ci: migrate e2e runner to Go (#77)

Author: tamas-jozsa

.github/workflows/e2e-tests.yml

@@ -11,6 +11,7 @@ on:
 env:
   CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
   CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
+  CLOUDFLARE_DOMAIN: ${{ secrets.CLOUDFLARE_DOMAIN }}
   CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
   CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
   CLOUDFLARE_R2_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
@@ -33,10 +34,7 @@ jobs:
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: "~> 1.0"
-
-      - name: Build binaries
-        run: make build-all
+          terraform_version: "1.9.8"
 
       - name: Run E2E Tests
-        run: bin/e2e-runner run
+        run: ./scripts/run-e2e-tests.sh --apply-exemptions

.gitignore

@@ -1,4 +1,4 @@
-tf-migrate
+bin/
 .terraformrc-tf-migrate
 
 # Local provider dev overrides
@@ -25,4 +25,4 @@ e2e/tf/v4/backend.configured.hcl
 
 # Backup files
 e2e/*.backup
-e2e/*.tfstate.backup
+e2e/*.tfstate.backup

Makefile

@@ -1,20 +1,44 @@
 # tf-migrate Makefile
 
-BINARY_NAME := tf-migrate
+BINARY_NAME := bin/tf-migrate
+E2E_BINARY := bin/e2e-runner
 GO := go
 MAIN_PACKAGE := ./cmd/tf-migrate
+E2E_PACKAGE := ./cmd/e2e-runner
 
-.PHONY: build test lint-testdata
+.PHONY: all build build-e2e build-all test test-e2e lint-testdata clean
 
-# Build the binary
+# Default target: build all binaries
+all: build-all
+
+# Build the main tf-migrate binary
 build:
+	@mkdir -p bin
 	$(GO) build -v -o $(BINARY_NAME) $(MAIN_PACKAGE)
 
-# Run unit tests
+# Build the e2e test runner binary
+build-e2e:
+	@mkdir -p bin
+	$(GO) build -v -o $(E2E_BINARY) $(E2E_PACKAGE)
+
+# Build both binaries
+build-all: build build-e2e
+
+# Run tests
 test:
-	$(GO) test -v -race ./...
+	$(GO) test -v -race ./internal/...
+
+# Run e2e-runner tests only
+test-e2e:
+	$(GO) test -v -race ./internal/e2e-runner
 
 # Lint testdata to ensure all resources have cftftest prefix
 lint-testdata:
 	@echo "Linting integration testdata for naming conventions..."
-	@$(GO) run scripts/lint_testdata_names.go
+	@$(GO) run scripts/lint_testdata_names.go
+
+# Clean build artifacts
+clean:
+	@echo "Cleaning build artifacts..."
+	@rm -rf bin/
+	@echo "Clean complete"

README.md

@@ -211,9 +211,26 @@ E2E tests validate the complete migration workflow with real Cloudflare resource
 ./scripts/run-e2e-tests
 
