action.yaml

name: 'start-up-with-containers'

description: 'Start the OpenTDF Platform with its containerized resources'

inputs:
  platform-ref:
    required: false
    description: 'The ref to check out for the platform'
    default: 'main'
  extra-keys:
    required: false
    description: A JSON array containing extra keys for the KAS to load. Each object should have 'kid', 'alg', 'private', and 'cert' fields.
    default: '[]'
  ec-tdf-enabled:
    default: "false"
    description: 'Whether to enable ECC wrapping for TDFs'
    required: false
  pqc-enabled:
    default: "false"
    description: 'Whether to enable post-quantum and hybrid PQ/T wrapping for TDFs'
    required: false
  log-level:
    default: "debug"
    description: 'Log level for the platform (audit, debug, info, warn, error)'
    required: false
  log-type:
    default: "text"
    description: 'Log format type (text, json)'
    required: false
  provision-policy-fixtures:
    default: "true"
    description: 'Whether to provision fixture policy data after bootstrapping the platform'
    required: false
  dpop-challenge-enabled:
    default: "false"
    description: 'Whether to enable the DPoP nonce challenge flow (sets server.auth.dpop.require_nonce: true)'
    required: false
  dpop-enforce-required:
    default: "false"
    description: 'Whether to enforce DPoP-bound access tokens (sets server.auth.dpop.enforce: true)'
    required: false

outputs:
  platform-working-dir:
    description: 'The working directory for the running platform instance'
    value: 'otdf-test-platform'
  platform-log-file:
    description: 'Path to the main platform/KAS log file'
    value: ${{ steps.log-path.outputs.log-file }}

runs:
  using: 'composite'
  steps:
    - name: Validate inputs
      shell: bash
      env:
        PLATFORM_REF: ${{ inputs.platform-ref }}
        EXTRA_KEYS: ${{ inputs.extra-keys }}
        EC_TDF_ENABLED: ${{ inputs.ec-tdf-enabled }}
        PQC_ENABLED: ${{ inputs.pqc-enabled }}
        LOG_LEVEL: ${{ inputs.log-level }}
        LOG_TYPE: ${{ inputs.log-type }}
        PROVISION_POLICY_FIXTURES: ${{ inputs.provision-policy-fixtures }}
        DPOP_CHALLENGE_ENABLED: ${{ inputs.dpop-challenge-enabled }}
        DPOP_ENFORCE_REQUIRED: ${{ inputs.dpop-enforce-required }}
      run: |
        # Validate platform-ref (must contain only safe characters for a git ref)
        if [[ ! "${PLATFORM_REF}" =~ ^[a-zA-Z0-9._/-]+$ ]]; then
          echo "Error: platform-ref must contain only alphanumeric characters, dots, underscores, hyphens, and forward slashes."
          exit 1
        fi

        # Validate extra-keys (must be a valid JSON array)
        if ! jq -e 'type == "array"' <<< "${EXTRA_KEYS}" > /dev/null 2>&1; then
          echo "Error: extra-keys must be a valid JSON array."
          exit 1
        fi

        # Validate ec-tdf-enabled (must be true or false)
        case "${EC_TDF_ENABLED}" in
          true|false)
            ;;
          *)
            echo "Error: ec-tdf-enabled must be 'true' or 'false'."
            exit 1
            ;;
        esac

        # Validate pqc-enabled (must be true or false)
        case "${PQC_ENABLED}" in
          true|false)
            ;;
          *)
            echo "Error: pqc-enabled must be 'true' or 'false'."
            exit 1
            ;;
        esac

        # Validate log-level (only allowed values)
        case "${LOG_LEVEL}" in
          audit|debug|info|warn|error)
            ;;
          *)
            echo "Error: log-level must be one of: audit, debug, info, warn, error."
            exit 1
            ;;
        esac

        # Validate log-type (only allowed values)
        case "${LOG_TYPE}" in
          text|json)
            ;;
          *)
            echo "Error: log-type must be one of: text, json."
            exit 1
            ;;
        esac

        # Validate provision-policy-fixtures (must be true or false)
        case "${PROVISION_POLICY_FIXTURES}" in
          true|false)
            ;;
          *)
            echo "Error: provision-policy-fixtures must be 'true' or 'false'."
            exit 1
            ;;
        esac

        # Validate dpop-challenge-enabled (must be true or false)
        case "${DPOP_CHALLENGE_ENABLED}" in
          true|false)
            ;;
          *)
            echo "Error: dpop-challenge-enabled must be 'true' or 'false'."
            exit 1
            ;;
        esac

