753bfad4be
Some checks failed
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (push) Successful in 6s
wai key · the real keychain / does this change touch it (push) Successful in 14s
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (push) Successful in 31s
wai key · the real keychain / the real keychain · macos (push) Successful in 44s
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (push) Successful in 8m49s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Has been cancelled
The real-keychain test ran only on pull requests, and work now lands as direct commits to main, so f6bfd71ca's change to key.rs's Keychain (its service field) reached main run against the real keychain by nothing. The workflow now also starts on a push to main that changes key.rs or this file, as wai-breaking.yml does; the gate has no pull request to read on a push and answers true, so the push's own filter decides. Each push to main takes its own concurrency group, so a newer push cannot cancel an older push's run. Changelog: none Co-Authored-By: Claude Opus 5.5 <[email protected]>
69 lines
2.9 KiB
YAML
69 lines
2.9 KiB
YAML
name: wai key · the real keychain
|
|
|
|
# `wai key` keeps a secret in macOS's keychain through /usr/bin/security. The binary's other tests
|
|
# reach it through a stand-in, on Linux; this one runs the real tool, in a scratch keychain the test
|
|
# makes and removes (never the login keychain), and needs no dialog.
|
|
#
|
|
# The macOS runner is CI's bottleneck, so this runs on one thing alone: a change to
|
|
# wai/wai-rs/src/bin/wai_cli/dx/key.rs or this file, in a pull request's own diff or in a push to
|
|
# main. The forge's filter matches a push's delta, so a rebase can fire it; the gate below (on
|
|
# Linux) reads the pull request's own diff, and the macOS job does not start without it. On a push
|
|
# to main the gate has no pull request to read and answers `true`, so the push's own filter
|
|
# decides: work lands as direct commits to main, and a change to key.rs that reached main that way
|
|
# was run against the real keychain by nothing.
|
|
|
|
# A pull request's newer push supersedes its older run. A push to main does not: a cancelled run
|
|
# would leave that push's change to key.rs run by nothing, so each push to main takes its own group.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'wai/wai-rs/src/bin/wai_cli/dx/key.rs'
|
|
- '.github/workflows/wai-key-keychain.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'wai/wai-rs/src/bin/wai_cli/dx/key.rs'
|
|
- '.github/workflows/wai-key-keychain.yml'
|
|
|
|
jobs:
|
|
relevant:
|
|
name: does this change touch it
|
|
runs-on: linux
|
|
outputs:
|
|
run: ${{ steps.gate.outputs.run }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
- id: gate
|
|
run: |
|
|
set -euo pipefail
|
|
r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-key-keychain.yml \
|
|
"${{ github.event.pull_request.base.sha }}" \
|
|
"${{ github.event.pull_request.head.sha }}")
|
|
echo "this change touches wai key's keychain: $r"
|
|
echo "run=$r" >> "$GITHUB_OUTPUT"
|
|
|
|
keychain:
|
|
name: the real keychain · macos
|
|
needs: relevant
|
|
if: needs.relevant.outputs.run == 'true'
|
|
runs-on: macos
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# launchd's PATH omits cargo on the macOS host runner.
|
|
- name: Put cargo on PATH
|
|
shell: bash
|
|
run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: The one test
|
|
shell: bash
|
|
working-directory: wai/wai-rs
|
|
run: |
|
|
set -euo pipefail
|
|
nice -n 10 cargo test --locked --no-default-features --features quickstart --bin wai -- --exact dx::key::tests::the_real_keychain_keeps_reads_replaces_and_removes_a_secret 2>&1 | tee "$RUNNER_TEMP/keychain.log"
|
|
grep -qE '^test result: ok\. 1 passed; 0 failed' "$RUNNER_TEMP/keychain.log" || { echo "::error::the test did not run"; exit 1; }
|