test(action): prove pull request reporting

.github/workflows/pull-request-reporting-demo.yml

@@ -0,0 +1,42 @@
+name: pull request reporting demo
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  architecture-review:
+    name: architecture review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out demo branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Prepare exact demo dialects
+        shell: bash
+        run: |
+          set -euo pipefail
+          for project in before current; do
+            mkdir -p "test/e2e/pull-request-reporting/${project}/.rootform"
+            cp -R \
+              test/e2e/pull-request-reporting/dialects \
+              "test/e2e/pull-request-reporting/${project}/.rootform/dialects"
+          done
+
+      - name: Run Rootform architecture review
+        uses: ./
+        with:
+          artifact-name: rootform-pr-${{ github.event.pull_request.number }}
+          baseline-path: test/e2e/pull-request-reporting/before
+          fail-on-changes: "false"
+          fail-on-violations: "true"
+          github-token: ${{ secrets.ROOTFORM_RELEASES_READ_TOKEN }}
+          path: test/e2e/pull-request-reporting/current
+          pull-request-token: ${{ github.token }}
+          report-diff: "true"
+          version: 0.1.0-dev.2

test/e2e/pull-request-reporting/before/main.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_version = ">= 1.14.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.62.0"
+    }
+  }
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.20.0.0/16"
+}
+
+resource "aws_subnet" "application" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.20.1.0/24"
+}

test/e2e/pull-request-reporting/current/main.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_version = ">= 1.14.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.62.0"
+    }
+  }
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.20.0.0/16"
+}
+
+resource "aws_subnet" "application" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.20.1.0/24"
+}

test/e2e/pull-request-reporting/dialects/aws/dialect.rf

@@ -0,0 +1,11 @@
+dialect "aws" {
+  version = "0.1.0"
+
+  requires {
+    core = "0.1.0"
+  }
+
+  provider "hashicorp/aws" {
+    version = "= 6.62.0"
+  }
+}

test/e2e/pull-request-reporting/dialects/aws/network/ec2.rf

@@ -0,0 +1,198 @@
+# Generated by scripts/generate-aws-dialect.ts.
+concept "customer-gateway" {
+  kind        = entity
+  description = "AWS VPN (Site-to-Site) customer gateway as a durable AWS architecture entity."
+}
+
+concept "ec2-client-vpn-endpoint" {
+  kind        = entity
+  description = "AWS VPN (Client) client VPN endpoint as a durable AWS architecture entity."
+}
+
+concept "ec2-transit-gateway-multicast-domain" {
+  kind        = scope
+  description = "AWS Transit Gateway transit gateway multicast domain as a durable AWS architecture scope."
+}
+
+concept "ec2-transit-gateway-policy-table" {
+  kind        = entity
+  description = "AWS Transit Gateway transit gateway policy table as a durable AWS architecture entity."
+}
+
+concept "ec2-transit-gateway-route-table" {
+  kind        = entity
+  description = "AWS Transit Gateway transit gateway route table as a durable AWS architecture entity."
+}
+
+concept "egress-only-internet-gateway" {
+  kind        = entity
+  description = "Amazon VPC egress-only internet gateway as a durable AWS architecture entity."
+}
+
+concept "internet-gateway" {
+  kind        = entity
+  description = "Amazon VPC internet gateway as a durable AWS architecture entity."
+}
+
+concept "network-acl" {
+  kind        = entity
+  description = "Amazon VPC network ACL as a durable AWS architecture entity."
+}
+
+concept "route-table" {
+  kind        = entity
+  description = "Amazon VPC route table as a durable AWS architecture entity."
+}
+
+concept "security-group" {
+  kind        = entity
+  description = "Amazon VPC security group as a durable AWS architecture entity."
+}
+
+concept "transit-gateway" {
+  kind        = entity
+  description = "An AWS Transit Gateway connecting multiple networks."
+}
+
+concept "transit-gateway-attachment" {
+  kind        = detail
+  description = "A network attachment contributing to an AWS Transit Gateway."
+}
+
+concept "verifiedaccess-endpoint" {
+  kind        = entity
+  description = "AWS Verified Access verified access endpoint as a durable AWS architecture entity."
+}
+
+concept "verifiedaccess-group" {
+  kind        = entity
+  description = "AWS Verified Access verified access group as a durable AWS architecture entity."
+}
+
+concept "verifiedaccess-instance" {
+  kind        = entity
+  description = "AWS Verified Access verified access instance as a durable AWS architecture entity."
+}
+
+concept "vpc-endpoint-service" {
+  kind        = entity
+  description = "Amazon VPC VPC endpoint service as a durable AWS architecture entity."
+}
+
+concept "vpc-ipam-pool" {
+  kind        = scope
+  description = "AWS VPC IPAM (IP Address Manager) ipam pool as a durable AWS architecture scope."
+}
+
+concept "vpc-route-server-endpoint" {
+  kind        = entity
+  description = "Amazon VPC VPC route server endpoint as a durable AWS architecture entity."
+}
+
+rule "customer-gateway" {
+  match {
+    kind = "resource"
+    type = "aws_customer_gateway"
+  }
+
+  as = concept.customer-gateway
+}
+
+rule "ec2-client-vpn-endpoint" {
+  match {
+    kind = "resource"
+    type = "aws_ec2_client_vpn_endpoint"
+  }
+
+  as = concept.ec2-client-vpn-endpoint
+}
+
+rule "ec2-transit-gateway-multicast-domain" {
+  match {
+    kind = "resource"
+    type = "aws_ec2_transit_gateway_multicast_domain"
+  }
+
+  as = concept.ec2-transit-gateway-multicast-domain
+}
+
+rule "ec2-transit-gateway-policy-table" {
+  match {
+    kind = "resource"
+    type = "aws_ec2_transit_gateway_policy_table"
+  }
+
+  as = concept.ec2-transit-gateway-policy-table
+}
+
+rule "ec2-transit-gateway-route-table" {
+  match {
+    kind = "resource"
+    type = "aws_ec2_transit_gateway_route_table"
+  }
+
+  as = concept.ec2-transit-gateway-route-table
+}
+
+rule "egress-only-internet-gateway" {
+  match {
+    kind = "resource"
+    type = "aws_egress_only_internet_gateway"
+  }
+
+  as = concept.egress-only-internet-gateway
+}
+
+rule "verifiedaccess-endpoint" {
+  match {
+    kind = "resource"
+    type = "aws_verifiedaccess_endpoint"
+  }
+
+  as = concept.verifiedaccess-endpoint
+}
+
+rule "verifiedaccess-group" {
+  match {
+    kind = "resource"
+    type = "aws_verifiedaccess_group"
+  }
+
+  as = concept.verifiedaccess-group
+}
+
+rule "verifiedaccess-instance" {
+  match {
+    kind = "resource"
+    type = "aws_verifiedaccess_instance"
+  }
+
+  as = concept.verifiedaccess-instance
+}
+
+rule "vpc-endpoint-service" {
+  match {
+    kind = "resource"
+    type = "aws_vpc_endpoint_service"
+  }
+
+  as = concept.vpc-endpoint-service
+}
+
+rule "vpc-ipam-pool" {
+  match {
+    kind = "resource"
+    type = "aws_vpc_ipam_pool"
+  }
+
+  as = concept.vpc-ipam-pool
+}
+
+rule "vpc-route-server-endpoint" {
+  match {
+    kind = "resource"
+    type = "aws_vpc_route_server_endpoint"
+  }
+
+  as = concept.vpc-route-server-endpoint
+}