        # Validate dpop-enforce-required (must be true or false)
        case "${DPOP_ENFORCE_REQUIRED}" in
          true|false)
            ;;
          *)
            echo "Error: dpop-enforce-required must be 'true' or 'false'."
            exit 1
            ;;
        esac
    - name: Check out platform
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        repository: opentdf/platform
        # use a distinct path to avoid conflicts
        path: otdf-test-platform
        ref: ${{ inputs.platform-ref }}
        persist-credentials: false
    - name: Download latest init-temp-keys.sh, docker-compose.yaml, and watch.sh
      shell: bash
      run: |
        curl -sSfL https://raw.githubusercontent.com/opentdf/platform/refs/tags/pqc-enabled/.github/scripts/init-temp-keys.sh > otdf-test-platform/.github/scripts/init-temp-keys.sh
        curl -sSfL https://raw.githubusercontent.com/opentdf/platform/refs/tags/pqc-enabled/docker-compose.yaml > otdf-test-platform/docker-compose.yaml
        curl -sSfL https://raw.githubusercontent.com/opentdf/platform/refs/tags/pqc-enabled/.github/scripts/watch.sh > otdf-test-platform/.github/scripts/watch.sh
    - name: Set up go (platform's go version)
      id: setup-go
      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
      with:
        go-version-file: 'otdf-test-platform/go.work'
        check-latest: false
        cache-dependency-path: |
          otdf-test-platform/service/go.sum
          otdf-test-platform/protocol/go/go.sum
          otdf-test-platform/sdk/go.sum
    - name: Lookup current platform version
      shell: bash
      id: platform-version
      run: |-
        if ! go run ./service version; then
          # NOTE: the version command was added in 0.4.37
          echo "Error: Unable to get platform version; defaulting to tag 0.3.0"
          echo "semver=0.3.0" >> "$GITHUB_OUTPUT"
          exit
        fi
        # Older version commands output version to stderr; newer versions output to stdout
        raw_version=$(go run ./service version 2>&1)

        # Sanitize: remove all characters except those allowed in semver (alphanumeric, dots, hyphens, plus)
        # This prevents any potential code injection via the version string
        sanitized_version=$(echo "$raw_version" | tr -cd '0-9a-zA-Z.+-')

        # Validate version format (semver: x.y.z with optional pre-release/build metadata)
        if [[ "$sanitized_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
          echo "semver=$sanitized_version" >> "$GITHUB_OUTPUT"
          echo "## Platform version output: [$sanitized_version]"
          exit 0
        fi

        echo "Warning: Platform version '$raw_version' doesn't match expected semver format. Extracting version numbers."
        resanitized_version=$(echo "$sanitized_version" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
        if [[ -z "$resanitized_version" ]]; then
          echo "## Error: Could not extract valid version, defaulting to 0.0.0"
          echo "semver=0.0.0" >> "$GITHUB_OUTPUT"
          exit 0
        fi
        if [[ "$resanitized_version" =~ ^[0-9a-zA-Z.+-]+$ ]]; then
          echo "semver=$resanitized_version" >> "$GITHUB_OUTPUT"
          echo "## Platform version output: [$resanitized_version]"
          exit 0
        fi
        echo "## Error: Version contains unsafe characters after sanitization. Using fallback 0.0.0."
        echo "semver=0.0.0" >> "$GITHUB_OUTPUT"
      working-directory: otdf-test-platform
    - name: Provide the platform with keys
      shell: bash
      run: .github/scripts/init-temp-keys.sh
      working-directory: otdf-test-platform
    - name: Map the config to the keys
      shell: bash
      env:
        EXTRA_KEYS: ${{ inputs.extra-keys }}
        PLATFORM_VERSION: ${{ steps.platform-version.outputs.semver }}
      run: |
        set -e
        allowed_algorithms=(ec:secp256r1 rsa:2048)
        if echo $PLATFORM_VERSION | awk -F. '{ if ($1 > 0 || ($1 == 0 && $2 > 7) || ($1 == 0 && $2 == 7 && $3 >= 1)) exit 0; else exit 1; }'; then
          # For versions 0.7.1 and later, we allow rsa:4096 ec:secp384r1 ec:secp521r1
          allowed_algorithms+=(rsa:4096 ec:secp384r1 ec:secp521r1)
        fi
        keyring='[{"kid":"ec1","alg":"ec:secp256r1"},{"kid":"r1","alg":"rsa:2048"}]'
        keys='[{"kid":"e1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"ec1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"r1","alg":"rsa:2048","private":"kas-private.pem","cert":"kas-cert.pem"}]'
        while IFS= read -r key_json; do
          printf 'processing %s\n' "${key_json}"
          alg="$(jq -r '.alg' <<< "${key_json}")"
          if [[ ! " ${allowed_algorithms[*]} " =~ " ${alg} " ]]; then
            printf 'algorithm [%s] is not allowed. Skipping extra key [%s]\n' "${alg}" "${kid}" 1>&2
            continue
          fi
          private_pem="$(jq -r '.privateKey' <<< "${key_json}")"
          cert_pem="$(jq -r '.cert' <<< "${key_json}")"
          kid="$(jq -r '.kid' <<< "${key_json}")"

