Flakyness using `auth` action and Workload Identity Federation

# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: v1 periodic
on:
  schedule:
    - cron:  '0 2 * * *'

jobs:
  integration:
    name: integration tests
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, windows-latest, ubuntu-latest]
      fail-fast: false
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - name: Checkout code
        uses: 'actions/[email protected]'
        with:
          ref: v1

      - name: Setup Go
        uses: actions/[email protected]
        with:
          go-version: 1.19

      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/[email protected]'
        with:
          workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: 600s

      - id: 'secrets'
        name: Get secrets
        uses: 'google-github-actions/[email protected]'
        with:
          secrets: |-
            MYSQL_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_CONNECTION_NAME
            MYSQL_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_USER
            MYSQL_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_PASS
            MYSQL_DB:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_DB
            POSTGRES_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CONNECTION_NAME
            POSTGRES_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_USER
            POSTGRES_USER_IAM:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_USER_IAM
            POSTGRES_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_PASS
            POSTGRES_DB:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_DB
            SQLSERVER_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_CONNECTION_NAME
            SQLSERVER_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_USER
            SQLSERVER_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_PASS
            SQLSERVER_DB:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_DB

      - name: Enable fuse config (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo sed -i 's/#user_allow_other/user_allow_other/g' /etc/fuse.conf

      - name: Run tests
        env:
          GOOGLE_CLOUD_PROJECT: '${{ secrets.GOOGLE_CLOUD_PROJECT }}'
          MYSQL_CONNECTION_NAME: '${{ steps.secrets.outputs.MYSQL_CONNECTION_NAME }}'
          MYSQL_USER: '${{ steps.secrets.outputs.MYSQL_USER }}'
          MYSQL_PASS: '${{ steps.secrets.outputs.MYSQL_PASS }}'
          MYSQL_DB: '${{ steps.secrets.outputs.MYSQL_DB }}'
          POSTGRES_CONNECTION_NAME: '${{ steps.secrets.outputs.POSTGRES_CONNECTION_NAME }}'
          POSTGRES_USER: '${{ steps.secrets.outputs.POSTGRES_USER }}'
          POSTGRES_USER_IAM: '${{ steps.secrets.outputs.POSTGRES_USER_IAM }}'
          POSTGRES_PASS: '${{ steps.secrets.outputs.POSTGRES_PASS }}'
          POSTGRES_DB: '${{ steps.secrets.outputs.POSTGRES_DB }}'
          SQLSERVER_CONNECTION_NAME: '${{ steps.secrets.outputs.SQLSERVER_CONNECTION_NAME }}'
          SQLSERVER_USER: '${{ steps.secrets.outputs.SQLSERVER_USER }}'
          SQLSERVER_PASS: '${{ steps.secrets.outputs.SQLSERVER_PASS }}'
          SQLSERVER_DB: '${{ steps.secrets.outputs.SQLSERVER_DB }}'
          TMPDIR: "/tmp"
          TMP: '${{ runner.temp }}'
        # specifying bash shell ensures a failure in a piped process isn't lost by using `set -eo pipefail`
        shell: bash
        run: |
          go test -race -v ./... | tee test_results.txt

      - name: Convert test output to XML
        if: ${{ github.event_name == 'schedule' && always() }}
        run: |
          go install github.com/jstemmer/go-junit-report/[email protected]
          go-junit-report -in test_results.txt -set-exit-code -out v1periodic_sponge_log.xml

      - name: FlakyBot (Linux)
        # only run flakybot on periodic (schedule) event
        if: ${{ github.event_name == 'schedule' && runner.os == 'Linux' && always() }}
        run: |
          curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot -o flakybot -s -L
          chmod +x ./flakybot
          ./flakybot --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}

      - name: FlakyBot (Windows)
        # only run flakybot on periodic (schedule) event
        if: ${{ github.event_name == 'schedule' && runner.os == 'Windows' && always() }}
        run: |
          curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot.exe -o flakybot.exe -s -L
          ./flakybot.exe --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}

      - name: FlakyBot (macOS)
        # only run flakybot on periodic (schedule) event
        if: ${{ github.event_name == 'schedule' && runner.os == 'macOS' && always() }}
        run: |
          curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot-darwin-amd64 -o flakybot -s -L
          chmod +x ./flakybot
          ./flakybot --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}