Merge branch 'master' into CLOUDP-352095_sa_mig_tests

* master:
  chore: Invoke Delete operation if timeout in autogen (#3820)
  Add support for typed nested sets in autogen (#3819)
  chore: Use timeouts attributes in autogen resources (#3817)
  refactor: Adds invalid update error for delete_on_create_timeout for sdkv2 (#3810)
  Add support for typed lists in autogen (#3816)
  refactor: Uses delete_on_create_timeout with default=true support across TPF resources (#3809)
  Rename customtype package to customtypes (#3814)
  chore: Add support for typed nested lists in autogen (#3813)
  don't schedule matrix until CLOUDP-353513 (#3812)
  chore: Fix stream tests notifications (#3805)
  chore: Bump golang.org/x/oauth2 from 0.31.0 to 0.32.0 (#3803)
  depends on data sources (#3808)
  test: Avoids flaky test by simplifying the check, ensuring count > 0 instead of reading API response and trying exact match (#3806)
  chore: Generate timeouts attribute for autogen resources (#3802)

# Conflicts:
#	.github/workflows/acceptance-tests-runner.yml

Author: lantoli

.github/workflows/acceptance-tests-runner.yml

@@ -12,32 +12,33 @@ on:
       provider_version:
         description: 'Previous MongoDB Atlas Provider version to use in Migration tests, e.g. 1.14.0, empty for latest'     
         type: string
-        required: false    
+        required: true    
       test_group:
         description: 'Test group to run, e.g. advanced_cluster, empty for all'
         type: string
-        required: false
+        required: true
       test_name:
         description: 'Name of the test to run, e.g. TestAccNetworkRSNetworkPeering_basicAzure, empty for all (this is regex & requires Test group to be specified as well)'
         type: string
-        required: false
+        required: true
       ref:
         description: 'The branch, tag or SHA where tests will run, e.g. v1.14.0, empty for default branch'
         type: string
-        required: false
+        required: true
+      # Boolean inputs are passed as null between workflows when false. For comparisons use my_input == true or my_input != true.
+      # Don't use my_input or my_input == false.
       reduced_tests:
         description: 'If run only minimum tests for advanced_cluster, e.g. in PRs'
         type: boolean
-        required: false
-        default: false    
+        required: true
       use_sa:
         description: "Run tests using Service Account instead of API Keys"
         type: boolean
-        required: false
+        required: true
       send_notification:
         description: 'Send a Slack notification if stream tests fail.'
         type: boolean
-        required: false
+        required: true
       mongodb_atlas_org_id:
         type: string
         required: true
@@ -213,15 +214,14 @@ env:
   # If the name (regex) of the test is set, only that test is run.
   # Only Migration tests are run when a specific previous provider version is set.
   # Don't run migration tests if using Service Account because each migration test creates a new SA token in the test first step.
-  # The previous provider runs externally (equivalent to running a Terraform command), causing token creation limit issues.
-  ACCTEST_REGEX_RUN: ${{ inputs.test_name || inputs.use_sa && '^TestAcc' || inputs.provider_version == '' && '^Test(Acc|Mig)' || '^TestMig' }}
+  # The previous provider runs externally (equivalent to running a Terraform command), causing token creation limit issues.  ACCTEST_REGEX_RUN: ${{ inputs.test_name || inputs.use_sa == true && '^TestAcc' || inputs.provider_version == '' && '^Test(Acc|Mig)' || '^TestMig' }}
   MONGODB_ATLAS_BASE_URL: ${{ inputs.mongodb_atlas_base_url }}
   MONGODB_REALM_BASE_URL: ${{ inputs.mongodb_realm_base_url }}
   MONGODB_ATLAS_ORG_ID: ${{ inputs.mongodb_atlas_org_id }}
-  MONGODB_ATLAS_PUBLIC_KEY: ${{ inputs.use_sa == false && secrets.mongodb_atlas_public_key || '' }}
-  MONGODB_ATLAS_PRIVATE_KEY: ${{ inputs.use_sa == false && secrets.mongodb_atlas_private_key || '' }}
-  MONGODB_ATLAS_CLIENT_ID: ${{ inputs.use_sa  && secrets.mongodb_atlas_client_id || '' }}
-  MONGODB_ATLAS_CLIENT_SECRET: ${{ inputs.use_sa && secrets.mongodb_atlas_client_secret || '' }}
+  MONGODB_ATLAS_PUBLIC_KEY: ${{ inputs.use_sa != true && secrets.mongodb_atlas_public_key || '' }}
+  MONGODB_ATLAS_PRIVATE_KEY: ${{ inputs.use_sa != true && secrets.mongodb_atlas_private_key || '' }}
+  MONGODB_ATLAS_CLIENT_ID: ${{ inputs.use_sa == true && secrets.mongodb_atlas_client_id || '' }}
+  MONGODB_ATLAS_CLIENT_SECRET: ${{ inputs.use_sa == true && secrets.mongodb_atlas_client_secret || '' }}
   MONGODB_ATLAS_PUBLIC_KEY_READ_ONLY: ${{ secrets.mongodb_atlas_public_key_read_only }}
   MONGODB_ATLAS_PRIVATE_KEY_READ_ONLY: ${{ secrets.mongodb_atlas_private_key_read_only }}
   MONGODB_ATLAS_GOV_PUBLIC_KEY: ${{ secrets.mongodb_atlas_gov_public_key }}
@@ -422,14 +422,14 @@ jobs:
         env:
           MONGODB_ATLAS_LAST_VERSION: ${{ needs.get-provider-version.outputs.provider_version }}
           HTTP_MOCKER_CAPTURE: 'true'
-          ACCTEST_REGEX_RUN: ${{ inputs.reduced_tests && '^TestAccMockable' || env.ACCTEST_REGEX_RUN }}
+          ACCTEST_REGEX_RUN: ${{ inputs.reduced_tests == true && '^TestAccMockable' || env.ACCTEST_REGEX_RUN }}
           ACCTEST_PACKAGES: ./internal/service/advancedcluster
         run: make testacc
 
