ci(test): create reusable distributed tests workflow (#2805)

.github/workflows/run-aws-tests-on-pr.yml

@@ -0,0 +1,54 @@
+name: Run AWS tests
+
+on:
+  pull_request_target:
+    branches: [main]
+    #opened, reopened and synchronize will cause the workflow to fail on forks due to permissions
+    #once labeled, that will then be overridden by the is-collaborator job
+    types: [opened, labeled, synchronize, reopened]
+
+jobs:
+  is-collaborator:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get User Permission
+        id: checkAccess
+        uses: actions-cool/check-user-permission@cd622002ff25c2311d2e7fb82107c0d24be83f9b
+        with:
+          require: write
+          username: ${{ github.actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check User Permission
+        if: steps.checkAccess.outputs.require-result == 'false'
+        run: |
+          echo "${{ github.actor }} does not have permissions on this repo."
+          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
+          exit 1
+
+  publish-branch-image:
+    if: contains( github.event.pull_request.labels.*.name, 'run-aws-tests' )
+    needs: is-collaborator
+    uses: ./.github/workflows/docker-ecs-worker-image.yml
+    permissions:
+      contents: read
+      id-token: write
+    secrets:
+      ECR_WORKER_IMAGE_PUSH_ROLE_ARN: ${{ secrets.ECR_WORKER_IMAGE_PUSH_ROLE_ARN }}
+    with:
+      COMMIT_SHA: ${{ github.event.pull_request.head.sha || null }} # this should only be run with this ref if is-collaborator has been run and passed
+
+  run-distributed-tests:
+    needs: publish-branch-image
+    uses: ./.github/workflows/run-distributed-tests.yml
+    with:
+      COMMIT_SHA: ${{ github.event.pull_request.head.sha || null }}
+    permissions:
+      contents: read
+      id-token: write
+    secrets:
+      ARTILLERY_CLOUD_ENDPOINT_TEST: ${{ secrets.ARTILLERY_CLOUD_ENDPOINT_TEST }}
+      ARTILLERY_CLOUD_API_KEY_TEST: ${{ secrets.ARTILLERY_CLOUD_API_KEY_TEST }}
+      DD_TESTS_API_KEY: ${{ secrets.DD_TESTS_API_KEY }}
+      DD_TESTS_APP_KEY: ${{ secrets.DD_TESTS_APP_KEY }}
+      AWS_TEST_EXECUTION_ROLE_ARN_TEST5: ${{ secrets.AWS_TEST_EXECUTION_ROLE_ARN_TEST5 }}

.github/workflows/run-aws-tests.yml → .github/workflows/run-distributed-tests.yml

@@ -1,52 +1,42 @@
 name: Run AWS tests
 
 on:
-  pull_request_target:
-    branches: [main]
-    #opened, reopened and synchronize will cause the workflow to fail on forks due to permissions
-    #once labeled, that will then be overridden by the is-collaborator job
-    types: [opened, labeled, synchronize, reopened]
-
-jobs:
-  is-collaborator:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Get User Permission
-        id: checkAccess
-        uses: actions-cool/check-user-permission@cd622002ff25c2311d2e7fb82107c0d24be83f9b
-        with:
-          require: write
-          username: ${{ github.actor }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check User Permission
-        if: steps.checkAccess.outputs.require-result == 'false'
-        run: |
-          echo "${{ github.actor }} does not have permissions on this repo."
-          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
-          exit 1
-
-  publish-branch-image:
-    if: contains( github.event.pull_request.labels.*.name, 'run-aws-tests' )
-    needs: is-collaborator
-    uses: ./.github/workflows/docker-ecs-worker-image.yml
-    permissions:
-      contents: read
-      id-token: write
+  workflow_call:
+    inputs:
+      COMMIT_SHA:
+        type: string
+      ARTILLERY_VERSION_OVERRIDE:
+        type: string
     secrets:
-      ECR_WORKER_IMAGE_PUSH_ROLE_ARN: ${{ secrets.ECR_WORKER_IMAGE_PUSH_ROLE_ARN }}
-    with:
-      COMMIT_SHA: ${{ github.event.pull_request.head.sha || null }} # this should only be run with this ref if is-collaborator has been run and passed
+      ARTILLERY_CLOUD_ENDPOINT_TEST: 
+        required: true
+        description: 'The endpoint for the Artillery Cloud API'
+      ARTILLERY_CLOUD_API_KEY_TEST:
+        required: true
+        description: 'The api key for the Artillery Cloud API'
+      DD_TESTS_API_KEY:
+        required: true
+        description: 'The api key for the Datadog API'
+      DD_TESTS_APP_KEY:
+        required: true
+        description: 'The app key for the Datadog API'
+      AWS_TEST_EXECUTION_ROLE_ARN_TEST5:
+        required: true
+        description: 'The role to assume for the AWS tests'
+
+permissions:
+  contents: read
+  id-token: write
 
+jobs:
   generate-test-matrix:
     runs-on: ubuntu-latest
-    needs: publish-branch-image
     outputs:
       matrix: ${{ steps.generate-matrix.outputs.matrix }}
     steps:
       - uses: actions/checkout@v3
         with:
-          ref: ${{ github.event.pull_request.head.sha || null }}
+          ref: ${{ inputs.COMMIT_SHA || null }}
       - name: Use Node.js 18.x
         uses: actions/setup-node@v3
         with:
@@ -57,7 +47,6 @@ jobs:
           echo "matrix=$RESULT" >> $GITHUB_OUTPUT
 
   run-tests:
-    if: contains( github.event.pull_request.labels.*.name, 'run-aws-tests' )
     needs: generate-test-matrix
     timeout-minutes: 60
     runs-on: ubuntu-latest
@@ -69,7 +58,7 @@ jobs:
       contents: read
       id-token: write
     env:
-      ECR_IMAGE_VERSION: ${{ github.event.pull_request.head.sha || github.sha }} # the image is published with the sha of the commmit in the branch
+      ECR_IMAGE_VERSION: ${{ inputs.COMMIT_SHA || github.sha }}
       ARTILLERY_CLOUD_ENDPOINT: ${{ secrets.ARTILLERY_CLOUD_ENDPOINT_TEST }}
       ARTILLERY_CLOUD_API_KEY: ${{ secrets.ARTILLERY_CLOUD_API_KEY_TEST }}
       DD_TESTS_API_KEY: ${{ secrets.DD_TESTS_API_KEY }}
@@ -79,7 +68,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
-          ref: ${{ github.event.pull_request.head.sha || null }} # this should only be run with this ref if is-collaborator has been run and passed
+          ref: ${{ inputs.COMMIT_SHA || null }} # in a PR we make a collaborator check, otherwise this would override pull_request_target
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
         env: