Skip to content

Commit 385138e

Browse files
jh-lee-cryptolabjh-lee-cryptolab
authored
Merge pull request #68 from CryptoLabInc/epic/go-migration
feat: migrate vault to Go binary runevault with multi-CSP installer
2 parents 4aa3df8 + ad52b6b commit 385138e

103 files changed

Lines changed: 9575 additions & 7159 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,67 +7,46 @@ on:
77
- "docs/**"
88
- "*.md"
99
- "deployment/**"
10-
- ".github/workflows/docker-publish.yml"
1110
- "LICENSE"
1211
- ".githooks/**"
12+
- ".github/workflows/**"
1313
push:
1414
branches: [main]
1515
paths-ignore:
1616
- "docs/**"
1717
- "*.md"
1818
- "deployment/**"
19-
- ".github/workflows/docker-publish.yml"
2019
- "LICENSE"
2120
- ".githooks/**"
21+
- ".github/workflows/**"
2222

2323
concurrency:
2424
group: ci-${{ github.event.pull_request.number || github.sha }}
2525
cancel-in-progress: true
2626

2727
jobs:
2828
check:
29-
runs-on: [self-hosted, vault-ci]
29+
runs-on: ubuntu-latest
30+
env:
31+
MISE_ENV: ci
3032
steps:
3133
- uses: actions/checkout@v4
3234
- uses: jdx/mise-action@v2
33-
env:
34-
MISE_ENV: ci
3535
- run: mise run setup
3636
- name: Clean previous fixtures
3737
run: rm -rf tests/fixtures/
3838
- name: Decrypt test fixtures
3939
env:
4040
FIXTURES_GPG_PASSPHRASE: ${{ secrets.FIXTURES_GPG_PASSPHRASE_ALT }}
4141
run: mise run fixtures:decrypt
42-
- name: Format check
43-
run: mise run format:check
44-
- name: Lint
45-
run: mise run lint
46-
- name: Test (unit + integration)
47-
run: mise run test
48-
- name: Clean up fixtures
49-
if: always()
50-
run: rm -rf tests/fixtures/
51-
52-
build-image:
53-
if: github.event_name == 'push'
54-
needs: check
55-
runs-on: [self-hosted, vault-ci]
56-
steps:
57-
- uses: actions/checkout@v4
42+
- name: Check (gofmt + vet + unit tests)
43+
run: mise run check
5844
- name: Build
5945
run: |
60-
docker build -t rune-vault:ci-${{ github.sha }} vault/
61-
- name: Smoke test
62-
run: |
63-
docker run -d --name vault-ci-${{ github.run_id }} \
64-
-e VAULT_TLS_DISABLE=true \
65-
rune-vault:ci-${{ github.sha }}
66-
timeout 60 bash -c 'until docker exec vault-ci-${{ github.run_id }} \
67-
curl -sf http://localhost:8081/health 2>/dev/null; do sleep 2; done'
68-
- name: Teardown
46+
VERSION=$(git describe --tags --always 2>/dev/null || echo "dev")
47+
VERSION=$VERSION mise run go:build
48+
- name: E2E tests
49+
run: mise run go:test:e2e
50+
- name: Clean up fixtures
6951
if: always()
70-
run: |
71-
docker rm -f vault-ci-${{ github.run_id }} || true
72-
docker rmi rune-vault:ci-${{ github.sha }} || true
73-
docker system prune -f
52+
run: rm -rf tests/fixtures/

‎.github/workflows/docker-publish.yml‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