          # don't allow injection of paths. the regex can't be quoted in bash
          if [[ ! "${kid}" =~ ^[-0-9a-zA-Z_]+$ ]]; then
            printf 'kid is not valid: [%s]\n' "${kid}" 1>&2
            exit 1
          fi

          private_path="${kid}.pem"
          cert_path="${kid}-cert.pem"

          echo "${private_pem}" >"${private_path}"
          echo "${cert_pem}" >"${cert_path}"
          chmod a+r "${private_path}" "${cert_path}"

          key_obj="$(jq '{kid, alg, private: $private, cert: $cert}' --arg private "${private_path}" --arg cert "${cert_path}" <<< "${key_json}")"
          keys="$(jq '. + [$key_obj]' --argjson key_obj "${key_obj}" <<< "${keys}")"

          keyring_obj="$(jq '{kid, alg}' <<< "${key_json}")"
          keyring="$(jq '. + [$keyring_obj]' --argjson keyring_obj "${keyring_obj}" <<< "${keyring}")"

        done < <(jq -c '.[]' <<< "${EXTRA_KEYS}")

        printf 'adding the following keys:\n  [%s]\n[%s]  \n' "${keys}" "${keyring}"

        yq_command="$(printf '(.services.kas.keyring = %s) | (.server.cryptoProvider.standard.keys = %s)' "${keyring}" "${keys}")"

        <opentdf-dev.yaml >opentdf.yaml yq e "${yq_command}"

      working-directory: otdf-test-platform
    - name: Enable ECC wrapping for TDFs
      shell: bash
      if: ${{ inputs.ec-tdf-enabled == 'true' }}
      run: |
        yq e '.services.kas.preview.ec_tdf_enabled = true' -i opentdf.yaml
      working-directory: otdf-test-platform
    - name: Enable PQ (mlkem, xwing, and hybrid) wrapping for TDFs
      shell: bash
      if: ${{ inputs.pqc-enabled == 'true' }}
      run: |
        if [ ! -f kas-xwing-private.pem ]; then
          echo "PQC key files not found; skipping PQC configuration (platform may not support PQC key types)" 1>&2
          exit 0
        fi
        yq e '
          (.services.kas.preview.hybrid_tdf_enabled = true)
          | (.services.kas.keyring += [{"kid":"x1","alg":"hpqt:xwing"},{"kid":"h1","alg":"hpqt:secp256r1-mlkem768"},{"kid":"h2","alg":"hpqt:secp384r1-mlkem1024"}])
          | (.server.cryptoProvider.standard.keys += [{"kid":"x1","alg":"hpqt:xwing","private":"kas-xwing-private.pem","cert":"kas-xwing-public.pem"},{"kid":"h1","alg":"hpqt:secp256r1-mlkem768","private":"kas-p256mlkem768-private.pem","cert":"kas-p256mlkem768-public.pem"},{"kid":"h2","alg":"hpqt:secp384r1-mlkem1024","private":"kas-p384mlkem1024-private.pem","cert":"kas-p384mlkem1024-public.pem"}])
        ' -i opentdf.yaml
      working-directory: otdf-test-platform
    - name: Enable DPoP nonce challenge
      shell: bash
      if: ${{ inputs.dpop-challenge-enabled == 'true' }}
      run: |
        yq e '.server.auth.dpop.require_nonce = true' -i opentdf.yaml
      working-directory: otdf-test-platform
    - name: Enable DPoP enforcement
      shell: bash
      if: ${{ inputs.dpop-enforce-required == 'true' }}
      run: |
        yq e '.server.auth.dpop.enforce = true' -i opentdf.yaml
      working-directory: otdf-test-platform
    - name: Configure logging
      shell: bash
      env:
        LOG_LEVEL: ${{ inputs.log-level }}
        LOG_TYPE: ${{ inputs.log-type }}
      run: |
        yq e '(.logger.level = env(LOG_LEVEL)) | (.logger.type = env(LOG_TYPE))' -i opentdf.yaml
      working-directory: otdf-test-platform
    - name: Trust the generated certs
      shell: bash
      run: |
        sudo chmod -R 777 ./keys
        sudo apt-get install -y ca-certificates
        sudo cp ./keys/localhost.crt /usr/local/share/ca-certificates
        sudo update-ca-certificates
      working-directory: otdf-test-platform
    - name: Spin up platform's containerized resources
      shell: bash
      run: docker compose up -d --wait --wait-timeout 240
      working-directory: otdf-test-platform
    - name: Provision realms/clients/users into idP
      shell: bash
      run: go run ./service provision keycloak
      working-directory: otdf-test-platform
    - name: Provision test fixture policy
      if: ${{ inputs.provision-policy-fixtures == 'true' }}
      shell: bash
      run: go run ./service provision fixtures
      working-directory: otdf-test-platform
    - name: Set platform log file path
      id: log-path
      shell: bash
      run: |
        LOG_FILE="otdf-test-platform/logs/kas-main.log"
        echo "log-file=$LOG_FILE" >> "$GITHUB_OUTPUT"
        echo "Platform log file will be: $LOG_FILE"
    - name: Start platform server in background
      uses: JarvusInnovations/background-action@2428e7b970a846423095c79d43f759abf979a635 # v1.0.7
      with:
        run: >
          go build -o opentdf -v service/main.go
          && .github/scripts/watch.sh --tee-err-to logs/kas-main.log opentdf.yaml ./opentdf start
        wait-on: |
          tcp:localhost:8080
        log-output-if: true
        wait-for: 90s
        working-directory: otdf-test-platform