45d564ace8
The wire identifiers of extensions/key-release.md (WKL1, WKE1, WKT1 and the WAI-Key-* header fields) in the registry table, and the export regenerated; the wai.video.keys row of SPEC §5 names its proxy form, and a §5 paragraph describes it; §6.2 states how a request missing a field is read. CI: the key-release step in the independent verifiers job (the module's tests, form 1's, tests/key_release.rs and key_release_verify.py), the extension under the workflow's paths, and the wai-key-proxy workflow (tests, clippy, the release binary end to end). Co-Authored-By: Claude Opus 5.5 <[email protected]>
88 lines
3 KiB
YAML
88 lines
3 KiB
YAML
name: wai-key-proxy
|
|
|
|
# The signing proxy and key server of extensions/key-release.md (wai/wai-key-proxy): its
|
|
# tests, which run the proxy, the key server and a fixture licence server on loopback, clippy
|
|
# with warnings as errors, and the release binary run end to end by smoke.sh.
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'wai/wai-key-proxy/**'
|
|
- 'wai/wai-rs/src/key_release.rs'
|
|
- 'wai/wai-rs/src/key_release/**'
|
|
- 'wai/wai-rs/src/wai_video_keys.rs'
|
|
- 'wai/wai-rs/Cargo.toml'
|
|
- 'wai/live-conformance/keys/**'
|
|
- 'rust-toolchain.toml'
|
|
- '.github/workflows/wai-key-proxy.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'wai/wai-key-proxy/**'
|
|
- 'wai/wai-rs/src/key_release.rs'
|
|
- 'wai/wai-rs/src/key_release/**'
|
|
- 'wai/wai-rs/src/wai_video_keys.rs'
|
|
- 'wai/wai-rs/Cargo.toml'
|
|
- 'wai/live-conformance/keys/**'
|
|
- 'rust-toolchain.toml'
|
|
- '.github/workflows/wai-key-proxy.yml'
|
|
|
|
jobs:
|
|
relevant:
|
|
name: does this change touch it
|
|
runs-on: linux-arm64
|
|
outputs:
|
|
run: ${{ steps.gate.outputs.run }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
- id: gate
|
|
run: |
|
|
set -euo pipefail
|
|
r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-key-proxy.yml \
|
|
"${{ github.event.pull_request.base.sha }}" \
|
|
"${{ github.event.pull_request.head.sha }}")
|
|
echo "this change touches wai-key-proxy: $r"
|
|
echo "run=$r" >> "$GITHUB_OUTPUT"
|
|
|
|
proxy-linux:
|
|
name: proxy · linux
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
runs-on: linux
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- name: Install Rust 1.98.0
|
|
shell: bash
|
|
run: |
|
|
export PATH="$HOME/.cargo/bin:$PATH"
|
|
command -v rustup >/dev/null 2>&1 || \
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
|
|
rustup toolchain install 1.98.0 --profile minimal --component clippy
|
|
rustup default 1.98.0
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: Tests and clippy
|
|
shell: bash
|
|
working-directory: wai/wai-key-proxy
|
|
run: |
|
|
set -euo pipefail
|
|
cargo test --locked 2>&1 | tee "$RUNNER_TEMP/test.log"
|
|
grep -qE '^test result: ok\. 2 passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::the end-to-end tests did not run"; exit 1; }
|
|
cargo clippy --locked --all-targets -- -D warnings
|
|
# smoke.sh runs a fixture licence server and picks free ports with Python.
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
- name: The release binary end to end
|
|
shell: bash
|
|
working-directory: wai/wai-key-proxy
|
|
run: |
|
|
set -euo pipefail
|
|
cargo build --locked --release
|
|
bash smoke.sh
|