kms/.github/workflows/main_base.yml at 673f3a24bee08d0ee3973cdebb2aa69d6aef5b7f · Cosmian/kms · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
---
name: CI checks

on:
  workflow_call:
    inputs:
      toolchain:
        required: true
        type: string

jobs:
  cla-assistant:
    if: (github.event.pull_request.head.repo.full_name != github.repository) && ((github.event.comment.body == 'recheck' || github.event.comment.body ==
      'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target')
    uses: ./.github/workflows/cla.yml
    secrets: inherit

  cargo-clippy:
    uses: Cosmian/reusable_workflows/.github/workflows/clippy.yml@develop
    with:
      toolchain: ${{ inputs.toolchain }}

  cargo-deny:
    uses: Cosmian/reusable_workflows/.github/workflows/cargo-audit.yml@develop
    name: Security Audit
    with:
      toolchain: ${{ inputs.toolchain }}

  cargo-machete:
    uses: Cosmian/reusable_workflows/.github/workflows/cargo-machete.yml@develop
    with:
      toolchain: ${{ inputs.toolchain }}

  log-index-check:
    name: Log index — log-reference.md in sync with source
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Check log-reference.md is up to date
        id: check
        run: python3 scripts/update_log_index.py --check --no-color

      - name: How to fix
        if: failure()
        run: |
          echo ""
          echo "════════════════════════════════════════════════════════════"
          echo "  log-reference.md is out of sync with the source code."
          echo ""
          echo "  Fix it locally by running:"
          echo ""
          echo "    python3 scripts/update_log_index.py --non-interactive --no-color"
          echo ""
          echo "  Then review the diff, stage, and commit:"
          echo ""
          echo "    git diff documentation/docs/configuration/log-reference.md"
          echo "    git add documentation/docs/configuration/log-reference.md"
          echo "    git commit -m 'docs: sync log-reference.md'"
          echo ""
          echo "════════════════════════════════════════════════════════════"

  forward-proxy:
    uses: ./.github/workflows/forward_proxy.yml
    with:
      toolchain: ${{ inputs.toolchain }}

  cargo-test:
    name: No Nix - ${{ matrix.runner }} - ${{ matrix.type }} - ${{ matrix.features }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        type:
          - sqlite
        features: [fips, non-fips]
        runner: [ubuntu-24.04, ubuntu-24.04-arm, macos-15]

    steps:
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.91.0
          components: rustfmt, clippy

      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: With cargo only
        run: |
          set -ex
          if [ "${{ matrix.features }}" = "non-fips" ]; then
            export FEATURES_FLAG="--features non-fips";
            # Build the PKCS#11 cdylib so that `ckms pkcs11 verify` and
            # integration tests can dynamically load it at runtime.
            # `cargo test --lib` does not produce cdylib artifacts.
            cargo build -p cosmian_pkcs11 --features non-fips
          else
            export FEATURES_FLAG="";
          fi
          cargo test --workspace --lib $FEATURES_FLAG -- --nocapture

  test: # Run all tests
    if: github.event.pull_request.head.repo.full_name == github.repository && !startsWith(github.ref_name, 'dependabot/') && github.actor != 'dependabot[bot]'
      || startsWith(github.ref, 'refs/tags/')
    uses: ./.github/workflows/test_all.yml
    secrets: inherit
    with:
      toolchain: ${{ inputs.toolchain }}

  public_documentation:
    if: github.event.pull_request.head.repo.full_name == github.repository && !startsWith(github.ref_name, 'dependabot/') && github.actor != 'dependabot[bot]'
      || startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Deploy documentation in staging
        if: ${{ github.ref_name == 'develop' }}
        uses: benc-uk/workflow-dispatch@v1
        with:
          workflow: staging.yml
          repo: Cosmian/public_documentation
          ref: develop
          token: ${{ secrets.PAT_TOKEN }}

      - name: Deploy documentation in prod
        if: startsWith(github.ref, 'refs/tags')
        uses: benc-uk/workflow-dispatch@v1
        with:
          workflow: prod.yml
          repo: Cosmian/public_documentation
          ref: main
          token: ${{ secrets.PAT_TOKEN }}