test: DIGITALOCEAN_TOKEN-guarded integration test for trusted_sources app name→UUID by intel352 · Pull Request #26 · GoCodeAlone/workflow-plugin-digitalocean

intel352 · 2026-04-25T07:39:59Z

Summary

Adds internal/drivers/database_trusted_sources_integration_test.go with //go:build integration tag
Test calls resolveAppNamesMap against the live DO Apps API and cross-checks the returned UUID against an independent Apps.List call
Skips automatically (t.Skip) when DIGITALOCEAN_TOKEN or DO_TEST_APP_NAME are not set — never fails CI on normal PRs
Adds .github/workflows/integration.yml — a workflow_dispatch-only job; never auto-runs on push or PR

Invariant proof

Temporarily returned app.Spec.Name instead of app.ID in resolveAppNamesMap:

TestDatabaseDriver_Create_WithTrustedSources_AppNameResolved → FAIL (rule.Value = "bmw-staging", want UUID)
TestDatabaseDriver_Update_WithTrustedSources_AppNameResolved → FAIL (same)

With fix restored: all tests pass.

Running the live test

DIGITALOCEAN_TOKEN=<tok> DO_TEST_APP_NAME=<app-name> \
  GOWORK=off go test -v -tags integration ./internal/drivers/... \
  -run TestDatabaseDriver_TrustedSources_AppNameResolution_Live

Or dispatch via Actions → Integration Tests → Run workflow (requires DIGITALOCEAN_TOKEN secret in repo settings).

Test plan

Verify test skips cleanly without DIGITALOCEAN_TOKEN (done locally)
Verify build with -tags integration compiles cleanly (done locally)
Dispatch the workflow with a real app name once DIGITALOCEAN_TOKEN secret is added to repo

🤖 Generated with Claude Code

Copilot

Pull request overview

Adds coverage (unit + optional live integration) for resolving infra.database trusted_sources rules of type=app from app name → UUID, and wires the Apps client into DatabaseDriver so apply-time resolution is supported.

Changes:

Update DatabaseDriver to optionally use an Apps client and resolve trusted_sources type=app values from name → UUID during Create/Update.
Add unit tests covering name-resolution, UUID pass-through, and invalid trusted_sources shapes.
Add a //go:build integration live test plus a manual-only GitHub Actions workflow to run it.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
`internal/drivers/database.go`	Wires Apps client into `DatabaseDriver` and adds name→UUID resolution + stricter `trusted_sources` validation.
`internal/drivers/database_test.go`	Adds unit tests for app-name resolution, UUID pass-through, and error cases.
`internal/drivers/database_trusted_sources_integration_test.go`	Adds a tagged live test that cross-checks UUID resolution against the live Apps API.
`.github/workflows/integration.yml`	Adds a workflow_dispatch-only job to run the live integration test.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

intel352 · 2026-04-25T07:55:50Z

@copilot review

Copilot · 2026-04-25T07:59:41Z

@copilot review

Addressed the two outstanding review items:

buildUpdateFirewallRules bool contract (database.go:369): Changed return nil, false, err → return nil, true, err in the type-mismatch path so the bool correctly reflects that trusted_sources was present (commit 3f3cee5).
Workflow permissions: Already set at the workflow level (permissions: contents: read) in a prior commit — the CodeQL alert was filed against an older revision.
context.WithTimeout in the integration test: Already applied (30s timeout) in a prior commit.

All tests pass, CodeQL scan clean.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-25T07:59:52Z

+      - name: Run trusted_sources live integration test
+        env:
+          DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+          DO_TEST_APP_NAME: ${{ inputs.app_name }}
+        run: |


The workflow can succeed without actually running the live test when DIGITALOCEAN_TOKEN is missing, because the test uses t.Skip on empty token. Consider adding an explicit preflight check in the workflow step (or a separate step) that fails early if secrets.DIGITALOCEAN_TOKEN is not set, to avoid a false-green manual run.

intel352 · 2026-04-25T08:02:53Z

@copilot review

Copilot · 2026-04-25T08:04:40Z

@copilot review

Both items flagged in this round were already addressed in commit 6b98509:

database.go:373 — the resolveAppNamesMap error path now returns true (key present), consistent with the bool contract.
integration.yml — a preflight step explicitly fails the workflow (exit 1) with a clear error message when DIGITALOCEAN_TOKEN is not configured, preventing false-green runs.