   advanced_cluster_tpf_mig_from_sdkv2:
     needs: [ change-detection, get-provider-version ]
     # advanced_cluster v1.x versions don't support SA.
-    if: ${{ inputs.reduced_tests == false && inputs.use_sa == false && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
+    if: ${{ inputs.reduced_tests != true && inputs.use_sa != true && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
     runs-on: ubuntu-latest
     permissions: {}
     steps:
@@ -455,7 +455,7 @@ jobs:
   advanced_cluster_tpf_mig_from_tpf_preview:
     needs: [ change-detection, get-provider-version ]
     # advanced_cluster v1.x versions don't support SA.
-    if: ${{ inputs.reduced_tests == false && inputs.use_sa == false && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
+    if: ${{ inputs.reduced_tests != true && inputs.use_sa != true && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
     runs-on: ubuntu-latest
     permissions: {}
     steps:
@@ -891,7 +891,7 @@ jobs:
   event_trigger:
     needs: [change-detection, get-provider-version]
     # Realm SDK doesn't support SA.
-    if: ${{ inputs.use_sa == false && (needs.change-detection.outputs.event_trigger == 'true' || inputs.test_group == 'event_trigger') }}
+    if: ${{ inputs.use_sa != true && (needs.change-detection.outputs.event_trigger == 'true' || inputs.test_group == 'event_trigger') }}
     runs-on: ubuntu-latest
     permissions: {}
     steps:
@@ -1200,10 +1200,10 @@ jobs:
           terraform_wrapper: false  
       - name: Acceptance Tests
         env:
-          MONGODB_ATLAS_PUBLIC_KEY: ${{ inputs.use_sa == false && secrets.mongodb_atlas_rp_public_key || '' }}
-          MONGODB_ATLAS_PRIVATE_KEY: ${{ inputs.use_sa == false && secrets.mongodb_atlas_rp_private_key || '' }}
-          MONGODB_ATLAS_CLIENT_ID: ${{ inputs.use_sa  && secrets.mongodb_atlas_rp_client_id || '' }}
-          MONGODB_ATLAS_CLIENT_SECRET: ${{ inputs.use_sa && secrets.mongodb_atlas_rp_client_secret || '' }}
+          MONGODB_ATLAS_PUBLIC_KEY: ${{ inputs.use_sa != true && secrets.mongodb_atlas_rp_public_key || '' }}
+          MONGODB_ATLAS_PRIVATE_KEY: ${{ inputs.use_sa != true && secrets.mongodb_atlas_rp_private_key || '' }}
+          MONGODB_ATLAS_CLIENT_ID: ${{ inputs.use_sa == true && secrets.mongodb_atlas_rp_client_id || '' }}
+          MONGODB_ATLAS_CLIENT_SECRET: ${{ inputs.use_sa == true && secrets.mongodb_atlas_rp_client_secret || '' }}
           MONGODB_ATLAS_ORG_ID: ${{ inputs.mongodb_atlas_rp_org_id }}
           MONGODB_ATLAS_LAST_VERSION: ${{ needs.get-provider-version.outputs.provider_version }}
           ACCTEST_PACKAGES: ./internal/service/resourcepolicy
@@ -1318,7 +1318,7 @@ jobs:
 
   slack-notification-stream:
     needs: [stream]
-    if: ${{ !cancelled() && needs.stream.result == 'failure' && !contains(github.event.inputs.send_notification, 'false') }}
+    if: ${{ !cancelled() && needs.stream.result == 'failure' && inputs.send_notification == true }}
     runs-on: ubuntu-latest
     permissions: {}
     steps:

