feat(garm): add get-credentials action

[Thanhphan1147]

Summary

• Adds the get-credentials Juju action to the GARM charm, exposing the admin credentials stored in the garm-admin-credentials Juju secret to the operator
• Adds unit tests covering the success path (credentials returned via `event.set_results`) and the failure path (credentials not yet available, `event.fail` called)
• Adds an integration test that runs the action against a live GARM unit and asserts all four credential fields are returned
• Adds a how-to guide under `docs/how-to/retrieve-garm-credentials.md`

Usage

juju run garm/0 get-credentials

[cbartz]

LGMT. This was not planned, but seems indeed like a useful feature.

[Copilot]

Pull request overview

Adds a get-credentials Juju action to the garm charm to expose the admin credentials stored in the garm-admin-credentials Juju secret, along with unit/integration test coverage and a new how-to guide documenting usage.

Changes:

• Add get-credentials action wiring in the charm and declare it in charmcraft.yaml.
• Add unit + integration tests for the action’s success/failure behavior.
• Add a new how-to guide and link it from the docs how-to index; update .gitignore entries.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
charms/garm/src/charm.py	Observes and implements the get-credentials action handler that returns admin secret content.
charms/garm/charmcraft.yaml	Declares the get-credentials action.
charms/garm/tests/unit/test_charm.py	Adds unit tests covering action success and failure paths.
charms/tests/integration/test_garm.py	Adds an integration test that runs the action and validates returned fields.
docs/how-to/retrieve-garm-credentials.md	Adds a how-to guide describing how to run the action and interpret output.
docs/how-to/index.rst	Adds the new how-to page to the toctree.
.gitignore	Fixes .vscode/ ignore entry and adds .worktrees/.

[florentianayuwono]

thank you!

[florentianayuwono]

can we add assertion that the credentials returned is as expected

[Thanhphan1147]

It's what the event.set_results.assert_called_once_with(credentials) is doing. Since we're mocking the event and not using scenario we don't have a way to actually get the output ( the hook methods always return None )

[florentianayuwono]

i see, is there a reason why we cannot use scenario? ideally it's better to test the state, not interaction

[Thanhphan1147]

No particular reason aside from that I like to keep tests simple if it's only a single method. And using scenario we'd still only call the hook method so it's a bit more overhead. But I can switch to scenario if needed, wdyt?

[erinecon]

Thanks so much for adding a how-to guide!! Some nits from me. Giving an approval since @cbartz has approved already

[yhaliaw]

Posting three minor findings from a code review pass — all cosmetic/convention issues, none blocking.

[yhaliaw]

This docstring is missing its assert: section — it only has arrange:/act:, while the test body performs two assertions. The sibling test added in the same commit (test_get_credentials_action_fails_when_credentials_unavailable) includes all three sections, as does every other test in this file.

Suggestion:

Suggested change

	"""
	assert: event.set_results is called once with the credentials dict and
	event.fail is not called.
	"""

[yhaliaw]

There are zero blank lines between the end of this test and the next top-level def test_reconcile_scalesets_skips_when_no_admin_credentials(): — PEP 8 / ruff E302 expects two. This won't fail CI (this charm's tox -e lint only checks src, not tests/), but it will get reformatted the next time someone runs tox -e fmt, producing unrelated churn in a future PR.

Suggested change

	event.set_results.assert_not_called()
	event.set_results.assert_not_called()