name: Terraform Provider

on:
  push:
    paths:
      - "terraform/provider/**"
      - ".github/workflows/test-terraform-provider.yml"
  pull_request:
    branches:
      - main
      - litellm_internal_staging
      - litellm_oss_staging
      - "litellm_**"
    paths:
      - "terraform/provider/**"
      - "litellm/proxy/**"
      - ".github/workflows/test-terraform-provider.yml"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  provider-checks:
    name: gofmt, vet, build, test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        working-directory: terraform/provider
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false

      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: terraform/provider/go.mod
          cache: true
          cache-dependency-path: terraform/provider/go.sum

      - name: gofmt
        run: |
          UNFORMATTED=$(gofmt -l .)
          if [ -n "${UNFORMATTED}" ]; then
            echo "::error::gofmt required for: ${UNFORMATTED}"
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      - name: Build
        run: go build ./...

      - name: Test
        run: go test -timeout 120s ./...

  endpoint-drift:
    name: Provider endpoints vs proxy OpenAPI schema
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Set up uv
        uses: ./.github/actions/setup-uv-with-retries
        with:
          version: "0.10.9"

      - name: Cache uv dependencies
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            ~/.cache/uv
            .venv
          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
          restore-keys: |
            ${{ runner.os }}-uv-

      - name: Cache the Rust build
        uses: ./.github/actions/cache-cargo-build

      - name: Install dependencies
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

      - name: Cache Prisma binaries
        uses: ./.github/actions/cache-prisma-binaries

      - name: Generate Prisma client
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Generate proxy OpenAPI schema
        run: |
          uv run --no-sync python terraform/provider/tools/dump_openapi.py "${RUNNER_TEMP}/openapi.json"

      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: terraform/provider/go.mod
          cache: true
          cache-dependency-path: terraform/provider/go.sum

      - name: Audit provider endpoints against the schema
        working-directory: terraform/provider
        run: go run ./tools/endpointaudit -provider-dir ./litellm -spec "${RUNNER_TEMP}/openapi.json" -coverage-allowlist ./tools/endpointaudit/coverage_allowlist.txt