6ffa015827
A macOS test drives /usr/bin/security through Keychain::with_tool and a wrapper that names a scratch keychain on every command it passes on: an item kept, read back, replaced through -U and removed, no secret on any process argument, exit 44 read as none. It removes the scratch keychain in every case, a failure included, and holds the search list and the default keychain to what they were. It never names the login keychain, and needs no dialog. What the real tool does that the stand-in did not: security -i exits with the status of a command that failed in it, where the stand-in always exited 0. add now reports that status and what the tool said, with any secret removed from it, rather than reading it as "holds another secret". The stand-in does the same now. wai-key-keychain.yml runs this test alone on the macOS runner, for a pull request whose own diff changes dx/key.rs or the workflow. Co-Authored-By: Claude Opus 5.5 <[email protected]>
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
name: wai key · the real keychain
|
|
|
|
# `wai key` keeps a secret in macOS's keychain through /usr/bin/security. The binary's other tests
|
|
# reach it through a stand-in, on Linux; this one runs the real tool, in a scratch keychain the test
|
|
# makes and removes (never the login keychain), and needs no dialog.
|
|
#
|
|
# The macOS runner is CI's bottleneck, so this runs on one thing alone: a pull request whose own diff
|
|
# changes wai/wai-rs/src/bin/wai_cli/dx/key.rs or this file. The forge's filter matches a push's
|
|
# delta, so a rebase can fire it; the gate below (on Linux) reads the pull request's own diff, and
|
|
# the macOS job does not start without it.
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'wai/wai-rs/src/bin/wai_cli/dx/key.rs'
|
|
- '.github/workflows/wai-key-keychain.yml'
|
|
|
|
jobs:
|
|
relevant:
|
|
name: does this change touch it
|
|
runs-on: linux
|
|
outputs:
|
|
run: ${{ steps.gate.outputs.run }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
- id: gate
|
|
run: |
|
|
set -euo pipefail
|
|
r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-key-keychain.yml \
|
|
"${{ github.event.pull_request.base.sha }}" \
|
|
"${{ github.event.pull_request.head.sha }}")
|
|
echo "this change touches wai key's keychain: $r"
|
|
echo "run=$r" >> "$GITHUB_OUTPUT"
|
|
|
|
keychain:
|
|
name: the real keychain · macos
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
runs-on: macos
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# launchd's PATH omits cargo on the macOS host runner.
|
|
- name: Put cargo on PATH
|
|
shell: bash
|
|
run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: The one test
|
|
shell: bash
|
|
working-directory: wai/wai-rs
|
|
run: |
|
|
set -euo pipefail
|
|
nice -n 10 cargo test --locked --no-default-features --features quickstart --bin wai -- --exact dx::key::tests::the_real_keychain_keeps_reads_replaces_and_removes_a_secret 2>&1 | tee "$RUNNER_TEMP/keychain.log"
|
|
grep -qE '^test result: ok\. 1 passed; 0 failed' "$RUNNER_TEMP/keychain.log" || { echo "::error::the test did not run"; exit 1; }
|