From 080645a79deb76ad3ee883823eaade6d8463aabd Mon Sep 17 00:00:00 2001
From: Julien Dessaux <julien.dessaux@adyxax.org>
Date: Sat, 12 Apr 2025 07:39:57 +0200
Subject: [PATCH] feat(module): add output variable `arn` and deprecate the
 output variable `iam_role_arn`

---
 .forgejo/workflows/main.yaml            | 16 ++++++++++++++++
 CHANGELOG.md                            | 15 +++++++++++++--
 README.md                               |  2 +-
 infrastructure/tofu/.gitignore          |  1 +
 infrastructure/tofu/.terraform.lock.hcl | 21 +++++++++++++++++++++
 infrastructure/tofu/main.tf             | 19 +++++++++++++++++++
 infrastructure/tofu/providers.tf        | 24 ++++++++++++++++++++++++
 main.tftest.hcl                         | 15 +++++++++++++++
 outputs.tf                              |  7 +++++++
 9 files changed, 117 insertions(+), 3 deletions(-)
 create mode 100644 .forgejo/workflows/main.yaml
 create mode 100644 infrastructure/tofu/.gitignore
 create mode 100644 infrastructure/tofu/.terraform.lock.hcl
 create mode 100644 infrastructure/tofu/main.tf
 create mode 100644 infrastructure/tofu/providers.tf
 create mode 100644 main.tftest.hcl

diff --git a/.forgejo/workflows/main.yaml b/.forgejo/workflows/main.yaml
new file mode 100644
index 0000000..2e4bd1f
--- /dev/null
+++ b/.forgejo/workflows/main.yaml
@@ -0,0 +1,16 @@
+---
+name: 'main'
+
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: 'self-hosted'
+    steps:
+      - uses: 'actions/checkout@v4'
+      - uses: "https://git.adyxax.org/adyxax/action-tofu-aws-test@1.0.0"
+        with:
+          aws-access-key-id: "${{ vars.AWS_ACCESS_KEY_ID }}"
+          aws-access-key-secret: "${{ secrets.AWS_ACCESS_KEY_SECRET }}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d511684..59835d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,8 +2,19 @@
 
 All notable changes to this project will be documented in this file.
 
+## 1.1.0 - 2025-04-12
+
+### Add
+
+- Add output variable `arn`.
+
+### Deprecate
+
+- Output variable `iam_role_arn` will be removed in a later release. Use `arn`
+  instead.
+
 ## 1.0.0 - 2025-04-11
 
-### Added
+### Add
 
-- initial import
+- Initial import.
diff --git a/README.md b/README.md
index af5a1f6..e7ca711 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ continuous integration tasks on AWS.
 
 ``` hcl
 module "aws_iam_role" {
-  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-role?depth=1&ref=1.0.0"
+  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-role?depth=1&ref=1.1.0"
 
   name            = local.name
   policy_statements = jsonencode([
diff --git a/infrastructure/tofu/.gitignore b/infrastructure/tofu/.gitignore
new file mode 100644
index 0000000..a8c8222
--- /dev/null
+++ b/infrastructure/tofu/.gitignore
@@ -0,0 +1 @@
+!.terraform.lock.hcl
diff --git a/infrastructure/tofu/.terraform.lock.hcl b/infrastructure/tofu/.terraform.lock.hcl
new file mode 100644
index 0000000..9ee3c83
--- /dev/null
+++ b/infrastructure/tofu/.terraform.lock.hcl
@@ -0,0 +1,21 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/aws" {
+  version     = "5.91.0"
+  constraints = "5.91.0"
+  hashes = [
+    "h1:g+uDHz6bZ36QaxoKWmJEYGh7OP5RAE5MPbxLohzcU18=",
+    "h1:qw1Sp5py+7rRwzHgHNJvgYTeTkBnPHY7WercO1BsOh0=",
+    "zh:057e6cb85e3efe2c30ef5ca47cc47abc8217e2e0dddce2e92a8d2d6f18b6cee6",
+    "zh:0f15d3f599e07307ac9771c602dcaaf0c46dd259649da985cb3cb80a7a647cea",
+    "zh:187086070cc878ab0a27163939516983e3efae65ebff78dc3466619cdf978dee",
+    "zh:67a58fc85c630bcc6c772f573813caabe6c9af291c71c7207590fc4792e4d94e",
+    "zh:68abb9382928ce29c0f3dd9a75b41ad2a453f3a46330f484d1ea858589146c1b",
+    "zh:772134ba713e879e5b70d614d08a6650f156e7a3fa724d538bfa85632b1ed639",
+    "zh:bf67439e47cf6720dcec7a1e2988d6c10c56d7eea69bb1ecff1b22d6bb63a36d",
+    "zh:bfd0b91dc4ae338eb79ec41bede5eed7a0740380bffbdfbda362f7ed08e0e2ad",
+    "zh:ca3c3313cd4971850da45ce4337b027a804389db740c310ba637bc0a86775eef",
+    "zh:d75a8ec54a4783c25cb806b887f0d3c67cded08db8c496fd9cf831791e4c8482",
+  ]
+}
diff --git a/infrastructure/tofu/main.tf b/infrastructure/tofu/main.tf
new file mode 100644
index 0000000..37037f8
--- /dev/null
+++ b/infrastructure/tofu/main.tf
@@ -0,0 +1,19 @@
+locals {
+  name = "tofu-module-aws-iam-role"
+}
+
+module "aws_iam_ci_user" {
+  providers = {
+    aws.core  = aws.all["core"]
+    aws.root  = aws.all["root"]
+    aws.tests = aws.all["tests"]
+  }
+  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-ci-user?depth=1&ref=1.0.0"
+
+  name = local.name
+  tests_policy_statements = jsonencode([{
+    Action   = "iam:*"
+    Effect   = "Allow"
+    Resource = "arn:aws:iam::*:role/tftest",
+  }])
+}
diff --git a/infrastructure/tofu/providers.tf b/infrastructure/tofu/providers.tf
new file mode 100644
index 0000000..8b42979
--- /dev/null
+++ b/infrastructure/tofu/providers.tf
@@ -0,0 +1,24 @@
+terraform {
+  backend "s3" {
+    bucket         = "adyxax-tofu-states"
+    dynamodb_table = "tofu-states"
+    key            = "repositories/${local.name}"
+    profile        = "core"
+    region         = "eu-west-3"
+  }
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "5.91.0"
+    }
+  }
+}
+
+provider "aws" {
+  for_each = toset(["core", "root", "tests"])
+
+  alias = "all"
+  default_tags { tags = { "managed-by" = "tofu" } }
+  profile = each.key
+  region  = "eu-west-3"
+}
diff --git a/main.tftest.hcl b/main.tftest.hcl
new file mode 100644
index 0000000..c21db0b
--- /dev/null
+++ b/main.tftest.hcl
@@ -0,0 +1,15 @@
+provider "aws" {
+  profile = "tests"
+  region  = "eu-west-3"
+}
+
+run "main" {
+  assert {
+    condition     = output.arn != null
+    error_message = "invalid IAM role ARN"
+  }
+}
+
+variables {
+  name = "tftest"
+}
diff --git a/outputs.tf b/outputs.tf
index f3ef649..ebfd120 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,3 +1,10 @@
+output "arn" {
+  description = "AWS IAM role ARN."
+  sensitive   = false
+  value       = aws_iam_role.main.id
+}
+
+# Deprecated since 1.1.0
 output "iam_role_arn" {
   description = "AWS IAM role ARN."
   sensitive   = false