initial workflow wip

.github/workflows/test-gcp-deploy.yml

@@ -0,0 +1,102 @@
+name: CIS-GCP-CI
+
+on:
+  pull_request_target:
+    branches:
+      - main
+      - "[0-9]+.[0-9]+"
+    types: [opened, synchronize, reopened]
+    paths:
+      - "deploy/deployment-manager/compute_engine.py"
+      - "deploy/deployment-manager/compute_engine.py.schema"
+      - "deploy/deployment-manager/deploy.sh"
+      - "deploy/deployment-manager/set_env.sh"
+
+jobs:
+  Run-CSPM-GCP-Tests:
+    name: CIS GCP deployment manager test
+    if: false
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    permissions:
+      contents: "read"
+      id-token: "write"
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Init Hermit
+        run: ./bin/hermit env -r >> $GITHUB_ENV
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.9"
+
+      - name: Install Poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+          poetry --version
+
+      - id: google-auth
+        name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v1
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+
+      - name: Provision Test Environment (EC)
+        id: apply
+        if: success()
+        run: |
+          terraform apply --auto-approve -target=module.ec_deployment
+
+      - name: Set Environment Output
+        id: env-output
+        run: |
+          echo "KIBANA_URL=$(terraform output -raw kibana_url)" >> $GITHUB_ENV
+          echo "ES_URL=$(terraform output -raw elasticsearch_url)" >> $GITHUB_ENV
+          echo "ES_USER=$(terraform output -raw elasticsearch_username)" >> $GITHUB_ENV
+
+          export ES_PASSWORD=$(terraform output -raw elasticsearch_password)
+          echo "::add-mask::$ES_PASSWORD"
+          echo "ES_PASSWORD=$ES_PASSWORD" >> $GITHUB_ENV
+
+          export CSPM_PUBLIC_IP=$(terraform output -raw ec2_cspm_public_ip)
+          echo "::add-mask::$CSPM_PUBLIC_IP"
+          echo "CSPM_PUBLIC_IP=$CSPM_PUBLIC_IP" >> $GITHUB_ENV
+
+      - name: Install CSPM GCP integration
+        id: cspm-gcp-integration
+        working-directory: ${{ env.WORKING_DIR }}/fleet_api
+        run: |
+          poetry run python src/install_cspm_gcp_integration.py
+
+      - name: Deploy CSPM GCP agent
+        id: cspm-gcp-agent
+        working-directory: deploy/deployment-manager
+        env:
+          DEPLOYMENT_LABELS: ${{ env.GCP_DEFAULT_TAGS }}
+        run: |
+          . ./set_env.sh && ./deploy.sh
+
+      - name: Check for findings
+        working-directory: ./tests
+        env:
+          USE_K8S: false
+        run: |
+          poetry install
+          poetry run pytest -k "cspm_gcp" --alluredir=./allure/results/ --clean-alluredir --maxfail=4
+
+      - name: Print cloudbeat logs
+        if: always()
+        run: |
+          cat logs/cloudbeat*
+
+      - name: Destory EC deployment
+        if: always()
+        run: |
+          terraform destroy -target=module.ec_deployment
+          # remove elastic agent from GCP project?
+
+# todo: destory the test environment