Add pulumi tests

[jemrobinson]

✅ Checklist

• You have given your pull request a meaningful title (e.g. Enable foobar integration rather than 515 foobar).
• You are targeting the appropriate branch. If you're not certain which one this is, it should be develop.
• Your branch is up-to-date with the target branch (it probably was when you started, but it may have changed since then).

🚦 Depends on

n/a

⤴️ Summary

Adds some proof-of-concept Pulumi unit tests for the SRE ApplicationGateway component.

Note that much of what is described in the Pulumi documentation about Mocking does not seem to work with inline programs.

Important notes:

• Pulumi Outputs should be tested within an apply loop with run_with_unknowns enabled, otherwise they will silently succeed on encountering any unknown values
• Value-based assertions need to be defined separately (currently in resource_assertions.py) as raw assert cannot be used inside an apply loop
• All tests must be decorated with pulumi.runtime.test or they will silently succeed
• Any sub-resource that we want to test needs to be exposed as an attribute of the Component class (e.g. SREApplicationGateway now has self.application_gateway = ... in its constructor so that we can test the ApplicationGateway resource.

🌂 Related issues

Closes #1835

🔬 Tests

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
data_safe_haven/external/interface
azure_ipv4_range.py
data_safe_haven/infrastructure/common
transformations.py					16, 31, 39, 47, 80, 88, 96, 104, 112
data_safe_haven/infrastructure/programs/sre
application_gateway.py
tests/infrastructure/programs
resource_assertions.py					9-11
tests/infrastructure/programs/sre
conftest.py
test_application_gateway.py
Project Total

This report was generated by python-coverage-comment-action

[JimMadge]

Looks good.

Helpful as an example when we write more Pulumi tests in the future.

Having to .apply() does make tests a bit untidy but I suppose that is just what happens when working with promises.
If we wanted to do more "abstract" tests like

assert "Internet" not in sre_nsg.rules.allowed

we might have to write bespoke functions or lambdas in test functions.

[jemrobinson]

@JimMadge I think the kind of abstract test you're thinking of could be better covered by property tests on deployed infrastructure.