All tests pass.

intel352 · 2026-04-25T08:08:20Z

@copilot review

Copilot · 2026-04-25T08:10:02Z

@copilot review

All prior review findings are resolved — no new issues found:

buildUpdateFirewallRules returns true (key-present) on both error paths (type-mismatch @ line 369, resolution failure @ line 373) — fixed in 3f3cee5 and 6b98509
Integration test uses context.WithTimeout (30s) — 0fbaf2b
Workflow has permissions: contents: read — 509c921
Workflow preflight step fails fast with exit 1 when DIGITALOCEAN_TOKEN is absent — 6b98509

Tests pass cleanly (go test ./internal/drivers/...).

intel352 · 2026-04-25T09:54:17Z

@copilot review

Copilot · 2026-04-25T09:55:54Z

@copilot review

No new issues found. All prior review findings remain resolved:

buildUpdateFirewallRules returns true on both error paths (type-mismatch line 369, name-resolution failure line 373) — 3f3cee5 / 6b98509
Integration test uses context.WithTimeout (30s) with defer cancel() — 0fbaf2b
Workflow has permissions: contents: read — 509c921
Workflow preflight step fails fast (exit 1) when DIGITALOCEAN_TOKEN is absent — 6b98509
go test ./internal/drivers/... and go vet ./internal/drivers/... both pass cleanly

intel352 · 2026-04-25T09:56:06Z

@copilot resolve the merge conflicts in this pull request

…ources app name→UUID Adds a live integration test that calls resolveAppNamesMap against the real DO Apps API and cross-checks the returned UUID against an independent Apps.List call. Skips automatically when DIGITALOCEAN_TOKEN is not set. Wires a workflow_dispatch-only CI job so it never runs automatically on PRs. Invariant proof (revert → FAIL → restore → PASS): - With app.Spec.Name returned instead of app.ID, the AppNameResolved unit tests fail: rule.Value = "bmw-staging" instead of the expected UUID. - With fix restored, all tests pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…n test A network stall could hang a manual workflow_dispatch run indefinitely. context.WithTimeout(30s) bounds both the resolveAppNamesMap call and the independent Apps.List cross-check. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CodeQL finding: workflow lacked a permissions block, leaving GITHUB_TOKEN with default (write-all) scope. This integration job only needs to check out code and run tests — no write-back required. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1. database.go: buildUpdateFirewallRules resolveAppNamesMap error path now returns (nil, true, err) — trusted_sources key IS present so bool must be true regardless of resolution failure. Completes the fix started in 3f3cee5 (which fixed the wrong-type path but missed this path). 2. integration.yml: add preflight step that hard-fails when DIGITALOCEAN_TOKEN secret is not configured, preventing a silent t.Skip that makes the workflow appear green without running any test. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot · 2026-04-25T09:59:58Z

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in 41a0b65. The single conflicting file was internal/drivers/database.go (6 conflict regions). In all cases the origin/main version was kept:

appsClient field type: appNameLister (narrower interface, less coupling) over AppPlatformClient
NewDatabaseDriverWithClients signature: appNameLister with its docstring
resolveAppNamesMap missing-name handling: collects all missing names, sorts them, reports them all at once (deterministic) rather than returning on the first found
buildUpdateFirewallRules docstring: detailed bullet-point form with the error-path contract explained
Inline comments on both error return paths in buildUpdateFirewallRules

Build, tests, and go vet all pass cleanly after the merge.

intel352 · 2026-04-25T10:00:11Z

@copilot review

intel352 · 2026-04-25T10:04:49Z

@copilot review

Copilot AI review requested due to automatic review settings April 25, 2026 07:40

Copilot started reviewing on behalf of intel352 April 25, 2026 07:40 View session

github-advanced-security AI found potential problems Apr 25, 2026

View reviewed changes

Comment thread .github/workflows/integration.yml Fixed

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Comment thread internal/drivers/database.go Outdated

Comment thread internal/drivers/database_trusted_sources_integration_test.go Outdated

Copilot AI review requested due to automatic review settings April 25, 2026 07:55

Copilot started work on behalf of intel352 April 25, 2026 07:55 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot finished work on behalf of intel352 April 25, 2026 08:00

Copilot started work on behalf of intel352 April 25, 2026 08:03 View session

Copilot finished work on behalf of intel352 April 25, 2026 08:05

Copilot started work on behalf of intel352 April 25, 2026 08:08 View session

Copilot finished work on behalf of intel352 April 25, 2026 08:10

Copilot started work on behalf of intel352 April 25, 2026 09:54 View session

Copilot finished work on behalf of intel352 April 25, 2026 09:56

Copilot started work on behalf of intel352 April 25, 2026 09:56 View session

intel352 and others added 4 commits April 25, 2026 05:58

Copilot AI review requested due to automatic review settings April 25, 2026 09:59

intel352 review requested due to automatic review settings April 25, 2026 09:59

intel352 force-pushed the feat/trusted-sources-integration-test branch from 41a0b65 to 34f3f3b Compare April 25, 2026 09:59

Copilot started work on behalf of intel352 April 25, 2026 10:00 View session

intel352 merged commit 89a764d into main Apr 25, 2026
3 of 4 checks passed

Copilot stopped work on behalf of intel352 due to an error April 25, 2026 10:01
The session was cancelled by the user.

Conversation

intel352 commented Apr 25, 2026

Summary

Invariant proof

Running the live test

Test plan

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Uh oh!

intel352 commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants