Skip to content

Commit 51f319d

Browse files
author
Mohamed Chorfa
committed
Harden the TEA reference implementation
- align the Rust server with the spec across auth, gRPC, persistence, and collection/product release flows - generate and validate publisher OpenAPI, conformance, and sbom-tools integration artifacts - add publishable release-doc bundles plus CI checks for spec, docs, and reference-profile behavior Signed-off-by: Mohamed Chorfa <mohamed.chorfa@thalesgroup.com>
1 parent ef802c2 commit 51f319d

99 files changed

Lines changed: 18962 additions & 3373 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yaml‎

Lines changed: 145 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,28 +14,67 @@ on:
1414
paths:
1515
- 'tea-server/**'
1616
- 'proto/**'
17+
- 'spec/**'
18+
- 'tools/**'
1719
- '.github/workflows/ci.yaml'
1820
pull_request:
1921
branches: [main]
2022
paths:
2123
- 'tea-server/**'
2224
- 'proto/**'
25+
- 'spec/**'
26+
- 'tools/**'
2327
- '.github/workflows/ci.yaml'
2428

2529
permissions:
2630
contents: read
2731

2832
env:
33+
BUF_VERSION: "1.66.1"
2934
CARGO_TERM_COLOR: always
3035
RUST_BACKTRACE: 1
3136

3237
jobs:
38+
# ─────────────────────────────────────────────────────────────────────────────
39+
# Proto verification
40+
# ─────────────────────────────────────────────────────────────────────────────
41+
proto:
42+
name: Proto Verify
43+
runs-on: ubuntu-latest
44+
45+
steps:
46+
- name: Checkout
47+
uses: actions/checkout@v4
48+
49+
- name: Install Rust toolchain
50+
uses: dtolnay/rust-toolchain@stable
51+
52+
- name: Install Buf CLI
53+
uses: bufbuild/buf-setup-action@v1
54+
with:
55+
version: ${{ env.BUF_VERSION }}
56+
57+
- name: Install protoc
58+
run: |
59+
sudo apt-get update
60+
sudo apt-get install -y protobuf-compiler
61+
62+
- name: Cache cargo artifacts
63+
uses: Swatinem/rust-cache@v2
64+
with:
65+
workspaces: tea-server -> target
66+
key: ${{ runner.os }}-rust-${{ hashFiles('tea-server/Cargo.lock') }}
67+
68+
- name: Verify proto pipeline
69+
run: make -C proto verify
70+
3371
# ─────────────────────────────────────────────────────────────────────────────
3472
# Build and Test
3573
# ─────────────────────────────────────────────────────────────────────────────
3674
build:
3775
name: Build & Test
3876
runs-on: ubuntu-latest
77+
needs: proto
3978
defaults:
4079
run:
4180
working-directory: tea-server
@@ -49,12 +88,25 @@ jobs:
4988
with:
5089
components: clippy, rustfmt
5190

91+
- name: Install Buf CLI
92+
uses: bufbuild/buf-setup-action@v1
93+
with:
94+
version: ${{ env.BUF_VERSION }}
95+
96+
- name: Install protoc
97+
run: |
98+
sudo apt-get update
99+
sudo apt-get install -y protobuf-compiler
100+
52101
- name: Cache cargo artifacts
53102
uses: Swatinem/rust-cache@v2
54103
with:
55104
workspaces: tea-server -> target
56105
key: ${{ runner.os }}-rust-${{ hashFiles('tea-server/Cargo.lock') }}
57106

107+
- name: Export proto dependencies
108+
run: make -C ../proto export-deps
109+
58110
- name: Check formatting
59111
run: cargo fmt -- --check
60112

@@ -64,11 +116,73 @@ jobs:
64116
- name: Run clippy
65117
run: cargo clippy -- -D warnings
66118

