packer-test.yaml

name: Packer Test

on:
  workflow_call:
    inputs:
      runs-on:
        description: >-
          Runner label. Defaults to ubuntu-latest. Override to a self-hosted
          runner label if you want to run CI on your own scale set.
        required: false
        default: ubuntu-latest
        type: string
      semantic_version:
        description: Semantic version to test against
        required: false
        type: string
      env:
        description: Environment name the image was tagged with (dev, prod, ...). Forwarded to the smoke test as $ENV so the snapshot selector matches the build.
        required: false
        type: string
      test_script:
        description: Path to the smoke test script
        required: false
        type: string
        default: ./packer/tests/smoke-test.sh
      provider_env_var:
        description: Name of the env var the smoke test expects for the provider API token (e.g. HCLOUD_TOKEN, DIGITALOCEAN_TOKEN).
        required: true
        type: string
    secrets:
      provider_token:
        description: Provider API token exposed as the env var named by provider_env_var.
        required: true

permissions:
  contents: read

jobs:
  packer-test:
    name: Packer Smoke Test
    runs-on: ${{ inputs.runs-on }}
    # Opt into Node 24 so hashicorp/setup-packer (still on node20 at v3.2.0)
    # does not emit the deprecation warning on every run. GitHub forces Node 24
    # for all JS actions from 2026-06-02; this drop-out is removable then.
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Export provider credentials
        env:
          PROVIDER_ENV_VAR: ${{ inputs.provider_env_var }}
          PROVIDER_TOKEN: ${{ secrets.provider_token }}
        run: |
          set -euo pipefail
          # Randomized heredoc delimiter per GitHub's own guidance, so a token
          # value can never smuggle a matching terminator line into GITHUB_ENV.
          DELIM="PROVIDER_TOKEN_EOF_$(openssl rand -hex 16)"
          {
            echo "${PROVIDER_ENV_VAR}<<${DELIM}"
            printf '%s\n' "$PROVIDER_TOKEN"
            echo "${DELIM}"
          } >> "$GITHUB_ENV"

      - name: Run Packer smoke test
        env:
          PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SEMANTIC_VERSION: ${{ inputs.semantic_version }}
          ENV: ${{ inputs.env }}
          TEST_SCRIPT: ${{ inputs.test_script }}
        run: '"$TEST_SCRIPT"'