 # Run E2E tests for specific resources only
-./scripts/run-e2e-tests --resources dns_record,api_token
+./scripts/run-e2e-tests --resources dns_record,api_token --apply-exemptions
 ```
 
 **Output:**
 - Test logs saved to `e2e/tmp/*.log`
 - State snapshots saved to `e2e/tmp/*-state.json`
+
+**Cleaning State:**
+
+If you need to remove specific modules from the remote Terraform state (useful for re-running failed tests or cleaning up partial deployments):
+
+```bash
+# Remove specific modules from remote state
+./scripts/clean-state-modules.sh dns,healthcheck,zone
+
+# The script will:
+# 1. Build the latest e2e-runner binary
+# 2. Pull state from R2
+# 3. Filter out specified modules
+# 4. Push cleaned state back to R2
+```
+
+**Note:** This directly modifies the remote Terraform state. Use with caution and only in test environments.

cmd/e2e-runner/main.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	e2e "github.com/cloudflare/tf-migrate/internal/e2e-runner"
+	"github.com/spf13/cobra"
+)
+
+var rootCmd = &cobra.Command{
+	Use:   "e2e",
+	Short: "E2E testing tool for tf-migrate",
+	Long:  `End-to-end testing framework for validating v4 to v5 migrations`,
+}
+
+var initCmd = &cobra.Command{
+	Use:          "init",
+	Short:        "Initialize test resources",
+	Long:         `Syncs resource files from integration testdata to e2e/v4`,
+	SilenceUsage: true, // Don't show usage on error
+	RunE: func(cmd *cobra.Command, args []string) error {
+		resources, _ := cmd.Flags().GetString("resources")
+		return e2e.RunInit(resources)
+	},
+}
+
+var migrateCmd = &cobra.Command{
+	Use:          "migrate",
+	Short:        "Run migration from v4 to v5",
+	Long:         `Copies v4/ to migrated-v4_to_v5/ and runs migration`,
+	SilenceUsage: true, // Don't show usage on error
+	RunE: func(cmd *cobra.Command, args []string) error {
+		resources, _ := cmd.Flags().GetString("resources")
+		return e2e.RunMigrate(resources)
+	},
+}
+
+var runCmd = &cobra.Command{
+	Use:          "run",
+	Short:        "Run full e2e test suite",
+	Long:         `Runs the complete e2e test: init, v4 apply, migrate, v5 apply, drift check`,
+	SilenceUsage: true, // Don't show usage on error
+	RunE: func(cmd *cobra.Command, args []string) error {
+		cfg := &e2e.RunConfig{
+			SkipV4Test:      cmd.Flag("skip-v4-test").Changed,
+			ApplyExemptions: cmd.Flag("apply-exemptions").Changed,
+			Resources:       cmd.Flag("resources").Value.String(),
+			ProviderPath:    cmd.Flag("provider").Value.String(),
+		}
+		return e2e.RunE2ETests(cfg)
+	},
+}
+
+var bootstrapCmd = &cobra.Command{
+	Use:          "bootstrap",
+	Short:        "Migrate local state to R2 remote backend",
+	Long:         `One-time operation to migrate local terraform.tfstate to R2 remote backend`,
+	SilenceUsage: true, // Don't show usage on error
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return e2e.RunBootstrap()
+	},
+}
+
+var cleanCmd = &cobra.Command{
+	Use:          "clean",
+	Short:        "Remove modules from remote state",
+	Long:         `Removes specified modules from the v4 remote Terraform state in R2. Useful for cleaning up resources that have been manually deleted from Cloudflare but still exist in the Terraform state.`,
+	SilenceUsage: true, // Don't show usage on error
+	RunE: func(cmd *cobra.Command, args []string) error {
+		modulesStr, _ := cmd.Flags().GetString("modules")
+		if modulesStr == "" {
+			return fmt.Errorf("no modules specified\nUsage: e2e clean --modules <module1,module2,...>")
+		}
+		modules := strings.Split(modulesStr, ",")
+		for i := range modules {
+			modules[i] = strings.TrimSpace(modules[i])
+			if modules[i] == "" {
+				return fmt.Errorf("empty module name in list")
+			}
+		}
+		return e2e.RunClean(modules)
+	},
+}
+
+func init() {
+	// Init command flags
+	initCmd.Flags().String("resources", "", "Target specific resources (comma-separated)")
+
+	// Migrate command flags
+	migrateCmd.Flags().String("resources", "", "Target specific resources (comma-separated)")
+
+	// Run command flags
+	runCmd.Flags().Bool("skip-v4-test", false, "Skip v4 testing phase")
+	runCmd.Flags().Bool("apply-exemptions", false, "Apply drift exemptions from e2e/drift-exemptions.yaml")
+	runCmd.Flags().String("resources", "", "Target specific resources (comma-separated)")
+	runCmd.Flags().String("provider", "", "Use local provider from specified path")
+
+	// Clean command flags
+	cleanCmd.Flags().String("modules", "", "Modules to remove from state (comma-separated)")
+
+	rootCmd.AddCommand(initCmd)
+	rootCmd.AddCommand(migrateCmd)
+	rootCmd.AddCommand(runCmd)
+	rootCmd.AddCommand(bootstrapCmd)
+	rootCmd.AddCommand(cleanCmd)
+}
+
+func main() {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}

e2e/README.md

@@ -0,0 +1,47 @@
+# Drift Detection Exemptions
+#
+# This file configures which drift warnings should be ignored during e2e tests.
+# Use this to exempt known false positives or expected changes.
+
+exemptions:
+  # Ignore computed value refreshes (values that show as "known after apply")
+  - name: "computed_value_refreshes"
+    description: "Ignore attributes that refresh to 'known after apply'"
+    patterns:
+      - "(known after apply)"
+    enabled: true
+
+  # Ignore status changes to "active" (common for DNSSEC resources)
+  - name: "status_to_active"
+    description: "Status changes from pending/disabled to active"
+    resource_types:
+      - "cloudflare_zone_dnssec"
+    patterns:
+      - 'status.*->.*"active"'
+    enabled: true
+
+  # Example: Ignore specific resource types
+  # - name: "zone_dnssec_computed"
+  #   description: "Ignore computed changes in zone DNSSEC resources"
+  #   resource_types:
+  #     - "cloudflare_zone_dnssec"
+  #   patterns:
+  #     - "(known after apply)"
+  #   enabled: true
+
+  # Example: Ignore specific attributes across all resources
+  # - name: "last_modified_timestamps"
+  #   description: "Ignore last_modified timestamp changes"
+  #   attributes:
+  #     - "last_modified"
+  #     - "last_modified_on"
+  #     - "modified_on"
+  #   enabled: true
+
+# Global settings
+settings:
+  # If true, all exemptions are applied. If false, exemptions are ignored.
+  apply_exemptions: true
+
+  # If true, shows which exemptions matched during drift detection
+  verbose_exemptions: false