From 2ed6c814d9149db128c230bb299ad88d473a62ea Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Mon, 20 Oct 2025 16:29:44 +0700
Subject: [PATCH 01/35] add terraform module

---
 webhook-gateway/charm/terraform/.tflint.hcl   |  6 ++
 webhook-gateway/charm/terraform/main.tf       | 19 +++++++
 webhook-gateway/charm/terraform/outputs.tf    | 13 +++++
 .../charm/terraform/tests/.tflint.hcl         |  6 ++
 webhook-gateway/charm/terraform/tests/main.tf | 44 +++++++++++++++
 .../charm/terraform/tests/main.tftest.hcl     | 15 +++++
 webhook-gateway/charm/terraform/variables.tf  | 55 +++++++++++++++++++
 webhook-gateway/charm/terraform/versions.tf   | 11 ++++
 8 files changed, 169 insertions(+)
 create mode 100644 webhook-gateway/charm/terraform/.tflint.hcl
 create mode 100644 webhook-gateway/charm/terraform/main.tf
 create mode 100644 webhook-gateway/charm/terraform/outputs.tf
 create mode 100644 webhook-gateway/charm/terraform/tests/.tflint.hcl
 create mode 100644 webhook-gateway/charm/terraform/tests/main.tf
 create mode 100644 webhook-gateway/charm/terraform/tests/main.tftest.hcl
 create mode 100644 webhook-gateway/charm/terraform/variables.tf
 create mode 100644 webhook-gateway/charm/terraform/versions.tf

diff --git a/webhook-gateway/charm/terraform/.tflint.hcl b/webhook-gateway/charm/terraform/.tflint.hcl
new file mode 100644
index 00000000..f93dae18
--- /dev/null
+++ b/webhook-gateway/charm/terraform/.tflint.hcl
@@ -0,0 +1,6 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+rule "terraform_required_version" {
+  enabled = false
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
new file mode 100644
index 00000000..77f6425f
--- /dev/null
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -0,0 +1,19 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+resource "juju_application" "github_runner_webhook_gateway" {
+  name  = var.app_name
+  model = var.model
+
+  charm {
+    name     = "github_runner_webhook_gateway"
+    channel  = var.channel
+    revision = var.revision
+    base     = var.base
+  }
+
+  config             = var.config
+  constraints        = var.constraints
+  units              = var.units
+  storage_directives = var.storage
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/outputs.tf b/webhook-gateway/charm/terraform/outputs.tf
new file mode 100644
index 00000000..64518001
--- /dev/null
+++ b/webhook-gateway/charm/terraform/outputs.tf
@@ -0,0 +1,13 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+output "app_name" {
+  description = "Name of the deployed application."
+  value       = juju_application.github_runner_webhook_gateway.name
+}
+
+output "endpoints" {
+  value = {
+    rabbitmq = "rabbitmq"
+  }
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/tests/.tflint.hcl b/webhook-gateway/charm/terraform/tests/.tflint.hcl
new file mode 100644
index 00000000..f93dae18
--- /dev/null
+++ b/webhook-gateway/charm/terraform/tests/.tflint.hcl
@@ -0,0 +1,6 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+rule "terraform_required_version" {
+  enabled = false
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
new file mode 100644
index 00000000..47cdbc7a
--- /dev/null
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -0,0 +1,44 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+variable "channel" {
+  description = "The channel to use when deploying a charm."
+  type        = string
+  default     = "latest/edge"
+}
+
+variable "revision" {
+  description = "Revision number of the charm."
+  type        = number
+  default     = null
+}
+
+terraform {
+  required_providers {
+    juju = {
+      version = "~> 0.23.0"
+      source  = "juju/juju"
+    }
+  }
+}
+
+provider "juju" {}
+
+module "github_runner_webhook_gateway" {
+  source   = "./.."
+  app_name = "github_runner_webhook_gateway"
+  channel  = var.channel
+  model    = "prod-github_runner_webhook_gateway-example"
+  revision = var.revision
+  config   = { webhook-secret = "" }
+}
+
+output "app_name" {
+  description = "The name of the deployed github_runner_webhook_gateway charm application."
+  value       = module.github_runner_webhook_gateway.app_name
+}
+
+output "endpoints" {
+  description = "Integration endpoints exposed by github_runner_webhook_gateway charm."
+  value       = module.github_runner_webhook_gateway.endpoints
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/tests/main.tftest.hcl b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
new file mode 100644
index 00000000..dbf45797
--- /dev/null
+++ b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
@@ -0,0 +1,15 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+variables {
+  channel = "latest/edge"
+  # renovate: depName="github_runner_webhook_gateway"
+  revision = 1
+}
+
+run "basic_deploy" {
+  assert {
+    condition     = module.github_runner_webhook_gateway.app_name == "github_runner_webhook_gateway"
+    error_message = "github_runner_webhook_gateway app_name did not match expected"
+  }
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
new file mode 100644
index 00000000..d1276cc1
--- /dev/null
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -0,0 +1,55 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+variable "app_name" {
+  description = "Name of the application in the Juju model."
+  type        = string
+  default     = "github-runner-webhook-gateway"
+}
+
+variable "base" {
+  description = "The operating system on which to deploy"
+  type        = string
+  default     = "ubuntu@24.04"
+}
+
+variable "channel" {
+  description = "The channel to use when deploying a charm."
+  type        = string
+  default     = "latest/stable"
+}
+
+variable "config" {
+  description = "Application config. Details about available options can be found at https://charmhub.io/<charm-name>/configurations."
+  type        = map(string)
+  default     = {}
+}
+
+variable "constraints" {
+  description = "Juju constraints to apply for this application."
+  type        = string
+  default     = ""
+}
+
+variable "model" {
+  description = "Reference to a `juju_model`."
+  type        = string
+}
+
+variable "revision" {
+  description = "Revision number of the charm"
+  type        = number
+  default     = null
+}
+
+variable "storage" {
+  description = "Map of storage used by the application."
+  type        = map(string)
+  default     = {}
+}
+
+variable "units" {
+  description = "Number of units to deploy"
+  type        = number
+  default     = 1
+}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/versions.tf b/webhook-gateway/charm/terraform/versions.tf
new file mode 100644
index 00000000..088a0caf
--- /dev/null
+++ b/webhook-gateway/charm/terraform/versions.tf
@@ -0,0 +1,11 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+terraform {
+  required_providers {
+    juju = {
+      source  = "juju/juju"
+      version = ">= 0.23.0"
+    }
+  }
+}
\ No newline at end of file

From 6e9cfa60e3f6beed0539f46eae98f7d562c38656 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 21 Oct 2025 00:20:21 +0700
Subject: [PATCH 02/35] add terraform

---
 .github/workflows/test_terraform_files.yaml   | 55 ++++++++++++++++++
 .github/workflows/test_terraform_module.yaml  | 41 +++++++++++++
 webhook-gateway/charm/terraform/README.md     | 57 +++++++++++++++++++
 webhook-gateway/charm/terraform/main.tf       | 31 ++++++++++
 webhook-gateway/charm/terraform/tests/main.tf | 13 ++++-
 webhook-gateway/charm/terraform/variables.tf  |  4 +-
 6 files changed, 198 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/test_terraform_files.yaml
 create mode 100644 .github/workflows/test_terraform_module.yaml
 create mode 100644 webhook-gateway/charm/terraform/README.md

diff --git a/.github/workflows/test_terraform_files.yaml b/.github/workflows/test_terraform_files.yaml
new file mode 100644
index 00000000..a02135de
--- /dev/null
+++ b/.github/workflows/test_terraform_files.yaml
@@ -0,0 +1,55 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Terraform module tests
+
+on:
+  pull_request:
+    paths:
+      - "*/terraform/**"
+
+permissions:
+  contents: read
+
+jobs:
+  test-terraform:
+    name: Test Terraform with Juju
+    runs-on: ubuntu-latest
+    env:
+      WORKING_DIR: "terraform/tests"
+    steps:
+      - uses: actions/checkout@v5.0.0
+      - uses: charmed-kubernetes/actions-operator@main
+        with:
+          provider: "k8s"
+          use-canonical-k8s: true
+          channel: 1.33-classic/stable
+          juju-channel: 3.6/stable
+
+      - name: Prepare juju tf provider environment
+        run: |
+          CONTROLLER=$(juju whoami | yq .Controller)
+          JUJU_CONTROLLER_ADDRESSES="$(juju show-controller | yq '.[$CONTROLLER]'.details.\"api-endpoints\" | tr -d "[]' "|tr -d '"'|tr -d '\n')"
+          JUJU_USERNAME="$(cat ~/.local/share/juju/accounts.yaml | yq .controllers.$CONTROLLER.user|tr -d '"')"
+          JUJU_PASSWORD="$(cat ~/.local/share/juju/accounts.yaml | yq .controllers.$CONTROLLER.password|tr -d '"')"
+
+          echo "JUJU_CONTROLLER_ADDRESSES=$JUJU_CONTROLLER_ADDRESSES" >> "$GITHUB_ENV"
+          echo "JUJU_USERNAME=$JUJU_USERNAME" >> "$GITHUB_ENV"
+          echo "JUJU_PASSWORD=$JUJU_PASSWORD" >> "$GITHUB_ENV"
+          {
+            echo 'JUJU_CA_CERT<<EOF'
+            juju show-controller $(echo $CONTROLLER|tr -d '"') | yq '.[$CONTROLLER]'.details.\"ca-cert\"|tr -d '"'
+            echo EOF
+          } >> "$GITHUB_ENV"
+      - uses: hashicorp/setup-terraform@v3.1.2
+      - run: terraform init
+        working-directory: ${{env.WORKING_DIR}}
+      - run: terraform plan -out=tfplan
+        working-directory: ${{env.WORKING_DIR}}
+      - run: terraform show tfplan
+        working-directory: ${{env.WORKING_DIR}}
+      - run: |
+          juju add-model prod-chat-example
+          set -e  # Exit on error
+          terraform test || { echo "Terraform test failed"; exit 1; }
+        working-directory: ${{env.WORKING_DIR}}
diff --git a/.github/workflows/test_terraform_module.yaml b/.github/workflows/test_terraform_module.yaml
new file mode 100644
index 00000000..9408aafa
--- /dev/null
+++ b/.github/workflows/test_terraform_module.yaml
@@ -0,0 +1,41 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Terraform files test
+
+on:
+  pull_request:
+    paths:
+      - "*/terraform/**"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate terraform configuration files
+    runs-on: ubuntu-latest
+    env:
+      WORKING_DIR: "terraform"
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v5.0.0
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3.1.2
+
+      - name: Run terraform fmt
+        run: terraform fmt -check -recursive
+        working-directory: ${{env.WORKING_DIR}}
+
+      - name: Setup Tflint
+        uses: terraform-linters/setup-tflint@v6.2.0
+        with:
+          tflint_wrapper_enabled: true
+
+      - name: Run tflint
+        run: |
+          tflint --version
+          tflint --init
+          tflint -f compact --recursive
+        working-directory: ${{env.WORKING_DIR}}
diff --git a/webhook-gateway/charm/terraform/README.md b/webhook-gateway/charm/terraform/README.md
new file mode 100644
index 00000000..a5c8f0d7
--- /dev/null
+++ b/webhook-gateway/charm/terraform/README.md
@@ -0,0 +1,57 @@
+# github_runner_webhook_gateway Terraform module
+
+This folder contains a base [Terraform][Terraform] module for the github_runner_webhook_gateway charm.
+
+The module uses the [Terraform Juju provider][Terraform Juju provider] to model the charm
+deployment onto any Kubernetes environment managed by [Juju][Juju].
+
+## Module structure
+
+- **main.tf** - Defines the Juju application to be deployed.
+- **variables.tf** - Allows customization of the deployment. Also models the charm configuration,
+  except for exposing the deployment options (Juju model name, channel or application name).
+- **output.tf** - Integrates the module with other Terraform modules, primarily
+  by defining potential integration endpoints (charm integrations), but also by exposing
+  the Juju application name.
+- **versions.tf** - Defines the Terraform provider version.
+
+## Using github_runner_webhook_gateway base module in higher level modules
+
+If you want to use `github_runner_webhook_gateway` base module as part of your Terraform module, import it
+like shown below:
+
+```text
+data "juju_model" "my_model" {
+  name = var.model
+}
+
+module "github_runner_webhook_gateway" {
+  source = "git::https://github.com/canonical/github-runner-operators/tree/main/webhook-gateway/charm/terraform"
+
+  model = juju_model.my_model.name
+  # (Customize configuration variables here if needed)
+}
+```
+
+Create integrations, for instance:
+
+```text
+resource "juju_integration" "github_runner_webhook_gateway-loki" {
+  model = juju_model.my_model.name
+  application {
+    name     = module.github_runner_webhook_gateway.app_name
+    endpoint = module.github_runner_webhook_gateway.endpoints.logging
+  }
+  application {
+    name     = "loki-k8s"
+    endpoint = "logging"
+  }
+}
+```
+
+The complete list of available integrations can be found [in the Integrations tab][github_runner_webhook_gateway-integrations].
+
+[Terraform]: https://developer.hashicorp.com/terraform
+[Terraform Juju provider]: https://registry.terraform.io/providers/juju/juju/latest
+[Juju]: https://juju.is
+[github_runner_webhook_gateway-integrations]: https://charmhub.io/github_runner_webhook_gateway/integrations
diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
index 77f6425f..2e88c4fe 100644
--- a/webhook-gateway/charm/terraform/main.tf
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -16,4 +16,35 @@ resource "juju_application" "github_runner_webhook_gateway" {
   constraints        = var.constraints
   units              = var.units
   storage_directives = var.storage
+}
+
+resource "juju_application" "rabbitmq" {
+  name  = "rabbitmq"
+  model = var.model
+
+  charm {
+    name     = "rabbitmq_server"
+    channel  = "3.12/stable"
+    revision = 247
+  }
+
+  config      = var.config
+  constraints = "arch=amd64 cores=4 mem=4096M root-disk=51200M" # according to https://www.rabbitmq.com/docs/production-checklist#minimum-hardware 4 cpu 4 GiB of Ram are recommended
+  units       = var.units
+
+  expose {}
+}
+
+
+resource "juju_offer" "rabbitmq_amqp" {
+  model            = var.model
+  application_name = juju_application.rabbitmq.name
+  endpoints        = ["amqp"]
+  name             = "rabbitmq"
+}
+
+resource "juju_access_offer" "this" {
+  offer_url = juju_offer.rabbitmq_amqp.url
+  consume   = ["k8s-prod-github-runner-github-runner"]
+  admin     = [var.model]
 }
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 47cdbc7a..d7b754e2 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -22,6 +22,15 @@ terraform {
   }
 }
 
+resource "juju_secret" "webhook-gateway-secret" {
+  model = "prod-github_runner_webhook_gateway-example"
+  name  = "webhook-gateway"
+  value = {
+    value = data.vault_generic_secret.webhook-gateway.data["webhook_secret"]
+  }
+  info = "The webhook gateway secret used for validating the webhooks"
+}
+
 provider "juju" {}
 
 module "github_runner_webhook_gateway" {
@@ -30,7 +39,9 @@ module "github_runner_webhook_gateway" {
   channel  = var.channel
   model    = "prod-github_runner_webhook_gateway-example"
   revision = var.revision
-  config   = { webhook-secret = "" }
+  config = {
+    webhook-secret = juju_secret.webhook-gateway-secret.secret_uri
+  }
 }
 
 output "app_name" {
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index d1276cc1..06c1e1ac 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -16,11 +16,11 @@ variable "base" {
 variable "channel" {
   description = "The channel to use when deploying a charm."
   type        = string
-  default     = "latest/stable"
+  default     = "latest/edge"
 }
 
 variable "config" {
-  description = "Application config. Details about available options can be found at https://charmhub.io/<charm-name>/configurations."
+  description = "Application config. Details about available options can be found at https://charmhub.io/github-runner-webhook-gateway/configurations."
   type        = map(string)
   default     = {}
 }

From 179e3da914ecb11551b50baf13c5166da18b6b11 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 04:37:16 +0700
Subject: [PATCH 03/35] add secret

---
 webhook-gateway/charm/terraform/main.tf       | 25 ++++---------------
 webhook-gateway/charm/terraform/tests/data.tf |  7 ++++++
 webhook-gateway/charm/terraform/tests/main.tf | 18 +++++++------
 3 files changed, 22 insertions(+), 28 deletions(-)
 create mode 100644 webhook-gateway/charm/terraform/tests/data.tf

diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
index 2e88c4fe..924a9980 100644
--- a/webhook-gateway/charm/terraform/main.tf
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -6,7 +6,7 @@ resource "juju_application" "github_runner_webhook_gateway" {
   model = var.model
 
   charm {
-    name     = "github_runner_webhook_gateway"
+    name     = "github-runner-webhook-gateway"
     channel  = var.channel
     revision = var.revision
     base     = var.base
@@ -23,28 +23,13 @@ resource "juju_application" "rabbitmq" {
   model = var.model
 
   charm {
-    name     = "rabbitmq_server"
+    name     = "rabbitmq-k8s"
     channel  = "3.12/stable"
-    revision = 247
+    revision = var.revision
   }
 
+  trust       = true
   config      = var.config
-  constraints = "arch=amd64 cores=4 mem=4096M root-disk=51200M" # according to https://www.rabbitmq.com/docs/production-checklist#minimum-hardware 4 cpu 4 GiB of Ram are recommended
+  constraints = var.constraints
   units       = var.units
-
-  expose {}
-}
-
-
-resource "juju_offer" "rabbitmq_amqp" {
-  model            = var.model
-  application_name = juju_application.rabbitmq.name
-  endpoints        = ["amqp"]
-  name             = "rabbitmq"
 }
-
-resource "juju_access_offer" "this" {
-  offer_url = juju_offer.rabbitmq_amqp.url
-  consume   = ["k8s-prod-github-runner-github-runner"]
-  admin     = [var.model]
-}
\ No newline at end of file
diff --git a/webhook-gateway/charm/terraform/tests/data.tf b/webhook-gateway/charm/terraform/tests/data.tf
new file mode 100644
index 00000000..cd9c525d
--- /dev/null
+++ b/webhook-gateway/charm/terraform/tests/data.tf
@@ -0,0 +1,7 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+data "vault_generic_secret" "webhook_gateway" {
+  path = "secret/prodstack6/roles/stg-ps6-github-runner-k8s-shared/webhook-gateway"
+}
+
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index d7b754e2..da736414 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -22,13 +22,15 @@ terraform {
   }
 }
 
-resource "juju_secret" "webhook-gateway-secret" {
-  model = "prod-github_runner_webhook_gateway-example"
+resource "juju_model" "webhook" {
+  name = "stg-ps6-github-runner-k8s-shared"
+}
+
+resource "juju_secret" "webhook_gateway_secret" {
+  model = juju_model.webhook.name
   name  = "webhook-gateway"
-  value = {
-    value = data.vault_generic_secret.webhook-gateway.data["webhook_secret"]
-  }
-  info = "The webhook gateway secret used for validating the webhooks"
+  value = { value = data.vault_generic_secret.webhook_gateway.data["webhook_secret"] }
+  info  = "The webhook gateway secret used for validating the webhooks"
 }
 
 provider "juju" {}
@@ -37,10 +39,10 @@ module "github_runner_webhook_gateway" {
   source   = "./.."
   app_name = "github_runner_webhook_gateway"
   channel  = var.channel
-  model    = "prod-github_runner_webhook_gateway-example"
+  model    = juju_model.webhook.name
   revision = var.revision
   config = {
-    webhook-secret = juju_secret.webhook-gateway-secret.secret_uri
+    webhook-secret = juju_secret.webhook_gateway_secret.secret_uri
   }
 }
 

From 5429fd21d2f2f18d457061fab3a3fdc3899cc64d Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 12:08:24 +0700
Subject: [PATCH 04/35] change path

---
 .github/workflows/test_terraform_files.yaml  | 2 +-
 .github/workflows/test_terraform_module.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test_terraform_files.yaml b/.github/workflows/test_terraform_files.yaml
index a02135de..ce72a6a2 100644
--- a/.github/workflows/test_terraform_files.yaml
+++ b/.github/workflows/test_terraform_files.yaml
@@ -6,7 +6,7 @@ name: Terraform module tests
 on:
   pull_request:
     paths:
-      - "*/terraform/**"
+      - "**/terraform/**"
 
 permissions:
   contents: read
diff --git a/.github/workflows/test_terraform_module.yaml b/.github/workflows/test_terraform_module.yaml
index 9408aafa..72814ea4 100644
--- a/.github/workflows/test_terraform_module.yaml
+++ b/.github/workflows/test_terraform_module.yaml
@@ -6,7 +6,7 @@ name: Terraform files test
 on:
   pull_request:
     paths:
-      - "*/terraform/**"
+      - "**/terraform/**"
 
 permissions:
   contents: read

From e88b2d9fc6c3faebbdf5454314ca8a6f388c92ff Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 13:30:16 +0700
Subject: [PATCH 05/35] modify structure

---
 webhook-gateway/charm/terraform/main.tf       | 16 ----------
 webhook-gateway/charm/terraform/outputs.tf    |  2 +-
 webhook-gateway/charm/terraform/tests/main.tf | 29 +++++++++++++++++--
 webhook-gateway/charm/terraform/variables.tf  |  2 +-
 webhook-gateway/charm/terraform/versions.tf   |  2 +-
 5 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
index 924a9980..14f394bd 100644
--- a/webhook-gateway/charm/terraform/main.tf
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -17,19 +17,3 @@ resource "juju_application" "github_runner_webhook_gateway" {
   units              = var.units
   storage_directives = var.storage
 }
-
-resource "juju_application" "rabbitmq" {
-  name  = "rabbitmq"
-  model = var.model
-
-  charm {
-    name     = "rabbitmq-k8s"
-    channel  = "3.12/stable"
-    revision = var.revision
-  }
-
-  trust       = true
-  config      = var.config
-  constraints = var.constraints
-  units       = var.units
-}
diff --git a/webhook-gateway/charm/terraform/outputs.tf b/webhook-gateway/charm/terraform/outputs.tf
index 64518001..876201e6 100644
--- a/webhook-gateway/charm/terraform/outputs.tf
+++ b/webhook-gateway/charm/terraform/outputs.tf
@@ -10,4 +10,4 @@ output "endpoints" {
   value = {
     rabbitmq = "rabbitmq"
   }
-}
\ No newline at end of file
+}
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index da736414..ef30652f 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -23,7 +23,23 @@ terraform {
 }
 
 resource "juju_model" "webhook" {
-  name = "stg-ps6-github-runner-k8s-shared"
+  name = "test-deploy-webhook"
+}
+
+resource "juju_application" "rabbitmq" {
+  name  = "rabbitmq"
+  model = juju_model.webhook.name
+
+  charm {
+    name     = "rabbitmq-k8s"
+    channel  = "3.12/stable"
+    revision = var.revision
+  }
+
+  trust       = true
+  config      = {}
+  constraints = ""
+  units       = 1
 }
 
 resource "juju_secret" "webhook_gateway_secret" {
@@ -33,6 +49,12 @@ resource "juju_secret" "webhook_gateway_secret" {
   info  = "The webhook gateway secret used for validating the webhooks"
 }
 
+resource "juju_access_secret" "webhook_gateway_access" {
+  applications = ["github-runner-webhook-gateway"]
+  model        = juju_model.webhook.name
+  secret_id    = juju_secret.webhook_gateway_secret.secret_id
+}
+
 provider "juju" {}
 
 module "github_runner_webhook_gateway" {
@@ -42,7 +64,8 @@ module "github_runner_webhook_gateway" {
   model    = juju_model.webhook.name
   revision = var.revision
   config = {
-    webhook-secret = juju_secret.webhook_gateway_secret.secret_uri
+    webhook-secret = juju_secret.webhook_gateway_secret.secret_uri,
+    metrics-port   = 9464
   }
 }
 
@@ -54,4 +77,4 @@ output "app_name" {
 output "endpoints" {
   description = "Integration endpoints exposed by github_runner_webhook_gateway charm."
   value       = module.github_runner_webhook_gateway.endpoints
-}
\ No newline at end of file
+}
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index 06c1e1ac..2ca29802 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -52,4 +52,4 @@ variable "units" {
   description = "Number of units to deploy"
   type        = number
   default     = 1
-}
\ No newline at end of file
+}
diff --git a/webhook-gateway/charm/terraform/versions.tf b/webhook-gateway/charm/terraform/versions.tf
index 088a0caf..90fb4593 100644
--- a/webhook-gateway/charm/terraform/versions.tf
+++ b/webhook-gateway/charm/terraform/versions.tf
@@ -8,4 +8,4 @@ terraform {
       version = ">= 0.23.0"
     }
   }
-}
\ No newline at end of file
+}

From e004e453d1ee5f2aa199ef50fc61b930194abd73 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 15:29:33 +0700
Subject: [PATCH 06/35] addaccess secret

---
 .github/workflows/test_terraform_files.yaml   |  4 +--
 .github/workflows/test_terraform_module.yaml  |  4 +--
 webhook-gateway/charm/terraform/README.md     |  5 ++-
 .../charm/terraform/tests/.tflint.hcl         |  2 +-
 webhook-gateway/charm/terraform/tests/main.tf | 31 +++++++++++++------
 .../charm/terraform/tests/main.tftest.hcl     |  2 +-
 6 files changed, 29 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/test_terraform_files.yaml b/.github/workflows/test_terraform_files.yaml
index ce72a6a2..a95a0ccb 100644
--- a/.github/workflows/test_terraform_files.yaml
+++ b/.github/workflows/test_terraform_files.yaml
@@ -1,7 +1,7 @@
 # Copyright 2025 Canonical Ltd.
 # See LICENSE file for licensing details.
 
-name: Terraform module tests
+name: Terraform module tests (webhook-gateway)
 
 on:
   pull_request:
@@ -16,7 +16,7 @@ jobs:
     name: Test Terraform with Juju
     runs-on: ubuntu-latest
     env:
-      WORKING_DIR: "terraform/tests"
+      WORKING_DIR: "webhook-gateway/charm/terraform/tests"
     steps:
       - uses: actions/checkout@v5.0.0
       - uses: charmed-kubernetes/actions-operator@main
diff --git a/.github/workflows/test_terraform_module.yaml b/.github/workflows/test_terraform_module.yaml
index 72814ea4..17beb178 100644
--- a/.github/workflows/test_terraform_module.yaml
+++ b/.github/workflows/test_terraform_module.yaml
@@ -1,7 +1,7 @@
 # Copyright 2025 Canonical Ltd.
 # See LICENSE file for licensing details.
 
