feat: vault exec — inject secrets as env vars at launch #115
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: GPL-3.0-or-later | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-D warnings" | |
| # Pin the toolchain so CI matches local dev (no rustup here — the dev box is | |
| # Nix-pinned at this version) and clippy/rustfmt can't drift ahead on the | |
| # runner. Keep in sync with rust-toolchain.toml; bump both together. | |
| RUST_TOOLCHAIN: "1.95.0" | |
| jobs: | |
| fmt: | |
| name: rustfmt | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| components: rustfmt | |
| - run: cargo fmt --all -- --check | |
| clippy: | |
| name: clippy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| test: | |
| name: test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo build --workspace --all-targets | |
| - run: cargo test --workspace --all-targets | |
| headless: | |
| name: headless build (no TUI / clipboard deps) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| - uses: Swatinem/rust-cache@v2 | |
| # PRD G6: the server install path must keep building — the CLI behind | |
| # its `cli` feature gate, and the agent without the clipboard's | |
| # X11/Wayland dependency tree. | |
| - run: cargo build -p vault-cli --no-default-features --features cli | |
| - run: cargo build -p vault-agent --no-default-features | |
| version-gate: | |
| name: vault --version emits §13.2 attribution | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo build --bin vault --release | |
| - name: Verify attribution block | |
| run: | | |
| out=$(./target/release/vault --version) | |
| echo "$out" | |
| echo "$out" | grep -q "Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>" \ | |
| && echo "$out" | grep -q "GPL-3.0-or-later" \ | |
| && echo "$out" | grep -q "https://Vault.SpacecraftSoftware.org/" | |
| audit: | |
| name: cargo-audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| # Installed directly (not via rustsec/audit-check@v2) so `--locked` pins | |
| # cargo-audit to its own committed lockfile. Without it, `cargo install` | |
| # re-resolves cargo-audit's dependencies fresh on every run, and a | |
| # transitive bump (e.g. kstring requiring a newer rustc) can outrun the | |
| # workspace's pinned toolchain even though nothing here changed. | |
| - run: cargo install cargo-audit --locked | |
| # --ignore mirrors `just audit`; keep both lists in lock-step. | |
| # RUSTSEC-2024-0436 — paste (unmaintained, build-time proc-macro; transitive via ratatui) | |
| # RUSTSEC-2026-0002 — lru 0.12.5 (unsound IterMut; transitive via ratatui) | |
| # RUSTSEC-2023-0071 — rsa (Marvin timing sidechannel, no upstream fix). rsa unwraps | |
| # organization keys (RSA-OAEP) once, locally, at unlock; the attack needs a | |
| # network-observable decryption oracle, which Vault never exposes. Revisit if rsa | |
| # ships a constant-time fix. | |
| # RUSTSEC-2026-0195, RUSTSEC-2026-0194 — quick-xml 0.39.4 (build-time-only proc-macro | |
| # dependency of wayland-scanner, itself transitive via arboard's Wayland clipboard | |
| # support; parses only the Wayland protocol XML bundled in wayland-scanner at compile | |
| # time, never runtime/attacker-controlled input). No newer wayland-scanner release is | |
| # resolvable yet under wayland-client's current constraint; revisit when one lands. | |
| - run: >- | |
| cargo audit | |
| --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0002 --ignore RUSTSEC-2023-0071 | |
| --ignore RUSTSEC-2026-0195 --ignore RUSTSEC-2026-0194 | |
| deny: | |
| name: cargo-deny | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 | |
| # REUSE (§4.3): every file has license + copyright info (via REUSE.toml) and | |
| # the license texts live in LICENSES/. Python tool, independent of the pinned | |
| # Rust toolchain. | |
| reuse: | |
| name: REUSE lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.x" | |
| - run: pip install reuse | |
| - run: reuse lint |