chore(CI): add new verify

test/integration/sandbox_enabled/sandbox_enabled_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
 	"github.com/stretchr/testify/assert"
 	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/testutils"
+	gkeutils "github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/utils"
 )
 
 func TestSandboxEnabled(t *testing.T) {
@@ -32,6 +33,7 @@ func TestSandboxEnabled(t *testing.T) {
 	bpt.DefineVerify(func(assert *assert.Assertions) {
 		//Skipping Default Verify as the Verify Stage fails due to change in Client Cert Token
 		// bpt.DefaultVerify(assert)
+		gkeutils.TGKEVerify(t, bpt, assert) // Verify Resources
 
 		projectId := bpt.GetStringOutput("project_id")
 		location := bpt.GetStringOutput("location")

test/integration/utils/utils.go

@@ -15,10 +15,13 @@
 package utils
 
 import (
+	"slices"
 	"testing"
 	"time"
 
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
+	tfjson "github.com/hashicorp/terraform-json"
+	"github.com/stretchr/testify/assert"
 	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/testutils"
 )
 
@@ -32,3 +35,19 @@ func GetTestProjectFromSetup(t *testing.T, idx int) string {
 	}
 	return projectIDs[idx]
 }
+
+var (
+	// TGKEVerify Exempt Resources. e.g. google_container_cluster.primary
+	verifyExemptResources = []string{}
+)
+
+func TGKEVerify(t *testing.T, b *tft.TFBlueprintTest, assert *assert.Assertions) {
+	_, ps := b.PlanAndShow()
+	for _, r := range ps.ResourceChangesMap {
+		if slices.Contains(verifyExemptResources, r.Address) {
+			t.Logf("Exempt plan address: %s", r.Address)
+			continue
+		}
+		assert.Equal(tfjson.Actions{tfjson.ActionNoop}, r.Change.Actions, "Plan must be no-op for resource: %s", r.Address)
+	}
+}