-name: Terraform files test
+name: Terraform files test (webhook-gateway)
 
 on:
   pull_request:
@@ -16,7 +16,7 @@ jobs:
     name: Validate terraform configuration files
     runs-on: ubuntu-latest
     env:
-      WORKING_DIR: "terraform"
+      WORKING_DIR: "webhook-gateway/charm/terraform"
     steps:
       - name: Check out code
         uses: actions/checkout@v5.0.0
diff --git a/webhook-gateway/charm/terraform/README.md b/webhook-gateway/charm/terraform/README.md
index a5c8f0d7..31d577a2 100644
--- a/webhook-gateway/charm/terraform/README.md
+++ b/webhook-gateway/charm/terraform/README.md
@@ -36,15 +36,14 @@ module "github_runner_webhook_gateway" {
 Create integrations, for instance:
 
 ```text
-resource "juju_integration" "github_runner_webhook_gateway-loki" {
+resource "juju_integration" "webhook_rabbitmq" {
   model = juju_model.my_model.name
   application {
     name     = module.github_runner_webhook_gateway.app_name
     endpoint = module.github_runner_webhook_gateway.endpoints.logging
   }
   application {
-    name     = "loki-k8s"
-    endpoint = "logging"
+    name = "rabbitmq"
   }
 }
 ```
diff --git a/webhook-gateway/charm/terraform/tests/.tflint.hcl b/webhook-gateway/charm/terraform/tests/.tflint.hcl
index f93dae18..01f1384f 100644
--- a/webhook-gateway/charm/terraform/tests/.tflint.hcl
+++ b/webhook-gateway/charm/terraform/tests/.tflint.hcl
@@ -3,4 +3,4 @@
 
 rule "terraform_required_version" {
   enabled = false
-}
\ No newline at end of file
+}
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index ef30652f..48892d86 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -1,6 +1,11 @@
 # Copyright 2025 Canonical Ltd.
 # See LICENSE file for licensing details.
 
+locals {
+  webhook_gateway_app_name = "github-runner-webhook-gateway"
+  juju_model_name          = "test-deploy-webhook-gateway"
+}
+
 variable "channel" {
   description = "The channel to use when deploying a charm."
   type        = string
@@ -22,13 +27,9 @@ terraform {
   }
 }
 
-resource "juju_model" "webhook" {
-  name = "test-deploy-webhook"
-}
-
 resource "juju_application" "rabbitmq" {
   name  = "rabbitmq"
-  model = juju_model.webhook.name
+  model = local.juju_model_name
 
   charm {
     name     = "rabbitmq-k8s"
@@ -43,25 +44,35 @@ resource "juju_application" "rabbitmq" {
 }
 
 resource "juju_secret" "webhook_gateway_secret" {
-  model = juju_model.webhook.name
+  model = local.juju_model_name
   name  = "webhook-gateway"
   value = { value = data.vault_generic_secret.webhook_gateway.data["webhook_secret"] }
   info  = "The webhook gateway secret used for validating the webhooks"
 }
 
 resource "juju_access_secret" "webhook_gateway_access" {
-  applications = ["github-runner-webhook-gateway"]
-  model        = juju_model.webhook.name
+  applications = [local.webhook_gateway_app_name]
+  model        = local.juju_model_name
   secret_id    = juju_secret.webhook_gateway_secret.secret_id
 }
 
+resource "juju_integration" "webhook_rabbitmq" {
+  model = local.juju_model_name
+  application {
+    name = local.webhook_gateway_app_name
+  }
+  application {
+    name = juju_application.rabbitmq.name
+  }
+}
+
 provider "juju" {}
 
 module "github_runner_webhook_gateway" {
   source   = "./.."
-  app_name = "github_runner_webhook_gateway"
+  app_name = local.webhook_gateway_app_name
   channel  = var.channel
-  model    = juju_model.webhook.name
+  model    = local.juju_model_name
   revision = var.revision
   config = {
     webhook-secret = juju_secret.webhook_gateway_secret.secret_uri,
diff --git a/webhook-gateway/charm/terraform/tests/main.tftest.hcl b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
index dbf45797..aad64b1f 100644
--- a/webhook-gateway/charm/terraform/tests/main.tftest.hcl
+++ b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
@@ -12,4 +12,4 @@ run "basic_deploy" {
     condition     = module.github_runner_webhook_gateway.app_name == "github_runner_webhook_gateway"
     error_message = "github_runner_webhook_gateway app_name did not match expected"
   }
-}
\ No newline at end of file
+}

From 7fa5fcbe86f9ce9c9fc5b105e193e60d6ab706e3 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 15:35:05 +0700
Subject: [PATCH 07/35] add vault providers

---
 webhook-gateway/charm/terraform/versions.tf | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/webhook-gateway/charm/terraform/versions.tf b/webhook-gateway/charm/terraform/versions.tf
index 90fb4593..455f1549 100644
--- a/webhook-gateway/charm/terraform/versions.tf
+++ b/webhook-gateway/charm/terraform/versions.tf
@@ -2,7 +2,13 @@
 # See LICENSE file for licensing details.
 
 terraform {
+  required_version = ">= 1.6.6"
   required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.3.0"
+    }
+
     juju = {
       source  = "juju/juju"
       version = ">= 0.23.0"

From a64857824a42bc3f881f43c713dce731cac2308a Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 15:38:23 +0700
Subject: [PATCH 08/35] add vault to test

---
 webhook-gateway/charm/terraform/tests/main.tf | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 48892d86..ae23113e 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -19,10 +19,16 @@ variable "revision" {
 }
 
 terraform {
+  required_version = ">= 1.6.6"
   required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.3.0"
+    }
+
     juju = {
-      version = "~> 0.23.0"
       source  = "juju/juju"
+      version = ">= 0.23.0"
     }
   }
 }

From 01110bc9bc4f71b04269ca6331a72d2e0be0e296 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 17:04:11 +0700
Subject: [PATCH 09/35] remove invalid input

---
 ...st_terraform_module.yaml => test_terraform_webhook_file.yaml} | 0
 ...t_terraform_files.yaml => test_terraform_webhook_module.yaml} | 1 -
 2 files changed, 1 deletion(-)
 rename .github/workflows/{test_terraform_module.yaml => test_terraform_webhook_file.yaml} (100%)
 rename .github/workflows/{test_terraform_files.yaml => test_terraform_webhook_module.yaml} (98%)

diff --git a/.github/workflows/test_terraform_module.yaml b/.github/workflows/test_terraform_webhook_file.yaml
similarity index 100%
rename from .github/workflows/test_terraform_module.yaml
rename to .github/workflows/test_terraform_webhook_file.yaml
diff --git a/.github/workflows/test_terraform_files.yaml b/.github/workflows/test_terraform_webhook_module.yaml
similarity index 98%
rename from .github/workflows/test_terraform_files.yaml
rename to .github/workflows/test_terraform_webhook_module.yaml
index a95a0ccb..015e309d 100644
--- a/.github/workflows/test_terraform_files.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -22,7 +22,6 @@ jobs:
       - uses: charmed-kubernetes/actions-operator@main
         with:
           provider: "k8s"
-          use-canonical-k8s: true
           channel: 1.33-classic/stable
           juju-channel: 3.6/stable
 

From 67acc09dd4434e17c5f19602799598f959de6d95 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 17:10:58 +0700
Subject: [PATCH 10/35] change provider

---
 .github/workflows/test_terraform_webhook_module.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 015e309d..8942f1bb 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v5.0.0
       - uses: charmed-kubernetes/actions-operator@main
         with:
-          provider: "k8s"
+          provider: "microk8s"
           channel: 1.33-classic/stable
           juju-channel: 3.6/stable
 

From 4a1461786b5cc466075be7428ccacbf93d38d068 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 17:13:56 +0700
Subject: [PATCH 11/35] change channel

---
 .github/workflows/test_terraform_webhook_module.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 8942f1bb..3f7c30e8 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -22,7 +22,7 @@ jobs:
       - uses: charmed-kubernetes/actions-operator@main
         with:
           provider: "microk8s"
-          channel: 1.33-classic/stable
+          channel: latest/stable
           juju-channel: 3.6/stable
 
       - name: Prepare juju tf provider environment

From 8d2ab544641d0a772e5d0e57bd0951a975f9a2a7 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Wed, 22 Oct 2025 17:19:34 +0700
Subject: [PATCH 12/35] change channel to strict

---
 .github/workflows/test_terraform_webhook_module.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 3f7c30e8..ea3147e2 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -22,7 +22,7 @@ jobs:
       - uses: charmed-kubernetes/actions-operator@main
         with:
           provider: "microk8s"
-          channel: latest/stable
+          channel: 1.33-strict/stable
           juju-channel: 3.6/stable
 
       - name: Prepare juju tf provider environment

From cc53cbe898959612f98a038e5781b5beb31c117f Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 14:06:03 +0700
Subject: [PATCH 13/35] add steps

---
 .../test_terraform_webhook_module.yaml        | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index ea3147e2..b10794a6 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -27,6 +27,7 @@ jobs:
 
       - name: Prepare juju tf provider environment
         run: |
+          set -e
           CONTROLLER=$(juju whoami | yq .Controller)
           JUJU_CONTROLLER_ADDRESSES="$(juju show-controller | yq '.[$CONTROLLER]'.details.\"api-endpoints\" | tr -d "[]' "|tr -d '"'|tr -d '\n')"
           JUJU_USERNAME="$(cat ~/.local/share/juju/accounts.yaml | yq .controllers.$CONTROLLER.user|tr -d '"')"
@@ -43,12 +44,31 @@ jobs:
       - uses: hashicorp/setup-terraform@v3.1.2
       - run: terraform init
         working-directory: ${{env.WORKING_DIR}}
+      - run: terraform validate
+        working-directory: ${{env.WORKING_DIR}}
       - run: terraform plan -out=tfplan
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform show tfplan
         working-directory: ${{env.WORKING_DIR}}
       - run: |
-          juju add-model prod-chat-example
+          juju add-model test-deploy-webhook-gateway
           set -e  # Exit on error
           terraform test || { echo "Terraform test failed"; exit 1; }
         working-directory: ${{env.WORKING_DIR}}
+      - name: Apply Terraform
+        run: terraform apply -auto-approve
+        working-directory: ${{ env.WORKING_DIR }}
+      - name: Wait for github-runner-webhook-gateway to be deployed
+        run: |
+          echo "Waiting for github-runner-webhook-gateway to be deployed..."
+          juju wait-for application github-runner-webhook-gateway --query='status=="maintenance" || status=="blocked"' --timeout=10m
+
+      - name: Verify github-runner-webhook-gateway application is deployed
+        run: |
+          STATUS=$(juju status github-runner-webhook-gateway --model test-deploy-webhook-gateway --format=json | jq -r '.applications.github-runner-webhook-gateway["application-status"].current')
+          echo "github-runner-webhook-gateway status: $STATUS"
+          if [ "$STATUS" == "error" ] || [ "$STATUS" == "unknown" ]; then
+            echo "github-runner-webhook-gateway failed to deploy or is unknown"
+            juju status --model test-deploy-webhook-gateway
+            exit 1
+          fi

From 5b23e73b7b59d9c9b75103fb80d37f50e29fa39a Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 14:16:29 +0700
Subject: [PATCH 14/35] add tmate

---
 .github/workflows/test_terraform_webhook_module.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index b10794a6..5024eadd 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -12,6 +12,13 @@ permissions:
   contents: read
 
 jobs:
+  build:
+    runs-on: [self-hosted, linux, X64, jammy, large]
+    steps:
+      - name: Setup tmate session
+        uses: canonical/action-tmate@main
+        with:
+          detached: true
   test-terraform:
     name: Test Terraform with Juju
     runs-on: ubuntu-latest

From 728df552b0851dc2d004daa25bf994c15c3068aa Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 17:06:36 +0700
Subject: [PATCH 15/35] add tmate

---
 .github/workflows/test_terraform_webhook_module.yaml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 5024eadd..e608d313 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -12,13 +12,6 @@ permissions:
   contents: read
 
 jobs:
-  build:
-    runs-on: [self-hosted, linux, X64, jammy, large]
-    steps:
-      - name: Setup tmate session
-        uses: canonical/action-tmate@main
-        with:
-          detached: true
   test-terraform:
     name: Test Terraform with Juju
     runs-on: ubuntu-latest
@@ -53,6 +46,8 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform validate
         working-directory: ${{env.WORKING_DIR}}
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
       - run: terraform plan -out=tfplan
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform show tfplan

From d753598f40fc7963dd7f7c8a0e68af7fbd9df967 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:04:18 +0700
Subject: [PATCH 16/35] remove secret

---
 .../test_terraform_webhook_module.yaml        | 17 ----------------
 webhook-gateway/charm/terraform/tests/data.tf |  7 -------
 webhook-gateway/charm/terraform/tests/main.tf | 20 +------------------
 3 files changed, 1 insertion(+), 43 deletions(-)
 delete mode 100644 webhook-gateway/charm/terraform/tests/data.tf

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index e608d313..27756182 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -57,20 +57,3 @@ jobs:
           set -e  # Exit on error
           terraform test || { echo "Terraform test failed"; exit 1; }
         working-directory: ${{env.WORKING_DIR}}
-      - name: Apply Terraform
-        run: terraform apply -auto-approve
-        working-directory: ${{ env.WORKING_DIR }}
-      - name: Wait for github-runner-webhook-gateway to be deployed
-        run: |
-          echo "Waiting for github-runner-webhook-gateway to be deployed..."
-          juju wait-for application github-runner-webhook-gateway --query='status=="maintenance" || status=="blocked"' --timeout=10m
-
-      - name: Verify github-runner-webhook-gateway application is deployed
-        run: |
-          STATUS=$(juju status github-runner-webhook-gateway --model test-deploy-webhook-gateway --format=json | jq -r '.applications.github-runner-webhook-gateway["application-status"].current')
-          echo "github-runner-webhook-gateway status: $STATUS"
-          if [ "$STATUS" == "error" ] || [ "$STATUS" == "unknown" ]; then
-            echo "github-runner-webhook-gateway failed to deploy or is unknown"
-            juju status --model test-deploy-webhook-gateway
-            exit 1
-          fi
diff --git a/webhook-gateway/charm/terraform/tests/data.tf b/webhook-gateway/charm/terraform/tests/data.tf
deleted file mode 100644
index cd9c525d..00000000
--- a/webhook-gateway/charm/terraform/tests/data.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-# Copyright 2025 Canonical Ltd.
-# See LICENSE file for licensing details.
-
-data "vault_generic_secret" "webhook_gateway" {
-  path = "secret/prodstack6/roles/stg-ps6-github-runner-k8s-shared/webhook-gateway"
-}
-
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index ae23113e..4991a16e 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -21,11 +21,6 @@ variable "revision" {
 terraform {
   required_version = ">= 1.6.6"
   required_providers {
-    vault = {
-      source  = "hashicorp/vault"
-      version = "~> 4.3.0"
-    }
-
     juju = {
       source  = "juju/juju"
       version = ">= 0.23.0"
@@ -49,19 +44,6 @@ resource "juju_application" "rabbitmq" {
   units       = 1
 }
 
-resource "juju_secret" "webhook_gateway_secret" {
-  model = local.juju_model_name
-  name  = "webhook-gateway"
-  value = { value = data.vault_generic_secret.webhook_gateway.data["webhook_secret"] }
-  info  = "The webhook gateway secret used for validating the webhooks"
-}
-
-resource "juju_access_secret" "webhook_gateway_access" {
-  applications = [local.webhook_gateway_app_name]
-  model        = local.juju_model_name
-  secret_id    = juju_secret.webhook_gateway_secret.secret_id
-}
-
 resource "juju_integration" "webhook_rabbitmq" {
   model = local.juju_model_name
   application {
@@ -81,7 +63,7 @@ module "github_runner_webhook_gateway" {
   model    = local.juju_model_name
   revision = var.revision
   config = {
-    webhook-secret = juju_secret.webhook_gateway_secret.secret_uri,
+    webhook-secret = "",
     metrics-port   = 9464
   }
 }

From 5b0d0e80a945b3729c91fc6eca5aac85d112ac89 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:15:46 +0700
Subject: [PATCH 17/35] remove tmate

---
 .github/workflows/test_terraform_webhook_module.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 27756182..49365756 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -46,8 +46,6 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform validate
         working-directory: ${{env.WORKING_DIR}}
-      - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
       - run: terraform plan -out=tfplan
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform show tfplan

From e21f76e49e6627cd3adece042e66613a066b8cef Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:25:48 +0700
Subject: [PATCH 18/35] remove revision

---
 webhook-gateway/charm/terraform/tests/main.tf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 4991a16e..ace8581b 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -35,7 +35,6 @@ resource "juju_application" "rabbitmq" {
   charm {
     name     = "rabbitmq-k8s"
     channel  = "3.12/stable"
-    revision = var.revision
   }
 
   trust       = true

From c29f3da6dd6fecb34d941f49147c7bef720f2d2a Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:26:46 +0700
Subject: [PATCH 19/35] fix format

---
 webhook-gateway/charm/terraform/tests/main.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index ace8581b..d64fe806 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -33,8 +33,8 @@ resource "juju_application" "rabbitmq" {
   model = local.juju_model_name
 
   charm {
-    name     = "rabbitmq-k8s"
-    channel  = "3.12/stable"
+    name    = "rabbitmq-k8s"
+    channel = "3.12/stable"
   }
 
   trust       = true

From af0d387659cd6648edd1a9241e76da99389c9fa6 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:32:49 +0700
Subject: [PATCH 20/35] change app name

---
 webhook-gateway/charm/terraform/tests/main.tftest.hcl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/webhook-gateway/charm/terraform/tests/main.tftest.hcl b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
index aad64b1f..a05a63d5 100644
--- a/webhook-gateway/charm/terraform/tests/main.tftest.hcl
+++ b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
@@ -9,7 +9,7 @@ variables {
 
 run "basic_deploy" {
   assert {
-    condition     = module.github_runner_webhook_gateway.app_name == "github_runner_webhook_gateway"
-    error_message = "github_runner_webhook_gateway app_name did not match expected"
+    condition     = module.github_runner_webhook_gateway.app_name == "github-runner-webhook-gateway"
+    error_message = "github-runner-webhook-gateway app_name did not match expected"
   }
 }

From a2d63bbf14470a4907ea7cc9ed9795424dd6ef7f Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:35:44 +0700
Subject: [PATCH 21/35] add eof

---
 webhook-gateway/charm/terraform/.tflint.hcl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webhook-gateway/charm/terraform/.tflint.hcl b/webhook-gateway/charm/terraform/.tflint.hcl
index f93dae18..01f1384f 100644
--- a/webhook-gateway/charm/terraform/.tflint.hcl
+++ b/webhook-gateway/charm/terraform/.tflint.hcl
@@ -3,4 +3,4 @@
 
 rule "terraform_required_version" {
   enabled = false
-}
\ No newline at end of file
+}

From 7148d935a50bb42ba438e2fd649c473d08c20fee Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 23 Oct 2025 19:50:39 +0700
Subject: [PATCH 22/35] add cleanup

---
 .github/workflows/test_terraform_webhook_module.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 49365756..eb317386 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -55,3 +55,7 @@ jobs:
           set -e  # Exit on error
           terraform test || { echo "Terraform test failed"; exit 1; }
         working-directory: ${{env.WORKING_DIR}}
+      - name: Cleanup Juju model
+        if: always()
+        run: |
+          juju destroy-model test-deploy-webhook-gateway --force --no-wait || true

From 6fa967fb77bdfc80be13a21368aed6c2af6e641a Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Fri, 24 Oct 2025 13:29:33 +0700
Subject: [PATCH 23/35] remove vault provider

---
 webhook-gateway/charm/terraform/versions.tf | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/webhook-gateway/charm/terraform/versions.tf b/webhook-gateway/charm/terraform/versions.tf
index 455f1549..212fa91e 100644
--- a/webhook-gateway/charm/terraform/versions.tf
+++ b/webhook-gateway/charm/terraform/versions.tf
@@ -4,11 +4,6 @@
 terraform {
   required_version = ">= 1.6.6"
   required_providers {
-    vault = {
-      source  = "hashicorp/vault"
-      version = "~> 4.3.0"
-    }
-
     juju = {
       source  = "juju/juju"
       version = ">= 0.23.0"

From e39e54c6a6cc4ebfed7a8bb5b43b8174ca3b1f75 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Fri, 24 Oct 2025 13:45:51 +0700
Subject: [PATCH 24/35] add tmate

---
 .github/workflows/test_terraform_webhook_module.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index eb317386..bedb7f84 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -50,12 +50,10 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform show tfplan
         working-directory: ${{env.WORKING_DIR}}
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
       - run: |
           juju add-model test-deploy-webhook-gateway
           set -e  # Exit on error
           terraform test || { echo "Terraform test failed"; exit 1; }
         working-directory: ${{env.WORKING_DIR}}
-      - name: Cleanup Juju model
-        if: always()
-        run: |
-          juju destroy-model test-deploy-webhook-gateway --force --no-wait || true

From d607ad47de8064804e677249a3bc41980b11bacb Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Fri, 24 Oct 2025 14:29:54 +0700
Subject: [PATCH 25/35] remove secret

---
 .github/workflows/test_terraform_webhook_module.yaml | 2 --
 webhook-gateway/charm/terraform/tests/main.tf        | 3 +--
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index bedb7f84..49365756 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -50,8 +50,6 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform show tfplan
         working-directory: ${{env.WORKING_DIR}}
-      - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
       - run: |
           juju add-model test-deploy-webhook-gateway
           set -e  # Exit on error
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index d64fe806..27c63617 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -62,8 +62,7 @@ module "github_runner_webhook_gateway" {
   model    = local.juju_model_name
   revision = var.revision
   config = {
-    webhook-secret = "",
-    metrics-port   = 9464
+    metrics-port = 9464
   }
 }
 

From 4117bbc15c420642f2d955acc087b9afcad1bfe5 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 14:24:00 +0700
Subject: [PATCH 26/35] update model to model_uuid

---
 .../test_terraform_webhook_module.yaml        |  2 +-
 webhook-gateway/charm/terraform/main.tf       |  4 ++--
 webhook-gateway/charm/terraform/tests/main.tf | 23 +++++++++++--------
 webhook-gateway/charm/terraform/variables.tf  |  4 ++--
 4 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 49365756..80107f75 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -51,7 +51,7 @@ jobs:
       - run: terraform show tfplan
         working-directory: ${{env.WORKING_DIR}}
       - run: |
-          juju add-model test-deploy-webhook-gateway
+          juju add-model stg-deploy-webhook-gateway
           set -e  # Exit on error
           terraform test || { echo "Terraform test failed"; exit 1; }
         working-directory: ${{env.WORKING_DIR}}
diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
index 14f394bd..ed4b4e6e 100644
--- a/webhook-gateway/charm/terraform/main.tf
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -2,8 +2,8 @@
 # See LICENSE file for licensing details.
 
 resource "juju_application" "github_runner_webhook_gateway" {
-  name  = var.app_name
-  model = var.model
+  name       = var.app_name
+  model_uuid = var.model_uuid
 
   charm {
     name     = "github-runner-webhook-gateway"
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 27c63617..8e0fed10 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -3,7 +3,7 @@
 
 locals {
   webhook_gateway_app_name = "github-runner-webhook-gateway"
-  juju_model_name          = "test-deploy-webhook-gateway"
+  juju_model_name          = "stg-deploy-webhook-gateway"
 }
 
 variable "channel" {
@@ -28,9 +28,14 @@ terraform {
   }
 }
 
+data "juju_model" "webhook" {
+  name  = local.juju_model_name
+  owner = "admin"
+}
+
 resource "juju_application" "rabbitmq" {
-  name  = "rabbitmq"
-  model = local.juju_model_name
+  name       = "rabbitmq"
+  model_uuid = data.juju_model.webhook.id
 
   charm {
     name    = "rabbitmq-k8s"
@@ -44,7 +49,7 @@ resource "juju_application" "rabbitmq" {
 }
 
 resource "juju_integration" "webhook_rabbitmq" {
-  model = local.juju_model_name
+  model_uuid = data.juju_model.webhook.id
   application {
     name = local.webhook_gateway_app_name
   }
@@ -56,11 +61,11 @@ resource "juju_integration" "webhook_rabbitmq" {
 provider "juju" {}
 
 module "github_runner_webhook_gateway" {
-  source   = "./.."
-  app_name = local.webhook_gateway_app_name
-  channel  = var.channel
-  model    = local.juju_model_name
-  revision = var.revision
+  source     = "./.."
+  app_name   = local.webhook_gateway_app_name
+  channel    = var.channel
+  model_uuid = data.juju_model.webhook.id
+  revision   = var.revision
   config = {
     metrics-port = 9464
   }
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index 2ca29802..86ccb8ee 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -31,8 +31,8 @@ variable "constraints" {
   default     = ""
 }
 
-variable "model" {
-  description = "Reference to a `juju_model`."
+variable "model_uuid" {
+  description = "Reference to a Juju model UUID."
   type        = string
 }
 

From fd48d813b017f96661bb74b111971d9ec264b81d Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 14:35:33 +0700
Subject: [PATCH 27/35] remove owner

---
 webhook-gateway/charm/terraform/tests/main.tf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 8e0fed10..67ee6af6 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -30,7 +30,6 @@ terraform {
 
 data "juju_model" "webhook" {
   name  = local.juju_model_name
-  owner = "admin"
 }
 
 resource "juju_application" "rabbitmq" {

From 72c233216379c26aac6c35e4fd003b1cb67f1c29 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 14:49:53 +0700
Subject: [PATCH 28/35] reorder workflow

---
 .github/workflows/test_terraform_webhook_module.yaml | 3 +--
 webhook-gateway/charm/terraform/tests/main.tf        | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 80107f75..3944bc05 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -41,6 +41,7 @@ jobs:
             juju show-controller $(echo $CONTROLLER|tr -d '"') | yq '.[$CONTROLLER]'.details.\"ca-cert\"|tr -d '"'
             echo EOF
           } >> "$GITHUB_ENV"
+      - run: juju add-model stg-deploy-webhook-gateway
       - uses: hashicorp/setup-terraform@v3.1.2
       - run: terraform init
         working-directory: ${{env.WORKING_DIR}}
@@ -51,7 +52,5 @@ jobs:
       - run: terraform show tfplan
         working-directory: ${{env.WORKING_DIR}}
       - run: |
-          juju add-model stg-deploy-webhook-gateway
-          set -e  # Exit on error
           terraform test || { echo "Terraform test failed"; exit 1; }
         working-directory: ${{env.WORKING_DIR}}
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 67ee6af6..8e0fed10 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -30,6 +30,7 @@ terraform {
 
 data "juju_model" "webhook" {
   name  = local.juju_model_name
+  owner = "admin"
 }
 
 resource "juju_application" "rabbitmq" {

From 726b45b2eb8d005970d5c7076a90256a2fb39528 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 22:42:36 +0700
Subject: [PATCH 29/35] apply code suggestion

---
 ...webhook_file.yaml => test_terraform_webhook_lint.yaml} | 2 +-
 .github/workflows/test_terraform_webhook_module.yaml      | 5 ++---
 webhook-gateway/charm/terraform/.tflint.hcl               | 6 ------
 webhook-gateway/charm/terraform/README.md                 | 5 ++---
 webhook-gateway/charm/terraform/tests/.tflint.hcl         | 6 ------
 webhook-gateway/charm/terraform/tests/main.tf             | 8 ++++----
 webhook-gateway/charm/terraform/variables.tf              | 2 +-
 webhook-gateway/charm/terraform/versions.tf               | 2 +-
 8 files changed, 11 insertions(+), 25 deletions(-)
 rename .github/workflows/{test_terraform_webhook_file.yaml => test_terraform_webhook_lint.yaml} (95%)
 delete mode 100644 webhook-gateway/charm/terraform/.tflint.hcl
 delete mode 100644 webhook-gateway/charm/terraform/tests/.tflint.hcl

diff --git a/.github/workflows/test_terraform_webhook_file.yaml b/.github/workflows/test_terraform_webhook_lint.yaml
similarity index 95%
rename from .github/workflows/test_terraform_webhook_file.yaml
rename to .github/workflows/test_terraform_webhook_lint.yaml
index 17beb178..c0737e85 100644
--- a/.github/workflows/test_terraform_webhook_file.yaml
+++ b/.github/workflows/test_terraform_webhook_lint.yaml
@@ -1,7 +1,7 @@
 # Copyright 2025 Canonical Ltd.
 # See LICENSE file for licensing details.
 
-name: Terraform files test (webhook-gateway)
+name: Terraform lint test (webhook-gateway)
 
 on:
   pull_request:
diff --git a/.github/workflows/test_terraform_webhook_module.yaml b/.github/workflows/test_terraform_webhook_module.yaml
index 3944bc05..3e1bae44 100644
--- a/.github/workflows/test_terraform_webhook_module.yaml
+++ b/.github/workflows/test_terraform_webhook_module.yaml
@@ -22,7 +22,7 @@ jobs:
       - uses: charmed-kubernetes/actions-operator@main
         with:
           provider: "microk8s"
-          channel: 1.33-strict/stable
+          channel: 1.34-strict/stable
           juju-channel: 3.6/stable
 
       - name: Prepare juju tf provider environment
@@ -51,6 +51,5 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
       - run: terraform show tfplan
         working-directory: ${{env.WORKING_DIR}}
-      - run: |
-          terraform test || { echo "Terraform test failed"; exit 1; }
+      - run: terraform test
         working-directory: ${{env.WORKING_DIR}}
diff --git a/webhook-gateway/charm/terraform/.tflint.hcl b/webhook-gateway/charm/terraform/.tflint.hcl
deleted file mode 100644
index 01f1384f..00000000
--- a/webhook-gateway/charm/terraform/.tflint.hcl
+++ /dev/null
@@ -1,6 +0,0 @@
-# Copyright 2025 Canonical Ltd.
-# See LICENSE file for licensing details.
-
-rule "terraform_required_version" {
-  enabled = false
-}
diff --git a/webhook-gateway/charm/terraform/README.md b/webhook-gateway/charm/terraform/README.md
index 31d577a2..248087e8 100644
--- a/webhook-gateway/charm/terraform/README.md
+++ b/webhook-gateway/charm/terraform/README.md
@@ -1,6 +1,6 @@
-# github_runner_webhook_gateway Terraform module
+# GitHub runner webhook gateway terraform module
 
-This folder contains a base [Terraform][Terraform] module for the github_runner_webhook_gateway charm.
+This folder contains a base [Terraform][Terraform] module for the GitHub runner webhook gateway charm.
 
 The module uses the [Terraform Juju provider][Terraform Juju provider] to model the charm
 deployment onto any Kubernetes environment managed by [Juju][Juju].
@@ -40,7 +40,6 @@ resource "juju_integration" "webhook_rabbitmq" {
   model = juju_model.my_model.name
   application {
     name     = module.github_runner_webhook_gateway.app_name
-    endpoint = module.github_runner_webhook_gateway.endpoints.logging
   }
   application {
     name = "rabbitmq"
diff --git a/webhook-gateway/charm/terraform/tests/.tflint.hcl b/webhook-gateway/charm/terraform/tests/.tflint.hcl
deleted file mode 100644
index 01f1384f..00000000
--- a/webhook-gateway/charm/terraform/tests/.tflint.hcl
+++ /dev/null
@@ -1,6 +0,0 @@
-# Copyright 2025 Canonical Ltd.
-# See LICENSE file for licensing details.
-
-rule "terraform_required_version" {
-  enabled = false
-}
diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 8e0fed10..25e0256e 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -23,7 +23,7 @@ terraform {
   required_providers {
     juju = {
       source  = "juju/juju"
-      version = ">= 0.23.0"
+      version = ">= 1.0.0"
     }
   }
 }
@@ -35,7 +35,7 @@ data "juju_model" "webhook" {
 
 resource "juju_application" "rabbitmq" {
   name       = "rabbitmq"
-  model_uuid = data.juju_model.webhook.id
+  model_uuid = data.juju_model.webhook.uuid
 
   charm {
     name    = "rabbitmq-k8s"
@@ -49,7 +49,7 @@ resource "juju_application" "rabbitmq" {
 }
 
 resource "juju_integration" "webhook_rabbitmq" {
-  model_uuid = data.juju_model.webhook.id
+  model_uuid = data.juju_model.webhook.uuid
   application {
     name = local.webhook_gateway_app_name
   }
@@ -64,7 +64,7 @@ module "github_runner_webhook_gateway" {
   source     = "./.."
   app_name   = local.webhook_gateway_app_name
   channel    = var.channel
-  model_uuid = data.juju_model.webhook.id
+  model_uuid = data.juju_model.webhook.uuid
   revision   = var.revision
   config = {
     metrics-port = 9464
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index 86ccb8ee..128acca0 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -16,7 +16,7 @@ variable "base" {
 variable "channel" {
   description = "The channel to use when deploying a charm."
   type        = string
-  default     = "latest/edge"
+  default     = "latest/edge" # change to latest/stable when available
 }
 
 variable "config" {
diff --git a/webhook-gateway/charm/terraform/versions.tf b/webhook-gateway/charm/terraform/versions.tf
index 212fa91e..2a99ba1b 100644
--- a/webhook-gateway/charm/terraform/versions.tf
+++ b/webhook-gateway/charm/terraform/versions.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     juju = {
       source  = "juju/juju"
-      version = ">= 0.23.0"
+      version = ">= 1.0.0"
     }
   }
 }

From 776450751882ecf9cf31e9715db22a06105040cd Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 22:58:40 +0700
Subject: [PATCH 30/35] update readme

---
 webhook-gateway/charm/terraform/README.md    | 5 +++--
 webhook-gateway/charm/terraform/main.tf      | 6 +++++-
 webhook-gateway/charm/terraform/variables.tf | 4 ++--
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/webhook-gateway/charm/terraform/README.md b/webhook-gateway/charm/terraform/README.md
index 248087e8..6e468362 100644
--- a/webhook-gateway/charm/terraform/README.md
+++ b/webhook-gateway/charm/terraform/README.md
@@ -22,7 +22,8 @@ like shown below:
 
 ```text
 data "juju_model" "my_model" {
-  name = var.model
+  name  = var.model
+  owner = "admin"
 }
 
 module "github_runner_webhook_gateway" {
@@ -37,7 +38,7 @@ Create integrations, for instance:
 
 ```text
 resource "juju_integration" "webhook_rabbitmq" {
-  model = juju_model.my_model.name
+  model_uuid = data.juju_model.my_model.uuid
   application {
     name     = module.github_runner_webhook_gateway.app_name
   }
diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
index ed4b4e6e..5a732352 100644
--- a/webhook-gateway/charm/terraform/main.tf
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -1,9 +1,13 @@
 # Copyright 2025 Canonical Ltd.
 # See LICENSE file for licensing details.
 
