feat(vz): validate the v2 secret-shim launch contract #3963
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: demo-e2e | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| demo-ci: | |
| name: just demo-ci | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| - name: Load tool versions | |
| shell: bash | |
| run: grep -E '^[A-Z0-9_]+=' tool-versions.env >> "$GITHUB_ENV" | |
| - name: Install protoc | |
| uses: ./.github/actions/setup-protoc | |
| with: | |
| version: ${{ env.PROTOC_VERSION }} | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install jq + netcat | |
| run: sudo apt-get install -y jq netcat-openbsd | |
| - name: Install cargo-binstall | |
| uses: cargo-bins/cargo-binstall@75b4bfae1b2c753a6806bbce6e6cb89b602de33c # v1.22.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install just | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| command -v just || cargo binstall -y --force --locked just | |
| shell: bash | |
| - name: Build release binaries | |
| run: cargo build --release -p firma -p firma-demo-fixture | |
| - name: Run demo CI driver | |
| run: timeout 90 just demo-ci | |
| - name: Run Git demo CI driver | |
| env: | |
| FIRMA_GIT_DEMO_GITHUB_TOKEN: ${{ secrets.FIRMA_GIT_DEMO_GITHUB_TOKEN }} | |
| FIRMA_GIT_DEMO_REPO: ${{ vars.FIRMA_GIT_DEMO_REPO }} | |
| run: timeout 180 just git-demo-ci | |
| - name: Assert audit ALLOW + DENY events | |
| run: | | |
| set -euo pipefail | |
| log="examples/demo/logs/sidecar.log" | |
| test -s "$log" || (echo "missing $log" >&2; exit 1) | |
| # Audit events are JSON-lines on stdout; decision field is | |
| # 1 = Allow, 2 = Deny (see audit/sink/stdout.rs). | |
| allow=$(grep -c '"decision":1' "$log" || true) | |
| deny=$(grep -c '"decision":2' "$log" || true) | |
| echo "allow_events=$allow deny_events=$deny" | |
| # firma-demo-fixture-client fires exactly one /allow + one /deny; | |
| # any other count means the demo deviated from its contract | |
| # (extra requests, retries, or a regression that lets a request | |
| # through with a different decision) — fail closed. | |
| test "$allow" -eq 1 || (echo "expected exactly 1 ALLOW audit event, got $allow" >&2; exit 1) | |
| test "$deny" -eq 1 || (echo "expected exactly 1 DENY audit event, got $deny" >&2; exit 1) | |
| - name: Upload demo logs | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: demo-logs | |
| path: examples/demo/logs/ |