Fix CI failures and simplify setup action to use SMB URL syntax

- Fix rustdoc: escape brackets in der_wrap doc comment
- Fix integration test skip: check secret via env step, not secrets context
- Simplify setup action: accept smb://user:pass@server/share URL
  instead of separate inputs for each field
- smb-pass input overrides URL password (for secrets)

Author: lukekim

.github/actions/setup/action.yml

@@ -6,24 +6,13 @@ inputs:
     description: Release tag to install (e.g. "v0.1.0"). Use "latest" for the most recent release.
     required: false
     default: latest
-  smb-server:
-    description: SMB server hostname or IP
-    required: true
-  smb-user:
-    description: SMB username
+  smb-url:
+    description: >
+      SMB connection URL: smb://user:pass@server/share or smb://user:pass@server:port/share.
+      Password can also be provided separately via smb-pass.
     required: true
   smb-pass:
-    description: SMB password
-    required: true
-  smb-share:
-    description: SMB share name
-    required: true
-  smb-port:
-    description: SMB port
-    required: false
-    default: "445"
-  smb-domain:
-    description: SMB domain
+    description: SMB password (overrides password in smb-url if both provided)
     required: false
     default: ""
   bucket:
@@ -87,12 +76,8 @@ runs:
       id: start
       shell: bash
       env:
-        SPICEIO_SMB_SERVER: ${{ inputs.smb-server }}
-        SPICEIO_SMB_PORT: ${{ inputs.smb-port }}
-        SPICEIO_SMB_USER: ${{ inputs.smb-user }}
-        SPICEIO_SMB_PASS: ${{ inputs.smb-pass }}
-        SPICEIO_SMB_DOMAIN: ${{ inputs.smb-domain }}
-        SPICEIO_SMB_SHARE: ${{ inputs.smb-share }}
+        SMB_URL: ${{ inputs.smb-url }}
+        SMB_PASS_OVERRIDE: ${{ inputs.smb-pass }}
         SPICEIO_BUCKET: ${{ inputs.bucket }}
         SPICEIO_REGION: ${{ inputs.region }}
         SPICEIO_BIND: ${{ inputs.bind }}
@@ -111,6 +96,36 @@ runs:
           exit 0
         fi
 
+        # Parse smb://user:pass@server:port/share
+        # Strips the smb:// prefix, then splits on :, @, /
+        URL="${SMB_URL#smb://}"
+
+        USERINFO="${URL%%@*}"
+        HOSTPATH="${URL#*@}"
+
+        SPICEIO_SMB_USER="${USERINFO%%:*}"
+        URL_PASS="${USERINFO#*:}"
+        # Use override password if provided, otherwise use URL password
+        if [[ -n "$SMB_PASS_OVERRIDE" ]]; then
+          SPICEIO_SMB_PASS="$SMB_PASS_OVERRIDE"
+        else
+          SPICEIO_SMB_PASS="$URL_PASS"
+        fi
+
+        HOSTPORT="${HOSTPATH%%/*}"
+        SPICEIO_SMB_SHARE="${HOSTPATH#*/}"
+
+        if [[ "$HOSTPORT" == *:* ]]; then
+          SPICEIO_SMB_SERVER="${HOSTPORT%%:*}"
+          SPICEIO_SMB_PORT="${HOSTPORT#*:}"
+        else
+          SPICEIO_SMB_SERVER="$HOSTPORT"
+          SPICEIO_SMB_PORT="445"
+        fi
+
+        export SPICEIO_SMB_SERVER SPICEIO_SMB_PORT SPICEIO_SMB_USER SPICEIO_SMB_PASS SPICEIO_SMB_SHARE
+        export SPICEIO_BUCKET SPICEIO_REGION SPICEIO_BIND
+
         spiceio &
         PID=$!
         echo "$PID" > "$PID_FILE"

.github/workflows/ci.yml

@@ -53,9 +53,17 @@ jobs:
       - name: Run unit tests
         run: cargo test --locked
 
+      - name: Check SMB credentials
+        run: |
+          if [[ -n "$SPICEIO_SMB_PASS" ]]; then
+            echo "HAS_SMB_PASS=true" >> "$GITHUB_ENV"
+          fi
+        env:
+          SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}
+
       - name: Run sccache integration test
         # Skipped when UNAS_SMB_PASS secret is not configured (e.g. fork PRs)
-        if: env.SPICEIO_SMB_PASS != ''
+        if: ${{ env.HAS_SMB_PASS == 'true' }}
         env:
           SPICEIO_SMB_SERVER: ${{ vars.SPICEIO_SMB_SERVER || '192.168.3.148' }}
           SPICEIO_SMB_USER: ${{ vars.SPICEIO_SMB_USER || 'runner' }}

src/smb/auth.rs

@@ -346,7 +346,7 @@ pub fn wrap_spnego_auth(ntlmssp: &[u8]) -> Vec<u8> {
     der_wrap(0xa1, &seq)
 }
 
-/// Wrap data in a DER TLV: [tag][length][data].
+/// Wrap data in a DER TLV: `[tag][length][data]`.
 fn der_wrap(tag: u8, data: &[u8]) -> Vec<u8> {
     let mut buf = Vec::with_capacity(1 + 4 + data.len());
     buf.push(tag);