+resource "juju_model" "webhook" {
+  name = var.model
+}
+
 resource "juju_application" "github_runner_webhook_gateway" {
   name       = var.app_name
-  model_uuid = var.model_uuid
+  model_uuid = juju_model.webhook.uuid
 
   charm {
     name     = "github-runner-webhook-gateway"
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index 128acca0..d95ebeda 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -31,8 +31,8 @@ variable "constraints" {
   default     = ""
 }
 
-variable "model_uuid" {
-  description = "Reference to a Juju model UUID."
+variable "model" {
+  description = "Reference to a `juju_model`."
   type        = string
 }
 

From 751048e99bebf247ee150dcde71d847cd9a3a7a9 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 23:09:17 +0700
Subject: [PATCH 31/35] Revert "update readme"

This reverts commit 776450751882ecf9cf31e9715db22a06105040cd.
---
 webhook-gateway/charm/terraform/README.md    | 5 ++---
 webhook-gateway/charm/terraform/main.tf      | 6 +-----
 webhook-gateway/charm/terraform/variables.tf | 4 ++--
 3 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/webhook-gateway/charm/terraform/README.md b/webhook-gateway/charm/terraform/README.md
index 6e468362..248087e8 100644
--- a/webhook-gateway/charm/terraform/README.md
+++ b/webhook-gateway/charm/terraform/README.md
@@ -22,8 +22,7 @@ like shown below:
 
 ```text
 data "juju_model" "my_model" {
-  name  = var.model
-  owner = "admin"
+  name = var.model
 }
 
 module "github_runner_webhook_gateway" {
@@ -38,7 +37,7 @@ Create integrations, for instance:
 
 ```text
 resource "juju_integration" "webhook_rabbitmq" {
-  model_uuid = data.juju_model.my_model.uuid
+  model = juju_model.my_model.name
   application {
     name     = module.github_runner_webhook_gateway.app_name
   }
diff --git a/webhook-gateway/charm/terraform/main.tf b/webhook-gateway/charm/terraform/main.tf
index 5a732352..ed4b4e6e 100644
--- a/webhook-gateway/charm/terraform/main.tf
+++ b/webhook-gateway/charm/terraform/main.tf
@@ -1,13 +1,9 @@
 # Copyright 2025 Canonical Ltd.
 # See LICENSE file for licensing details.
 
-resource "juju_model" "webhook" {
-  name = var.model
-}
-
 resource "juju_application" "github_runner_webhook_gateway" {
   name       = var.app_name
-  model_uuid = juju_model.webhook.uuid
+  model_uuid = var.model_uuid
 
   charm {
     name     = "github-runner-webhook-gateway"
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index d95ebeda..128acca0 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -31,8 +31,8 @@ variable "constraints" {
   default     = ""
 }
 
-variable "model" {
-  description = "Reference to a `juju_model`."
+variable "model_uuid" {
+  description = "Reference to a Juju model UUID."
   type        = string
 }
 

From 91d60139843181092762b9ad90c8dcdc99ebd937 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Tue, 28 Oct 2025 23:13:20 +0700
Subject: [PATCH 32/35] update readme

---
 webhook-gateway/charm/terraform/README.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/webhook-gateway/charm/terraform/README.md b/webhook-gateway/charm/terraform/README.md
index 248087e8..768eeb2a 100644
--- a/webhook-gateway/charm/terraform/README.md
+++ b/webhook-gateway/charm/terraform/README.md
@@ -22,13 +22,14 @@ like shown below:
 
 ```text
 data "juju_model" "my_model" {
-  name = var.model
+  name = "test-deploy-webhook-gateway"
+  owner = "admin"
 }
 
 module "github_runner_webhook_gateway" {
   source = "git::https://github.com/canonical/github-runner-operators/tree/main/webhook-gateway/charm/terraform"
 
-  model = juju_model.my_model.name
+  model_uuid = data.juju_model.my_model.uuid
   # (Customize configuration variables here if needed)
 }
 ```
@@ -37,7 +38,7 @@ Create integrations, for instance:
 
 ```text
 resource "juju_integration" "webhook_rabbitmq" {
-  model = juju_model.my_model.name
+  model_uuid = data.juju_model.my_model.uuid
   application {
     name     = module.github_runner_webhook_gateway.app_name
   }

From 614030e953fccaf8e4cf674f4bc23b09889287c3 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Fri, 31 Oct 2025 16:23:29 +0700
Subject: [PATCH 33/35] add tests

---
 ...hook_lint.yaml => lint_terraform_webhook.yaml} |  0
 .../charm/terraform/tests/main.tftest.hcl         | 15 +++++++++++++++
 webhook-gateway/charm/terraform/variables.tf      |  3 ++-
 3 files changed, 17 insertions(+), 1 deletion(-)
 rename .github/workflows/{test_terraform_webhook_lint.yaml => lint_terraform_webhook.yaml} (100%)

diff --git a/.github/workflows/test_terraform_webhook_lint.yaml b/.github/workflows/lint_terraform_webhook.yaml
similarity index 100%
rename from .github/workflows/test_terraform_webhook_lint.yaml
rename to .github/workflows/lint_terraform_webhook.yaml
diff --git a/webhook-gateway/charm/terraform/tests/main.tftest.hcl b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
index a05a63d5..34dfb7d3 100644
--- a/webhook-gateway/charm/terraform/tests/main.tftest.hcl
+++ b/webhook-gateway/charm/terraform/tests/main.tftest.hcl
@@ -12,4 +12,19 @@ run "basic_deploy" {
     condition     = module.github_runner_webhook_gateway.app_name == "github-runner-webhook-gateway"
     error_message = "github-runner-webhook-gateway app_name did not match expected"
   }
+
+  assert {
+    condition     = juju_application.rabbitmq.name == "rabbitmq"
+    error_message = "rabbitmq name did not match expected"
+  }
+
+  assert {
+    condition     = contains([for app in juju_integration.webhook_rabbitmq.application : app.name], "rabbitmq")
+    error_message = "Integration must include the rabbitmq application"
+  }
+
+  assert {
+    condition     = contains([for app in juju_integration.webhook_rabbitmq.application : app.name], "github-runner-webhook-gateway")
+    error_message = "Integration must include the webhook gateway application"
+  }
 }
diff --git a/webhook-gateway/charm/terraform/variables.tf b/webhook-gateway/charm/terraform/variables.tf
index 128acca0..bf3fbac0 100644
--- a/webhook-gateway/charm/terraform/variables.tf
+++ b/webhook-gateway/charm/terraform/variables.tf
@@ -13,10 +13,11 @@ variable "base" {
   default     = "ubuntu@24.04"
 }
 
+# Change to latest/stable when available
 variable "channel" {
   description = "The channel to use when deploying a charm."
   type        = string
-  default     = "latest/edge" # change to latest/stable when available
+  default     = "latest/edge"
 }
 
 variable "config" {

From 7b1a2686a0e97fa175a339d8f4753471b57128c0 Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Mon, 3 Nov 2025 21:22:52 +0700
Subject: [PATCH 34/35] add trivyignore

---
 .trivyignore | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 00000000..f19c84e7
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,10 @@
+# Add CVEs here to be ignored by Trivy if needed
+# pebble
+CVE-2025-47912
+CVE-2025-58183
+CVE-2025-58185
+CVE-2025-58186
+CVE-2025-58187
+CVE-2025-58188
+CVE-2025-61723
+CVE-2025-61724

From d583a7052849b94b976a2d684b8a240fb723e9cc Mon Sep 17 00:00:00 2001
From: florentianayuwono <florentiana.yuwono@canonical.com>
Date: Thu, 6 Nov 2025 22:25:52 +0700
Subject: [PATCH 35/35] add local var

---
 webhook-gateway/charm/terraform/tests/main.tf | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/webhook-gateway/charm/terraform/tests/main.tf b/webhook-gateway/charm/terraform/tests/main.tf
index 25e0256e..c58b1a89 100644
--- a/webhook-gateway/charm/terraform/tests/main.tf
+++ b/webhook-gateway/charm/terraform/tests/main.tf
@@ -2,8 +2,9 @@
 # See LICENSE file for licensing details.
 
 locals {
-  webhook_gateway_app_name = "github-runner-webhook-gateway"
-  juju_model_name          = "stg-deploy-webhook-gateway"
+  webhook_gateway_app_name     = "github-runner-webhook-gateway"
+  webhook_gateway_metrics_port = 9464
+  juju_model_name              = "stg-deploy-webhook-gateway"
 }
 
 variable "channel" {
@@ -67,7 +68,7 @@ module "github_runner_webhook_gateway" {
   model_uuid = data.juju_model.webhook.uuid
   revision   = var.revision
   config = {
-    metrics-port = 9464
+    metrics-port = local.webhook_gateway_metrics_port
   }
 }