.github/workflows/acceptance-tests.yml

@@ -1,5 +1,5 @@
 name: 'Acceptance Tests'
-run-name: "Acceptance Tests ${{ inputs.atlas_cloud_env }} ${{ inputs.test_group }} ${{ inputs.use_sa && 'sa' || 'pak'}}"
+run-name: "Acceptance Tests ${{ inputs.atlas_cloud_env }} ${{ inputs.test_group }} ${{ inputs.use_sa == true && 'sa' || 'pak'}}"
 
 # Used for running acceptance tests, either triggered manually or called by other workflows. 
 on:
@@ -28,7 +28,7 @@ on:
       ref:
         description: 'The branch, tag or SHA where tests will run, e.g. v1.14.0, empty for default branch'
         type: string
-        required: false  
+        required: false
       use_sa:
         description: "Run tests using Service Account instead of API Keys"
         type: boolean
@@ -122,13 +122,12 @@ jobs:
     with:
       terraform_version: ${{ inputs.terraform_version || '1.13.x' }}
       provider_version: ${{ inputs.provider_version }}
-      ref: ${{ inputs.ref }}
       test_group: ${{ inputs.test_group }}
       test_name: ${{ inputs.test_name }}
-      reduced_tests: ${{ inputs.reduced_tests || false }}
-      use_sa: ${{ inputs.use_sa || false }}
-      send_notification: ${{ !contains(github.event.inputs.send_notification, 'false') }}
-      aws_region_federation: ${{ vars.AWS_REGION_FEDERATION }}
+      ref: ${{ inputs.ref }}
+      reduced_tests: ${{ inputs.reduced_tests == true }}
+      use_sa: ${{ inputs.use_sa == true }}
+      send_notification: ${{ inputs.send_notification == true }}
       mongodb_atlas_org_id: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_ORG_ID_CLOUD_QA || vars.MONGODB_ATLAS_ORG_ID_CLOUD_DEV }}
       mongodb_atlas_base_url: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_BASE_URL_QA || vars.MONGODB_ATLAS_BASE_URL }}
       mongodb_realm_base_url: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_REALM_BASE_URL_QA || vars.MONGODB_REALM_BASE_URL }}
@@ -139,6 +138,7 @@ jobs:
       azure_service_principal_id: ${{ inputs.atlas_cloud_env == 'qa' && vars.AZURE_SERVICE_PRINCIPAL_ID_QA || vars.AZURE_SERVICE_PRINCIPAL_ID }}
       azure_tenant_id: ${{ vars.AZURE_TENANT_ID }}
       aws_secret_name: ${{ inputs.atlas_cloud_env == 'qa' && vars.AWS_SECRET_NAME_QA || vars.AWS_SECRET_NAME }}
+      aws_region_federation: ${{ vars.AWS_REGION_FEDERATION }}
       mongodb_atlas_federation_settings_id: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_FEDERATION_SETTINGS_ID_QA || vars.MONGODB_ATLAS_FEDERATION_SETTINGS_ID }}
       mongodb_atlas_federated_okta_idp_id: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_FEDERATED_OKTA_IDP_ID_QA || vars.MONGODB_ATLAS_FEDERATED_OKTA_IDP_ID }}
       mongodb_atlas_federated_idp_id: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_FEDERATED_IDP_ID_QA || vars.MONGODB_ATLAS_FEDERATED_IDP_ID }}

.github/workflows/code-health.yml

@@ -93,5 +93,3 @@ jobs:
     uses: ./.github/workflows/acceptance-tests.yml
     with:
         reduced_tests: true
-        use_sa: false
-        send_notification: false

.github/workflows/release.yml

@@ -125,8 +125,6 @@ jobs:
     with:
       atlas_cloud_env: "qa"
       ref: ${{ inputs.version_number }}
-      use_sa: false
-      send_notification: false
 
   release:
     runs-on: ubuntu-latest

.github/workflows/terraform-compatibility-matrix.yml

@@ -2,8 +2,9 @@ name: "HashiCorp Terraform Compatibility Matrix"
 run-name: 'HashiCorp Terraform Compatibility Matrix ${{ inputs.atlas_cloud_env }}'
 
 on:
-  schedule:
-    - cron: "0 0 1 * *" # runs first day of the month at midnight UTC
+  # Will be spread in multiple days in CLOUDP-353513, don't schedule at the moment.
+  # schedule:
+  #  - cron: "0 0 1 * *" # runs first day of the month at midnight UTC
   workflow_dispatch:
     inputs:
       atlas_cloud_env:

