Set up a CI system (travis or circle)

[brandonjbjelland]

Tests are there and working through test kitchen. Let's wire this thing up to CI and get a badge on the README.

[antonbabenko]

@brandoconnor Good to see that you open this issue.

There is already a small group of people (@ozbillwang @ncs-alane to name a few from top of my head) who are interested in this effort for Terraform modules we maintain.

"Discuss/propose a CircleCI workflow" is already on the top of my list of things for the next week.

The question I'd like to get solved before copy-paste any solution to all modules I raised here. What do you think?

[brandonjbjelland]

Excellent! I just worked through through a TravisCI setup leveraging @ncs-alane 's kitchen-terraform. It's up and running on a skeleton AWS module project. It'd be good to see a couple CI products tried (codeship, travis, circle) to see how well they do and if they support the requirements. Perhaps even on the same project to do a side by side on speed and results.

Assumptions/requirements:

• the AWS (or whatever cloud provider) account used for testing will probably need to be paid for by a maintainer if it falls outside of free tiers. Maybe having a separate account we all can access and use for this purpose makes sense? Not sure. Let me know if anyone has ideas around eliminating cost.
• The CI system should be 100% free. I think they all are but those free tiers likely have their own quirks and details that might matter.
• secret/encrypted variables (environment variables are fine) are a must for credential storage. Sounds like this is possible with some differences on the edges for each of the platforms I've listed.
• coming from the CM space, test kitchen is fantastic and I think kitchen-terraform + awspec has been a familiar and mostly excellent experience for me. It's not the only option but a good one. Interested to hear opinions on what people prefer.

I don't necessarily think we ALL need to take the exact same approach but it would be nice to have one or a few prescriptive paths for testing and TDD that infra developers can easily start a project with. Let's mosh in a chat room if we have enough to discuss.

[antonbabenko]

AWS costs should not be an issue as long as we use dedicated AWS account just for running tests and keep an eye on a bill. I will get it covered/sponsored.

While I agree that there can be multiple alternative approaches to do testing it will be better if there is the default (aka recommended) way which fits most cases.

All other points you listed require some thinking. :)

Till next week!

[antonbabenko]

@brandoconnor - Here you can see how I am using CircleCI 2.0 with Terraform - https://youtu.be/MmFu-oII9_k?t=15m . This is pretty similar to how I am thinking to use it for other modules.

[ncs-alane]

👋 I have been using TravisCI's beta bulid matrix feature to test kitchen-terraform against different versions of Ruby and Terraform; it works quite well.

There is also an AWS plugin for InSpec that is under development: https://github.com/chef/inspec-aws. It's not yet ready for mainstream usage but this effort could be a motivation to spur or participate in the development of that project.

[antonbabenko]

terraform-aws-modules/terraform-aws-security-group#4 - I've just made more "actionable" issue for a smaller module.

[brandonjbjelland]

Resolved in PR #5. Closing.

[brandonjbjelland]

As a final note, I'm using some personal account credentials for testing here. If you have an employer sponsor who we could transition to using, let me know and we can find the right way to add those to the Travis config instead. I've disabled the nightly tests as they sporadically fail (this terraform version isn't officially supported but does usually work).

[antonbabenko]

I don't have coupon codes available at the moment, but I will try to get some before AWS re:invent (btw, are you going there?).

Maybe you can adjust TravisCI to build only if you are a committer to not spend $$$ so fast.

[brandonjbjelland]

I won't be there this year (just started contracting full time) though I've gone in the past. Have fun if you're going!

Yea I'll just limit who and how often the build runs. It finishes in just a couple minutes anyway so I haven't seen any cost just yet.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.