chore(CI): add new verify (#2156)

Author: apeabody

test/integration/sandbox_enabled/sandbox_enabled_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
 	"github.com/stretchr/testify/assert"
 	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/testutils"
+	gkeutils "github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/utils"
 )
 
 func TestSandboxEnabled(t *testing.T) {
@@ -32,6 +33,7 @@ func TestSandboxEnabled(t *testing.T) {
 	bpt.DefineVerify(func(assert *assert.Assertions) {
 		//Skipping Default Verify as the Verify Stage fails due to change in Client Cert Token
 		// bpt.DefaultVerify(assert)
+		gkeutils.TGKEVerify(t, bpt, assert) // Verify Resources
 
 		projectId := bpt.GetStringOutput("project_id")
 		location := bpt.GetStringOutput("location")

test/integration/utils/utils.go

@@ -15,10 +15,14 @@
 package utils
 
 import (
+	"slices"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
+	tfjson "github.com/hashicorp/terraform-json"
+	"github.com/stretchr/testify/assert"
 	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/testutils"
 )
 
@@ -32,3 +36,22 @@ func GetTestProjectFromSetup(t *testing.T, idx int) string {
 	}
 	return projectIDs[idx]
 }
+
+// TGKEVerify asserts no resource changes exist after apply.
+func TGKEVerify(t *testing.T, b *tft.TFBlueprintTest, assert *assert.Assertions) {
+	TGKEVerifyExemptResources(t, b, assert, []string{})
+}
+
+// TGKEVerifyExemptResources asserts no resource changes exist after apply except exempt resources: e.g. google_container_cluster.primary
+func TGKEVerifyExemptResources(t *testing.T, b *tft.TFBlueprintTest, assert *assert.Assertions, verifyExemptResources []string) {
+	_, ps := b.PlanAndShow()
+	for _, r := range ps.ResourceChangesMap {
+		if slices.ContainsFunc(verifyExemptResources, func(str string) bool {
+			return strings.HasSuffix(r.Address, str)
+		}) {
+			t.Logf("Exempt plan address: %s", r.Address)
+			continue
+		}
+		assert.Equal(tfjson.Actions{tfjson.ActionNoop}, r.Change.Actions, "Plan must be no-op for resource: %s", r.Address)
+	}
+}