Terratest Adds GCP Resource Reads and Pins Its CI

Terratest, the Go library for testing Terraform, Kubernetes, and cloud infrastructure, had a busy week on main. Ten commits landed with 109 files changed and 6290 insertions, and most of that volume is a single push: a large set of read helpers in the GCP modules so tests can assert on actual resource settings instead of just resource existence. Alongside that, the project pinned every workflow action to a commit SHA and fixed a small but annoying AWS client footgun.

Three commits from the same author landed on October 22 and account for nearly all of the week’s diff volume. The first adds reads for ten project and network level resources, the second covers Anthos, App Engine and fleet resources, and the third adds reads for data, build and management resources. Files touched include modules/gcp/aiplatform.go, modules/gcp/backupdr.go, modules/gcp/binaryauthorization.go, modules/gcp/apphub.go, and modules/gcp/bigqueryreservation.go.

The pattern is consistent. Each new resource gets three functions: an Attrs variant that fails the test on error, an AttrsE variant that returns the error, and a WithClient variant that accepts a supplied service so unit tests can run against an httptest fake instead of a real project. The read of the Vertex AI cache config shows why existence checks are not enough. The config is a singleton per project with one field, whether context caching is disabled, and a test needs an actual read to assert the module flipped it. The comment also notes a real API quirk: the config is named for the project alone, but Vertex AI answers only on a regional endpoint, so a location is still required to build the client.

The same trio of function variants makes the API predictable if you already use the AWS helpers. The tradeoff is size. Dozens of new files under modules/gcp/ is a lot of generated shaped surface, and consumers who keep vendored copies will see that import graph grow.

The second theme is supply chain hygiene. One commit pins every workflow action to a commit SHA instead of a mutable tag. This matters more than it sounds. A pinned tag can be repointed and a modified action can run inside your CI with full token access. A SHA is immutable, so the only way an action changes is through an intentional edit to your own workflow file. Dependabot handles the follow up work, which is exactly what the next commits show.

Four dependabot bumps landed the same day: actions/cache to 6.1.0, actions/upload-artifact to 7.0.2, google-github-actions/setup-gcloud to 3.0.1, and a newer aws-actions/configure-aws-credentials. The top changed files confirm these are not trivial bumps. The workflow files for AWS, GCP, Azure, Kubernetes, Terraform and Terragrunt integration tests were each touched three or four times in the window. If you copy Terratest workflows as templates, expect the action references to look different and read the diff before you cherry pick.

One flag for adopters: SHA pinning plus dependabot means your diff between action versions is empty unless you look up the tags separately. Worth doing on major bumps like upload-artifact jumping from 4.6.2 to 7.0.2.

The toolchain moved to Go 1.26.10 and golangci-lint 2.15.0 in a chore commit. Library consumers are not affected unless you build Terratest from source, but contributors need the new toolchain locally.

The only behavioral bug fix of the week is in the AWS modules: a build of a Config from credentials now keeps the resolved endpoint. The fix targets a pattern many test suites hit: you build an AWS client with a custom or resolved endpoint, construct a second Config from those credentials, and the endpoint silently resets to the default regional one. Before the fix, tests pointing at a LocalStack or a VPC endpoint could pass against real AWS by accident. After the fix, the endpoint survives the rebuild. If your suite mixed both construction paths, this is worth a regression look.

The GCP read helper wave is worth watching for API growth and for whether the AWS modules get a matching pass, since there is now a wide gap in assertion depth between the two cloud libraries. The action major version jumps, especially actions/upload-artifact at 7.0.2, deserve a check of artifact retention or naming changes before adoption. And the endpoint preservation fix is a good candidate to backport if you pin Terratest to an older minor and build Configs from credentials on the custom endpoint path.

Everything described here is on gruntwork-io/terratest on the main branch.