.github/workflows/test-suite.yml

@@ -7,7 +7,7 @@ name: 'Test Suite'
 #   - Tuesday, Thursday, Saturday: SA against Dev environment
 # Note: PAK refers to Programmatic API Key authentication (use_sa: false), SA refers to Service Account authentication (use_sa: true)
 # It can also be run manually.
-# The 1st day of the month we run terraform-compatibility-matrix.yml and therefore, we skip the test-suite (see schedule->cron below).
+# Pending change in CLOUDP-353513: The 1st day of the month we run terraform-compatibility-matrix.yml and therefore, we skip the test-suite (see schedule->cron below).
 on:
   workflow_dispatch:
     inputs:
@@ -24,7 +24,7 @@ on:
       use_sa:
         description: "Run tests using Service Account instead of API Keys"
         type: boolean
-        required: false
+        default: false
   workflow_call:
     inputs:
       terraform_matrix:
@@ -41,7 +41,11 @@ on:
       send_notification:
         description: 'Send the Slack notification if any of the tests fail.'
         type: boolean
-        default: true
+        default: false
+      use_sa:
+        description: "Run tests using Service Account instead of API Keys"
+        type: boolean
+        default: false  
   schedule:
     - cron: "0 0 2-31 * *" # workflow runs every day at midnight UTC except on the first day of the month
 
@@ -59,7 +63,8 @@ jobs:
       terraform_matrix: ${{ inputs.terraform_matrix || env.schedule_terraform_matrix }}
       provider_matrix: ${{ inputs.provider_matrix || env.schedule_provider_matrix }}
       is_sun: ${{ steps.set_day.outputs.DAY == 'Sun' }}
-      use_sa: ${{ (inputs.use_sa != null && inputs.use_sa) || (inputs.use_sa == null && (steps.set_day.outputs.DAY == 'Tue' || steps.set_day.outputs.DAY == 'Thu' || steps.set_day.outputs.DAY == 'Sat')) }}
+      use_sa: ${{ inputs.use_sa == true || (github.event_name == 'schedule' && (steps.set_day.outputs.DAY == 'Tue' || steps.set_day.outputs.DAY == 'Thu' || steps.set_day.outputs.DAY == 'Sat')) }}
+      send_notification: ${{ github.event_name == 'schedule' || inputs.send_notification == true }}
     steps:
       - name: set day
         id: set_day
@@ -86,9 +91,9 @@ jobs:
       terraform_version: ${{ matrix.terraform_version }}
       provider_version: ${{ matrix.provider_version }}
       atlas_cloud_env: ${{ inputs.atlas_cloud_env || needs.variables.outputs.is_sun == 'true' && 'qa' || '' }} # Run against QA on Sundays
+      # Job output variables are always returned as strings.
       use_sa: ${{ needs.variables.outputs.use_sa == 'true' }}
-      # This expression is true if unset (scheduled workflow) and works with boolean and string (GHA params are passed as strings)
-      send_notification: ${{ !contains(github.event.inputs.send_notification, 'false') }}
+      send_notification: ${{ needs.variables.outputs.send_notification == 'true' }}
 
   clean-after:
     needs: tests
@@ -97,8 +102,8 @@ jobs:
     uses: ./.github/workflows/cleanup-test-env.yml
 
   slack-notification:
-    needs: [tests, clean-after]
-    if: ${{ !cancelled() && needs.tests.result == 'failure' && !contains(github.event.inputs.send_notification, 'false') }}
+    needs: [tests, variables, clean-after]
+    if: ${{ !cancelled() && needs.tests.result == 'failure' && needs.variables.outputs.send_notification == 'true' }}
     runs-on: ubuntu-latest
     permissions: {}
     steps:

go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/hashicorp/terraform-json v0.27.2
 	github.com/hashicorp/terraform-plugin-framework-jsontypes v0.2.0
 	go.mongodb.org/atlas-sdk/v20250312008 v20250312008.0.0
-	golang.org/x/oauth2 v0.31.0
+	golang.org/x/oauth2 v0.32.0
 )
 
 require (

go.sum

@@ -1608,8 +1608,8 @@ golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
 golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo=
-golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
+golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=