Support linking the SDKs against secretspec-ffi via pkg-config #906
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Test" | |
| on: | |
| workflow_call: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: [ main ] | |
| # Do not let superseded revisions occupy the limited macOS runner pool. | |
| concurrency: | |
| group: ${{ github.workflow }}-test-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| tests: | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # The full devenv shell includes every SDK toolchain plus the musl static | |
| # dependencies. It no longer fits alongside the preinstalled software on | |
| # GitHub's Ubuntu image, so reclaim that space before populating /nix. | |
| - name: Free up disk space | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android \ | |
| /opt/hostedtoolcache/CodeQL /usr/local/.ghcup /opt/ghc \ | |
| /usr/local/share/boost /usr/local/share/powershell | |
| sudo docker image prune --all --force | |
| df -h / | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | |
| - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 | |
| with: | |
| name: devenv | |
| - name: Install devenv.sh | |
| run: nix profile install nixpkgs#devenv | |
| - name: Cache Rust builds | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| key: ${{ matrix.os }} | |
| # The tests compile with devenv's pinned Nix toolchain, so use the same | |
| # toolchain when rust-cache calculates its compiler and dependency keys. | |
| cmd-format: devenv shell -- {0} | |
| # `devenv test` also starts every configured process. The docs dev server is | |
| # unrelated to this suite and makes process-compose wait for its timeout when | |
| # docs dependencies are not installed, so run the hooks and tests directly. | |
| # rustfmt and clippy are platform-independent; run them once on Linux rather | |
| # than paying for a second cold compilation on the slower macOS runner. | |
| - name: Run pre-commit hooks | |
| if: runner.os == 'Linux' | |
| run: devenv tasks run devenv:git-hooks:run --show-output | |
| - name: Check provider credential documentation | |
| if: runner.os == 'Linux' | |
| run: devenv shell -- npm --prefix docs run check:provider-credentials | |
| - name: Run tests | |
| run: devenv shell -- cargo test --all | |
| # Each optional provider must compile on its own, not just in the default | |
| # feature set. `cargo test` above cannot catch a missing feature gate: it | |
| # builds with every provider enabled and with `cfg(test)` on, and shared | |
| # helpers gated on `any(feature = "...", test)` are reachable under either. | |
| # A provider that forgets to add itself to such a gate only breaks for the | |
| # user who builds it standalone, which is precisely who `--features` is for. | |
| features: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust | |
| run: rustup toolchain install stable --profile minimal | |
| - name: Cache Rust builds | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| - name: Check each provider feature standalone | |
| run: | | |
| set -euo pipefail | |
| for feature in cli keyring keeper gcsm awssm vault openbao infisical bws akv sops bw; do | |
| echo "::group::$feature" | |
| cargo check --package secretspec --no-default-features --features "$feature" | |
| echo "::endgroup::" | |
| done | |
| package: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust | |
| run: rustup toolchain install stable --profile minimal | |
| - name: Verify the published crate contains its schema fixture | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| fixture="secretspec/src/fixtures/resolution-report.schema.json" | |
| cmp schema/resolution-report.schema.json "$fixture" | |
| cargo package --package secretspec --list | | |
| grep -Fx 'src/fixtures/resolution-report.schema.json' | |
| # Windows runners can't run Nix/devenv, so the suite runs here natively via | |
| # rustup + cargo. This exists specifically to catch Windows-only path handling | |
| # regressions (e.g. config discovery and relative `-f` paths, issue #59), which | |
| # the Ubuntu/macOS devenv job above can never observe. | |
| windows: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Download SOPS 3.13.2 | |
| uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 | |
| with: | |
| repository: getsops/sops | |
| tag: v3.13.2 | |
| fileName: sops-v3.13.2.amd64.exe | |
| out-file-path: sops-bin | |
| - name: Add SOPS to PATH | |
| shell: pwsh | |
| run: | | |
| Rename-Item -Path "sops-bin/sops-v3.13.2.amd64.exe" -NewName "sops.exe" | |
| (Resolve-Path "sops-bin").Path | | |
| Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append | |
| - name: Install Rust | |
| run: rustup toolchain install stable --profile minimal | |
| - name: Cache Rust builds | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| - name: cargo test | |
| # Exclude secretspec-php-native: it is an ext-php-rs extension that needs a | |
| # PHP dev toolchain (php-config/headers) this bare runner does not have, and | |
| # ext-php-rs rejects the runner's PHP version anyway. The PHP SDK is built | |
| # and tested by sdks.yml / php-ext.yml instead. | |
| run: cargo test --workspace --exclude secretspec-php-native |