Repository navigation
Enforce the response-mode constants against the oneof tag #1126
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: test-golang | |
| on: [push, pull_request] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Install Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: "**/*.sum" | |
| - name: Install Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| - name: Run tests | |
| run: make test | |
| config-docs: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Install Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: "**/*.sum" | |
| - name: Check docs/CONFIGURATION.md is up to date | |
| run: | | |
| make gen-config-docs | |
| if ! git diff --exit-code -- docs/CONFIGURATION.md; then | |
| echo "::error::docs/CONFIGURATION.md is out of date. Run 'make gen-config-docs' and commit the result." | |
| exit 1 | |
| fi | |
| # The zknative build tag gates pkg/mdoc's cgo path onto | |
| # zk-cred-longfellow's C ABI. Until this job existed, neither that cgo | |
| # code nor any of its four tagged test files was ever compiled by CI — | |
| # so a change to the crate's ABI, or to the Go wrapper, could only be | |
| # discovered by hand on a developer machine. | |
| # | |
| # The live-service tests already skip cleanly when | |
| # https://zk-circuits.fly.dev is unreachable (6fe7e96a and its sibling | |
| # guard), so a catalog outage cannot redden this job. | |
| zknative: | |
| name: Native ZK verification (cgo) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Install Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: "**/*.sum" | |
| - name: Install Rust | |
| # Pinned to a commit SHA: "stable" is a mutable branch ref, so an | |
| # unpinned use is a moving third-party dependency in the build. | |
| uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| # zk-cred-longfellow is fetched and built from source by | |
| # `make zk-native-lib`, which is a release-mode Rust build — cache it | |
| # on the resolved crate revision so only the first run after a bump | |
| # pays for it. | |
| - name: Resolve the native ZK crate revisions | |
| id: crate | |
| run: | | |
| set -euo pipefail | |
| # Both crates are fetched and built from source by their Makefile | |
| # targets, and both are cached on the resolved revision, so both | |
| # need resolving the same way. One step rather than two so the | |
| # ls-remote handling below exists once. | |
| resolve() { | |
| local name="$1" repo="$2" ref="$3" sha refs | |
| if printf '%s' "$ref" | grep -Eiq '^[0-9a-f]{40}$'; then | |
| # The Makefile accepts a raw commit SHA (and pinning the ref to | |
| # one is the intended direction), but `git ls-remote` does not | |
| # resolve a SHA - it would return nothing. Use it as-is. | |
| sha="$ref" | |
| else | |
| refs=$(git ls-remote "$repo" "$ref") | |
| # An annotated tag resolves to two lines; the peeled "^{}" entry | |
| # is the commit `git checkout FETCH_HEAD` actually lands on. | |
| sha=$(printf '%s\n' "$refs" | awk '$2 ~ /\^\{\}$/ { print $1; exit }') | |
| [ -n "$sha" ] || sha=$(printf '%s\n' "$refs" | awk 'NR==1 { print $1 }') | |
| fi | |
| # Also guarantees a single-line value, so GITHUB_OUTPUT cannot be | |
| # corrupted by an unexpected ls-remote result. | |
| if ! printf '%s' "$sha" | grep -Eiq '^[0-9a-f]{40}$'; then | |
| echo "::error::could not resolve $name ref '$ref'" | |
| exit 1 | |
| fi | |
| echo "$sha" | |
| } | |
| echo "sha=$(resolve zk-cred-longfellow https://github.com/sirosfoundation/zk-cred-longfellow.git "${ZK_CRED_LONGFELLOW_REF:-main}")" >> "$GITHUB_OUTPUT" | |
| echo "vega_sha=$(resolve zk-cred-vega https://github.com/sirosfoundation/zk-cred-vega.git "${ZK_CRED_VEGA_REF:-main}")" >> "$GITHUB_OUTPUT" | |
| - name: Cache the built C ABI library | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| third_party/zk-cred-longfellow | |
| third_party/.zk-cred-longfellow-src/target | |
| key: zk-cred-longfellow-${{ runner.os }}-${{ steps.crate.outputs.sha }} | |
| - name: Cache the built Vega C ABI library | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| third_party/zk-cred-vega | |
| third_party/.zk-cred-vega-src/target | |
| key: zk-cred-vega-${{ runner.os }}-${{ steps.crate.outputs.vega_sha }} | |
| - name: Build the native libraries | |
| # Both, not just Longfellow: pkg/mdoc/zknative_vega includes | |
| # zk_cred_vega_go.h, so the zknative tag does not compile at all | |
| # without the Vega library staged as well. | |
| run: | | |
| make zk-native-lib | |
| make zk-native-lib-vega | |
| - name: Run the zknative-tagged tests | |
| run: make test-zknative | |
| # Compiling the tests is not the same as compiling the binary that | |
| # ships: build-verifier-zknative exercises the link step the tests | |
| # never reach. | |
| - name: Build the verifier with the tag | |
| run: make build-verifier-zknative | |
| # The Vega path runs in a separate process, so the verifier binary | |
| # above links none of it - this is the only step that compiles and | |
| # links the worker. | |
| - name: Build the Vega verify worker | |
| run: make build-zkvegaverifyworker | |
| # Same reasoning as the zknative job: pkg/bbs's cgo path is behind a build | |
| # tag, so without a job that sets it neither the cgo code nor its tests is | |
| # ever compiled, and an ABI change in zk-cred-bbs would only surface by | |
| # hand on a developer machine. | |
| # | |
| # Unlike zknative this matters on the ISSUER side too — an issuer offering | |
| # BBS credentials cannot verify a commitment or blind-sign without it. | |
| bbsnative: | |
| name: Blind BBS issuance (cgo) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Install Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: "**/*.sum" | |
| - name: Install Rust | |
| # Pinned to a commit SHA: "stable" is a mutable branch ref. | |
| uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| # zk-cred-bbs is pinned to a tag in the Makefile, so this key is | |
| # stable until someone bumps it deliberately. | |
| - name: Cache the built C ABI library | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: | | |
| third_party/zk-cred-bbs | |
| third_party/.zk-cred-bbs-src/target | |
| key: zk-cred-bbs-${{ runner.os }}-${{ hashFiles('Makefile') }} | |
| - name: Build the native library | |
| run: make bbs-native-lib | |
| - name: Run the bbsnative-tagged tests | |
| run: make test-bbsnative | |
| # Compiling the tests is not the same as compiling the binary that | |
| # ships. The issuer is the binary that links this library, and its | |
| # link step - cgo objects into a statically linked executable - is | |
| # reached by nothing else here. | |
| - name: Build the issuer | |
| run: make build-issuer | |
| # pkg/bbs must still compile and pass without the tag. Every other | |
| # service is CGO_ENABLED=0 and fully static, and the package is | |
| # imported by openid4vci, which they all use. | |
| - name: Check the untagged, static build still compiles | |
| run: CGO_ENABLED=0 go build ./pkg/bbs/... && go test ./pkg/bbs/... |