Bicep Assert / Test

[oliverlabs]

I've been following the latest Bicep Community call and wanted to try the test functionality.

Here's a sample code I used:

keyvault.bicep

param location string = resourceGroup().location

@description('Name of the Key Vault')
param keyVaultName string

@description('Prefix for deployment')
param prefix string

resource kv 'Microsoft.KeyVault/vaults@2023-02-01' = {
  name: '${prefix}-${keyVaultName}'
  location: location
  properties: {
    sku: {
      name: 'standard'
      family: 'A'
    }
    tenantId: subscription().tenantId
    enableRbacAuthorization: true
  }
}

assert kvSKU = kv.properties.sku.name == 'standard'

test.bicep

test testKeyVault 'keyvault.bicep' = {
  params: {
    keyVaultName: 'coffee'
    prefix: 'prod'
  }
}

assert assertKeyVaultName = testKeyVault.resources.kv.name == 'prod-coffee'

I am getting red squiggly lines on my testKeyVault scope in the assert above. How can I test this deployment? The demo did not specify the steps to do so.

Thanks in advance.

[jonasssa]

Getting the same here. Getting the asserts to work and the tests separately, but when referring to the test-resource in the asserts im getting the red squiggly line and error message: The name "acrRg" is not a parameter, variable, resource or module.

This is my code

targetScope = 'subscription'

@description('Required. Location of the resources.')
param location string

@description('Required. Unique identifier for the GH actions run or your local deployment')
param uniqueSuffix string

@description('Required. Resource group name for acr components')
param rgBaseName string

var acrRgName = '${rgBaseName}-${uniqueSuffix}'

@minLength(5)
@maxLength(50)
@description('Required. The base name for the Azure Container Registry. Alphanumerical characters only.')
param acrBaseName string

// VARIABLES

// Because of Alphanumerical characters only in combination with the name of acr needs to be global unique we combine the basename with the uniquesuffix set by using {{ github.run_id }}
var acrName = '${acrBaseName}${uniqueSuffix}'

// MODULES
test acrRg '../../CARML/Microsoft.Resources/resourceGroups/deploy.bicep' = {
  name: '${deployment().name}-acr-rg'
  params: {
    name: acrRgName
    location: location
  }
}

test acr '../../modules/acr/acr.bicep' = {
  name: '${deployment().name}-acr'
  params: {
    location: location
    acrName: acrName
    acrResourceGroupName: acrRg.outputs.name
  }
}


assert locationTest = contains(acrRg.resources.resourceGroup.location, 'westeurope')

[pchettri3]

Any update on this? I am planning to add assert test for resource naming convention on the github flow before deploy and after what-if, it works and it it can be used as separate test job

[oliverlabs]

Are you saying that your were able to successfully run an assert on a parameter as part of a GitHub flow? I thought it was still in the development phase. Do you have any examples?

[oliverlabs]

UPD: I have just tried it with the latest version of the az bicep and it worked :)

[pchettri3]

no I have not tried. I wanted to make sure it works before trying based on the reported issue. Thank you for testing. Did you add the test construct as separate inline script to call the bicep test only or you have to call both test and main?

[oliverlabs]

I was only able to test the assert command. The Test framework seems to be in a limbo since last September. I think it is unlikely that it would get implemented.

[cloudlene]

I was trying to validate parameters and provide error messages as appropriate as output parameters before the advent of assert.

Before

var validationError = (!isSharedAcr) && isOtherAcr && isNewAcr  

resource .... if(!validationError) {
}

output validationMessage string = validationError ? '''
Only one ACR can be supplied for use.
Shared ACR has 'shrd' in name and created in the RG where you're deploying
Other ACR is ACR in other Resource Groups.  You must only specify the resourceId in the configuration
Specify a name other than the shared ACR name to create a new ACR
''' :  'None'

Of course, the issue was with skipping deploying the resources after the validation.
While I gained the opportunity to cleanly stop the code from proceeding with an assert exception, I lost the ability to output validation error messages.

Now

var validationError = (!isSharedAcr) && isOtherAcr && isNewAcr  

// Only one ACR can be supplied for use.
// Shared ACR has 'shrd' in name and created in the RG where you're deploying
// Other ACR is ACR in other Resource Groups.  You must only specify the resourceId in the configuration
// Specify a name other than the shared ACR name to create a new ACR
assert MoreThanOneAcrSpecified = !validationError
// Note no conditions are required.
resource ....  {
}

Unfortunately, the output variables are no longer visible in the deployment stack due to the exception and hence can't specify it.
I have to ONLY rely on the assert name.

Future?

Perhaps the assert needs a syntax enhancement - an optional message parameter:

var validationError = (!isSharedAcr) && isOtherAcr && isNewAcr  
var validationErrorMessage = validationError ? '''
Only one ACR can be supplied for use.
Shared ACR has 'shrd' in name and created in the RG where you're deploying
Other ACR is ACR in other Resource Groups.  You must only specify the resourceId in the configuration
Specify a name other than the shared ACR name to create a new ACR
''' :  'None'
assert MoreThanOneAcrSpecified = !validationError, validationErrorMessage