Additional zeroization/defense-in-depth + CI fixes #94
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | ||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| env: | ||
| CARGO_TERM_COLOR: always | ||
| RUST_BACKTRACE: 1 | ||
| MSRV: "1.96.0" | ||
| jobs: | ||
| test: | ||
| name: test (${{ matrix.os }}, ${{ matrix.toolchain }}) | ||
| runs-on: ${{ matrix.os }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-latest, macos-latest, windows-latest] | ||
| toolchain: ["1.96.0"] | ||
| include: | ||
| - os: ubuntu-latest | ||
| toolchain: stable | ||
| - os: ubuntu-latest | ||
| toolchain: beta | ||
| env: | ||
| HPKE_NG_SKIP_COMPILE_FAIL: ${{ matrix.toolchain != '1.96.0' && '1' || '' }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@master | ||
| with: | ||
| toolchain: ${{ matrix.toolchain }} | ||
| components: clippy, rustfmt | ||
| - name: cargo fmt | ||
| if: runner.os != 'Windows' | ||
| run: cargo fmt --check | ||
| - name: cargo fmt (fuzz workspace) | ||
| if: runner.os != 'Windows' | ||
| working-directory: fuzz | ||
| run: cargo fmt --check | ||
| - name: cargo clippy (default) | ||
| run: cargo clippy --all-targets -- -D warnings | ||
| - name: cargo clippy (no-default-features) | ||
| run: cargo clippy --lib --no-default-features -- -D warnings | ||
| - name: cargo clippy (all features) | ||
| run: cargo clippy --all-targets --features pq,hazmat-kat-internals,hazmat-differential -- -D warnings | ||
| - name: cargo test | ||
| run: cargo test | ||
| - name: cargo test (pq) | ||
| run: cargo test --features pq | ||
| - name: cargo test (pq + hazmat-kat-internals) | ||
| run: cargo test --features pq,hazmat-kat-internals | ||
| - name: cargo test (pq + both hazmat features) | ||
| run: cargo test --features pq,hazmat-differential,hazmat-kat-internals | ||
| - name: cargo build --release | ||
| run: cargo build --release | ||
| no-std: | ||
| name: no-std check (thumbv7em-none-eabihf) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@master | ||
| with: | ||
| toolchain: ${{ env.MSRV }} | ||
| targets: thumbv7em-none-eabihf | ||
| - run: cargo check --target thumbv7em-none-eabihf --no-default-features | ||
| - run: cargo check --target thumbv7em-none-eabihf --no-default-features --features pq | ||
| doc: | ||
| name: cargo doc | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@master | ||
| with: | ||
| toolchain: ${{ env.MSRV }} | ||
| - env: | ||
| RUSTDOCFLAGS: -D warnings | ||
| run: cargo doc --no-deps --features pq | ||
| deny: | ||
| name: cargo-deny | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: EmbarkStudios/cargo-deny-action@v2 | ||
| with: | ||
| command: check advisories bans licenses sources | ||
| package: | ||
| name: cargo package | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@master | ||
| with: | ||
| toolchain: ${{ env.MSRV }} | ||
| - run: cargo package --locked | ||
| fuzz: | ||
| name: fuzz (${{ matrix.target }}) | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| target: | ||
| - pk_from_bytes | ||
| - enc_from_bytes | ||
| - open | ||
| - key_schedule | ||
| - derive_key_pair | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@nightly | ||
| - uses: taiki-e/install-action@v2 | ||
| with: | ||
| tool: cargo-fuzz | ||
| - name: cargo fuzz run ${{ matrix.target }} | ||
| run: cargo fuzz run --target "$(rustc -vV | sed -n 's/^host: //p')" ${{ matrix.target }} -- -max_total_time=60 -rss_limit_mb=4096 | ||
