
 
     assert.include(output, `Created the deny policy: ${policyName}`);
   });
 
   it('should list IAM policies', async () => {
-    const output = execSync(`node deny/listDenyPolicies ${projectId}`);
+    const output = execSync(`node listDenyPolicies ${projectId}`);
 
     assert.include(output, `- ${policyName}`);
   });
 
   it('should get IAM policies', async () => {
-    const output = execSync(`node deny/getDenyPolicy ${projectId} ${policyId}`);
+    const output = execSync(`node getDenyPolicy ${projectId} ${policyId}`);
 
     assert.include(output, `Retrieved the deny policy: ${policyName}`);
   });
@@ -57,16 +55,14 @@ describe.skip('IAM deny samples', () => {
       name: policyName,
     });
     const output = execSync(
-      `node deny/updateDenyPolicy ${projectId} ${policyId} ${policy.etag}`
+      `node updateDenyPolicy ${projectId} ${policyId} ${policy.etag}`
     );
 
     assert.include(output, `Updated the deny policy: ${policyName}`);
   });
 
   it('should delete IAM policy', async () => {
-    const output = execSync(
-      `node deny/deleteDenyPolicy ${projectId} ${policyId}`
-    );
+    const output = execSync(`node deleteDenyPolicy ${projectId} ${policyId}`);
 
     assert.include(output, `Deleted the deny policy: ${policyName}`);
   });