67-
- name: Run tests
68-
run: cargo test --locked
69-
env:
70-
# Disable integration tests that need Docker
71-
RUST_TEST_SKIP_INTEGRATION: 1
119+
- name: Run unit and binary tests
120+
run: cargo test --locked --lib --bins
121+
122+
- name: Validate publisher conformance checklist
123+
run: python3 ../tools/validate_publisher_conformance.py
124+
125+
- name: Check generated publisher OpenAPI profile
126+
run: python3 ../tools/generate_publisher_openapi.py --check
127+
128+
- name: Check generated aggregate OpenAPI publisher fragment
129+
run: python3 ../tools/render_aggregate_openapi_publisher_fragment.py --check
130+
131+
- name: Check generated aggregate OpenAPI publisher block
132+
run: python3 ../tools/sync_aggregate_openapi_publisher_block.py --check
133+
134+
- name: Check generated sbom-tools publisher examples
135+
run: python3 ../tools/render_sbom_tools_publisher_examples.py --check
136+
137+
- name: Check generated sbom-tools reqwest snippets
138+
run: python3 ../tools/render_sbom_tools_reqwest_snippets.py --check
139+
140+
- name: Validate publisher OpenAPI profile
141+
run: python3 ../tools/validate_publisher_openapi.py
142+
143+
- name: Render publisher conformance report
144+
run: python3 ../tools/render_publisher_conformance_report.py --output ../publisher-conformance-report.md --html-output ../publisher-conformance-report.html --summary-output ../publisher-conformance-summary.md
145+
146+
- name: Check publisher release-doc bundle inputs
147+
run: python3 ../tools/build_publisher_release_doc_bundle.py --check
148+
149+
- name: Publish publisher conformance summary
150+
if: ${{ always() }}
151+
run: cat ../publisher-conformance-summary.md >> "$GITHUB_STEP_SUMMARY"
152+
153+
- name: Build publisher release-doc bundle
154+
run: python3 ../tools/build_publisher_release_doc_bundle.py --output-dir ../publisher-release-doc-bundle
155+
156+
- name: Validate publisher release-doc bundle
157+
run: python3 ../tools/validate_publisher_release_doc_bundle.py --bundle-dir ../publisher-release-doc-bundle
158+
159+
- name: Run publisher gRPC reference-profile tests
160+
run: cargo test --locked --test grpc_smoke --test publisher_conformance --test publisher_capability_coverage
161+
162+
- name: Upload publisher conformance reports
163+
if: ${{ always() }}
164+
uses: actions/upload-artifact@v4
165+
with:
166+
name: publisher-conformance-report
167+
path: |
168+
publisher-conformance-report.md
169+
publisher-conformance-report.html
170+
publisher-conformance-summary.md
171+
if-no-files-found: ignore
172+
173+
- name: Upload publisher release-doc bundle
174+
if: ${{ always() }}
175+
uses: actions/upload-artifact@v4
176+
with:
177+
name: publisher-release-doc-bundle
178+
path: |
179+
publisher-release-doc-bundle
180+
publisher-release-doc-bundle.tar.gz
181+
publisher-release-doc-bundle.tar.gz.sha256
182+
if-no-files-found: ignore
183+
184+
- name: Run doctests
185+
run: cargo test --locked --doc
72186

73187
# ─────────────────────────────────────────────────────────────────────────────
74188
# Security Audit
@@ -111,11 +225,24 @@ jobs:
111225
- name: Install Rust toolchain
112226
uses: dtolnay/rust-toolchain@stable
113227

228+
- name: Install Buf CLI
229+
uses: bufbuild/buf-setup-action@v1
230+
with:
231+
version: ${{ env.BUF_VERSION }}
232+
233+
- name: Install protoc
234+
run: |
235+
sudo apt-get update
236+
sudo apt-get install -y protobuf-compiler
237+
114238
- name: Cache cargo artifacts
115239
uses: Swatinem/rust-cache@v2
116240
with:
117241
workspaces: tea-server -> target
118242

243+
- name: Export proto dependencies
244+
run: make -C ../proto export-deps
245+
119246
- name: Run integration tests
120247
run: cargo test --test integration
121248
# testcontainers will spin up Postgres automatically
@@ -138,10 +265,23 @@ jobs:
138265
- name: Install Rust toolchain
139266
uses: dtolnay/rust-toolchain@stable
140267

268+
- name: Install Buf CLI
269+
uses: bufbuild/buf-setup-action@v1
270+
with:
271+
version: ${{ env.BUF_VERSION }}
272+
273+
- name: Install protoc
274+
run: |
275+
sudo apt-get update
276+
sudo apt-get install -y protobuf-compiler
277+
141278
- name: Cache cargo artifacts
142279
uses: Swatinem/rust-cache@v2
143280
with:
144281
workspaces: tea-server -> target
145282

283+
- name: Export proto dependencies
284+
run: make -C ../proto export-deps
285+
146286
- name: Run E2E conformance tests
147287
run: cargo test --test e2e_conformance

‎dagger/Cargo.lock‎

Lines changed: 23 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dagger/Cargo.toml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@ version = "0.1.0"
44
edition = "2021"
55

66
[dependencies]
7-
dagger-sdk = "0.9"
7+
dagger-sdk = "0.20.3"
8+
eyre = "0.6"
89
tokio = { version = "1.0", features = ["full"] }

0 commit comments

Comments
 (0)