‎.github/workflows/release.yaml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
name: Release Binaries
2+
3+
on:
4+
release:
5+
types: [prereleased]
6+
workflow_dispatch:
7+
inputs:
8+
dry_run:
9+
description: 'Dry run — skip GitHub Release upload'
10+
required: false
11+
default: 'true'
12+
type: boolean
13+
14+
concurrency:
15+
group: release-binaries-${{ github.ref }}
16+
cancel-in-progress: false
17+
18+
jobs:
19+
build:
20+
name: Build ${{ matrix.os }}/${{ matrix.arch }}
21+
runs-on: ${{ matrix.runner }}
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
include:
26+
- { runner: ubuntu-latest, os: linux, arch: amd64 }
27+
- { runner: ubuntu-24.04-arm, os: linux, arch: arm64 }
28+
- { runner: macos-14, os: darwin, arch: arm64 }
29+
- { runner: macos-14, os: darwin, arch: amd64 }
30+
31+
steps:
32+
- uses: actions/checkout@v4
33+
34+
- uses: jdx/mise-action@v2
35+
36+
- name: Bootstrap (modules + proto stubs)
37+
run: mise run setup
38+
39+
- name: Install OpenSSL (Linux)
40+
if: matrix.os == 'linux'
41+
run: sudo apt-get install -y libssl-dev
42+
43+
- name: Install OpenSSL arm64 (macOS)
44+
if: matrix.os == 'darwin'
45+
run: brew install openssl@3
46+
47+
- name: Install Intel Homebrew + OpenSSL x86_64 (macOS amd64 cross)
48+
if: matrix.os == 'darwin' && matrix.arch == 'amd64'
49+
run: |
50+
if ! [ -x /usr/local/bin/brew ]; then
51+
NONINTERACTIVE=1 arch -x86_64 /bin/bash -c \
52+
"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
53+
fi
54+
arch -x86_64 /usr/local/bin/brew install openssl@3
55+
56+
- name: Check (gofmt + go vet + unit tests)
57+
run: mise run check
58+
59+
- name: Resolve version
60+
id: meta
61+
run: |
62+
if [ "${{ github.event_name }}" = "release" ]; then
63+
VERSION="${{ github.event.release.tag_name }}"
64+
else
65+
VERSION=$(git describe --tags --always 2>/dev/null || echo "dev")
66+
fi
67+
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
68+
echo "archive=runevault_${VERSION}_${{ matrix.os }}_${{ matrix.arch }}.tar.gz" >> "$GITHUB_OUTPUT"
69+
70+
- name: Build binary
71+
env:
72+
GOOS: ${{ matrix.os }}
73+
GOARCH: ${{ matrix.arch }}
74+
VERSION: ${{ steps.meta.outputs.version }}
75+
run: |
76+
PKG="github.com/CryptoLabInc/rune-admin/vault/internal/commands"
77+
COMMIT=$(git rev-parse --short HEAD)
78+
DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
79+
if [ "${{ matrix.os }}" = "darwin" ] && [ "${{ matrix.arch }}" = "amd64" ]; then
80+
SDKROOT=$(xcrun -sdk macosx --show-sdk-path)
81+
export CC="clang -arch x86_64 -isysroot ${SDKROOT}"
82+
export CGO_CFLAGS="-arch x86_64 -I/usr/local/opt/openssl@3/include"
83+
export CGO_LDFLAGS="-arch x86_64 -L/usr/local/opt/openssl@3/lib"
84+
fi
85+
cd vault && go build \
86+
-trimpath \
87+
-ldflags "-s -w -X '${PKG}.buildVersion=${VERSION}' -X '${PKG}.buildCommit=${COMMIT}' -X '${PKG}.buildDate=${DATE}'" \
88+
-o bin/runevault \
89+
./cmd
90+
91+
- name: Smoke test
92+
run: |
93+
if [ "${{ matrix.os }}" = "darwin" ] && [ "${{ matrix.arch }}" = "amd64" ]; then
94+
arch -x86_64 ./vault/bin/runevault version
95+
else
96+
./vault/bin/runevault version
97+
fi
98+
99+
- name: Package
100+
run: |
101+
mkdir -p _dist
102+
cp vault/bin/runevault _dist/
103+
cp LICENSE _dist/
104+
tar -czf "${{ steps.meta.outputs.archive }}" -C _dist .
105+
106+
- uses: actions/upload-artifact@v4
107+
with:
108+
name: ${{ steps.meta.outputs.archive }}
109+
path: ${{ steps.meta.outputs.archive }}
110+
retention-days: 7
111+
112+
publish:
113+
name: Publish
114+
runs-on: ubuntu-latest
115+
needs: build
116+
permissions:
117+
contents: write
118+
119+
steps:
120+
- uses: actions/checkout@v4
121+
122+
- name: Download build artifacts
123+
uses: actions/download-artifact@v4
124+
with:
125+
path: dist/
126+
merge-multiple: true
127+
128+
- name: Resolve version
129+
id: meta
130+
run: |
131+
if [ "${{ github.event_name }}" = "release" ]; then
132+
echo "version=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
133+
else
134+
echo "version=$(git describe --tags --always 2>/dev/null || echo dev)" >> "$GITHUB_OUTPUT"
135+
fi
136+
137+
- name: Generate SHA256SUMS
138+
working-directory: dist/
139+
run: sha256sum *.tar.gz > SHA256SUMS
140+
141+
- name: Upload to GitHub Release
142+
if: github.event_name == 'release'
143+
working-directory: dist/
144+
env:
145+
GH_TOKEN: ${{ github.token }}
146+
run: |
147+
gh release upload "${{ github.event.release.tag_name }}" \
148+
*.tar.gz \
149+
SHA256SUMS \
150+
--repo "${{ github.repository }}"

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,11 @@ Thumbs.db
9696
*.dll
9797
*.dylib
9898

99+
# Go build artifacts
100+
vault/bin/
101+
vault/**/*.test
102+
vault/**/*.out
103+
99104
# Database
100105
*.db
101106
*.sqlite
@@ -114,3 +119,6 @@ test-results/
114119

115120
# Test fixtures (plaintext — decrypted from fixtures.tar.gz.gpg)
116121
tests/fixtures/
122+
123+
# Local dev runtime files (config, socket, keys, pid)
124+
vault/dev/

‎.mise.ci.toml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
1-
# CI-only tool configuration
2-
# Used by setting MISE_ENV=ci in GitHub Actions workflows
1+
# CI environment overrides — merged on top of .mise.toml when MISE_ENV=ci.
2+
# Tasks are inherited from .mise.toml; only CI-specific settings go here.
33

4-
[tools]
5-
python = "3.12"
6-
buf = "1.66"
7-
ruff = "0.15"
8-
9-
[env]
10-
_.python.venv = { path = ".venv", create = true }
11-
PYTHONPATH = "{{config_root}}/vault/proto:{{config_root}}/vault"
4+
# Only install tools required for build and test; skip deployment tools.
5+
[settings]
6+
enable_tools = ["go", "buf"]

0 commit comments

Comments
 (0)