Merge pull request #9 from IntentProof/phase3-sdk-signing-golden

Read signing golden fixtures from spec checkout

Author: negillett

.github/workflows/ci.yml

@@ -13,6 +13,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Checkout spec repository
+        uses: actions/checkout@v4
+        with:
+          repository: IntentProof/intentproof-spec
+          ref: main
+          path: intentproof-spec
+
+      - name: Ensure spec sdk-signing golden checkout
+        run: |
+          if [[ -d intentproof-spec/golden/sdk-signing ]]; then
+            exit 0
+          fi
+          git -C intentproof-spec fetch origin phase3-ecosystem-conformance
+          git -C intentproof-spec checkout FETCH_HEAD
+
       - uses: actions/setup-go@v5
         with:
           go-version: '1.25'
@@ -21,4 +36,11 @@ jobs:
         run: go mod verify
 
       - name: Run tests and enforce coverage
+        env:
+          INTENTPROOF_SPEC_DIR: intentproof-spec
         run: bash ./scripts/run-coverage-gate.sh
+
+      - name: Verify sdk-signing fixtures synced with spec
+        env:
+          INTENTPROOF_SPEC_DIR: intentproof-spec
+        run: bash ./scripts/check-sdk-signing-fixtures-sync.sh

intentproof/signing_golden_test.go

@@ -10,8 +10,19 @@ import (
 	"github.com/intentproof/intentproof-sdk-go/intentproof"
 )
 
+func signingFixtureDir(t *testing.T) string {
+	t.Helper()
+	if specDir := strings.TrimSpace(os.Getenv("INTENTPROOF_SPEC_DIR")); specDir != "" {
+		if !filepath.IsAbs(specDir) {
+			specDir = filepath.Join("..", specDir)
+		}
+		return filepath.Join(specDir, "golden", "sdk-signing")
+	}
+	return filepath.Join("..", "testdata", "fixtures")
+}
+
 func TestSigningGoldenBytes(t *testing.T) {
-	fixtureDir := filepath.Join("..", "testdata", "fixtures")
+	fixtureDir := signingFixtureDir(t)
 	unsignedRaw, err := os.ReadFile(filepath.Join(fixtureDir, "signing_unsigned_event.json"))
 	if err != nil {
 		t.Fatal(err)

scripts/check-sdk-signing-fixtures-sync.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Fail when mirrored SDK signing fixtures drift from intentproof-spec.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+LOCAL="${ROOT}/testdata/fixtures"
+
+spec_dir="${INTENTPROOF_SPEC_DIR:?INTENTPROOF_SPEC_DIR must point at intentproof-spec}"
+if [[ "$spec_dir" != /* ]]; then
+  spec_dir="${ROOT}/${spec_dir}"
+fi
+CANONICAL="${spec_dir}/golden/sdk-signing"
+
+if [[ ! -d "$CANONICAL" ]]; then
+  echo "canonical sdk-signing fixtures not found at ${CANONICAL}" >&2
+  exit 1
+fi
+
+shopt -s nullglob
+files=("${CANONICAL}"/signing_*)
+if [[ ${#files[@]} -eq 0 ]]; then
+  echo "no signing fixtures under ${CANONICAL}" >&2
+  exit 1
+fi
+
+fail=0
+for canonical in "${files[@]}"; do
+  base="$(basename "$canonical")"
+  local_path="${LOCAL}/${base}"
+  if [[ ! -f "$local_path" ]]; then
+    continue
+  fi
+  if ! cmp -s "$canonical" "$local_path"; then
+    echo "sdk-signing fixture drift: ${base} differs from spec golden/sdk-signing" >&2
+    fail=1
+  fi
+done
+
+if [[ "$fail" -ne 0 ]]; then
+  exit 1
+fi
+
+echo "PASS: sdk-signing fixture mirrors match spec golden."