From 4065954e5f9cefe02dc526951efb28afc7e8b661 Mon Sep 17 00:00:00 2001
From: Timo Furrer <tfurrer@gitlab.com>
Date: Tue, 5 Nov 2024 13:27:14 +0100
Subject: [PATCH] Support `warning_on_none_empty_plan` input in `plan` job.

Changelog: added
---
 src/gitlab-tofu.sh                            |  7 +++-
 templates/plan.yml                            | 25 +++++++++++++
 .../WarningOnNoneEmptyPlan.gitlab-ci.yml      | 36 +++++++++++++++++++
 tests/integration.gitlab-ci.yml               |  1 +
 4 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 tests/integration-tests/WarningOnNoneEmptyPlan.gitlab-ci.yml

diff --git a/src/gitlab-tofu.sh b/src/gitlab-tofu.sh
index b552713..1d4eb46 100644
--- a/src/gitlab-tofu.sh
+++ b/src/gitlab-tofu.sh
@@ -237,9 +237,14 @@ if [ $sourced -eq 0 ]; then
       terraform_init "${@}"
     ;;
     "plan")
+      plan_args=''
+      if [ "${OPENTOFU_COMPONENT_USE_DETAILED_EXITCODE}" = 'true' ]; then
+        plan_args='-detailed-exitcode'
+      fi
+
       $TF_IMPLICIT_INIT && terraform_init
       # shellcheck disable=SC2086
-      tofu "${TF_CHDIR_OPT}" "${@}" -input=false -out="${TF_PLAN_CACHE}" ${var_file_args}
+      tofu "${TF_CHDIR_OPT}" "${@}" -input=false -out="${TF_PLAN_CACHE}" ${var_file_args} ${plan_args}
     ;;
     "plan-json")
       tofu "${TF_CHDIR_OPT}" show -json "${TF_PLAN_CACHE}" | \
diff --git a/templates/plan.yml b/templates/plan.yml
index b08502a..c10d2d3 100644
--- a/templates/plan.yml
+++ b/templates/plan.yml
@@ -99,11 +99,31 @@ spec:
       default: pull-push
       type: string
       description: 'Defines the cache policy of the job.'
+    warning_on_none_empty_plan:
+      default: false
+      type: boolean
+      description: 'Whether to mark the job with a warning if the plan contains a diff.'
 
 ---
 
+# NOTE: the two following jobs are necessary to implement the abstraction logic
+# required for the `warning_on_none_empty_plan` input.
+# Without any kind of flow control support for the GitLab CI YAML we cannot infer
+# another value from the input. However, we can clearly apply "inheritance" to
+# customize behavior related to the CI keywords that have otherwise nothing
+# in common with the inputs value.
+'.$[[ inputs.as ]]:detailed_exitcode:warning:false':
+  extends: null
+
+'.$[[ inputs.as ]]:detailed_exitcode:warning:true':
+  allow_failure:
+    exit_codes: [2]
+
 '$[[ inputs.as ]]':
   stage: $[[ inputs.stage ]]
+  extends:
+    # NOTE: see the comment above. This is to support the `warning_on_none_empty_plan` input.
+    - '.$[[ inputs.as ]]:detailed_exitcode:warning:$[[ inputs.warning_on_none_empty_plan ]]'
   environment:
     name: $[[ inputs.state_name ]]
     action: prepare
@@ -131,6 +151,11 @@ spec:
     TF_STATE_NAME: $[[ inputs.state_name ]]
     TF_PLAN_NAME: $[[ inputs.plan_name ]]
     OPENTOFU_COMPONENT_VAR_FILE: '$[[ inputs.var_file ]]'
+    OPENTOFU_COMPONENT_USE_DETAILED_EXITCODE: '$[[ inputs.warning_on_none_empty_plan ]]'
+    # NOTE: we rely on correct exitcode reporting behavior for the `warning_on_none_empty_plan` input
+    # behavior. However, when using bash the runner does not work properly without setting
+    # the feature flag below to `true`.
+    FF_USE_NEW_BASH_EVAL_STRATEGY: 'true'
   image:
     name: '$[[ inputs.image_registry_base ]]/$[[ inputs.image_name ]]:$[[ inputs.version ]]-opentofu$[[ inputs.opentofu_version ]]-$[[ inputs.base_os ]]$[[ inputs.image_digest ]]'
   script:
diff --git a/tests/integration-tests/WarningOnNoneEmptyPlan.gitlab-ci.yml b/tests/integration-tests/WarningOnNoneEmptyPlan.gitlab-ci.yml
new file mode 100644
index 0000000..1c3fbf5
--- /dev/null
+++ b/tests/integration-tests/WarningOnNoneEmptyPlan.gitlab-ci.yml
@@ -0,0 +1,36 @@
+include:
+  - component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/plan@$CI_COMMIT_SHA
+    inputs:
+      image_registry_base: $GITLAB_OPENTOFU_IMAGE_BASE
+      version: $CI_COMMIT_SHA
+      base_os: $GITLAB_OPENTOFU_BASE_IMAGE_OS
+      opentofu_version: $OPENTOFU_VERSION
+      root_dir: $TEST_TF_ROOT
+      state_name: $TEST_TF_STATE_NAME
+      warning_on_none_empty_plan: true
+
+  # For CI Terraform state cleanup
+  - component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/delete-state@$CI_COMMIT_SHA
+    inputs:
+      state_name: $TEST_TF_STATE_NAME
+      rules: [{when: always}]
+
+stages: [build, cleanup, verify]
+
+verify:plan-job:has-warning-state:
+  stage: verify
+  needs: ['plan']
+  rules: [{when: always}]
+  image: alpine:latest
+  before_script:
+    - apk add --update curl jq
+  script:
+    - |
+      endpoint="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/pipelines/${CI_PIPELINE_ID}/jobs"
+      is_warning_job=$(curl --silent "$endpoint" | jq -r '.[] | select(.name == "plan") | [.status == "failed", .allow_failure == true] | all')
+      if [ "$is_warning_job" != 'true' ]; then
+        echo 'Error: the plan job was not in warning state.'
+        exit 1
+      else
+        echo 'Success: the plan job was in warning state.'
+      fi
diff --git a/tests/integration.gitlab-ci.yml b/tests/integration.gitlab-ci.yml
index af76bcb..90e8bc1 100644
--- a/tests/integration.gitlab-ci.yml
+++ b/tests/integration.gitlab-ci.yml
@@ -16,6 +16,7 @@ component:
           - ModuleRelease
           - Destroy
           - VarFile
+          - WarningOnNoneEmptyPlan
         GITLAB_OPENTOFU_BASE_IMAGE_OS:
           - alpine
           - debian
-- 
GitLab