test.yaml

name: 'Lint and Test'

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:
  # Called by the publish workflows so the gate that guards a release is this exact job, rather
  # than a copy of it that can drift. It drifted once already: the CLI install step was added here
  # and the publish gates kept skipping the Conftest and Trivy tests.
  workflow_call:

permissions:
  contents: read

concurrency:
  # github.workflow resolves to the CALLING workflow's name under workflow_call, so the standalone
  # run and each publish gate land in their own group. A shared group would make the three runs
  # triggered by one manifest push cancel each other, taking the publish down with them.
  group: test-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-and-test:
    name: 'Lint and Test'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: pwsh
    steps:
      - uses: actions/checkout@v4

      # The Conftest and Trivy suites gate themselves on the CLI being present and skip when it is
      # not, so on a bare runner the nine tests covering the gate logic itself (deny handling,
      # -SoftFail, -FailOnWarn, HIGH/CRITICAL failure, and waiver discovery) never ran. Installing
      # both through the module's own installers turns those skips back into real assertions, and
      # exercises the installers on every push as a side effect.
      - name: Install the CLIs the Conftest and Trivy suites need
        run: |
          Import-Module ./LibreDevOpsHelpers/LibreDevOpsHelpers.psd1 -Force
          Install-LdoConftest
          Install-LdoTrivy
          conftest --version
          trivy --version

      - name: Run analyzer and tests
        run: ./Invoke-Tests.ps1