ci.yml

name: CI

on:
  push:
    branches: ['**']
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Use CMake builder for aws-lc-sys to avoid __isoc23_sscanf (C23) unavailable on Rocky Linux GLIBC
  AWS_LC_SYS_CMAKE_BUILDER: 1

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  self-contained:
    name: Self-Contained Check
    runs-on: [self-hosted, Linux]
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: self-contained
      - name: Reject git dependencies
        run: |
          # Use cargo metadata for authoritative dependency source checking.
          # This cannot be bypassed with string tricks unlike grep-based approaches.
          GIT_DEPS=$(cargo metadata --format-version 1 2>/dev/null \
            | python3 -c "
          import json, sys
          meta = json.load(sys.stdin)
          git_deps = []
          for p in meta['packages']:
              src = p.get('source') or ''
              if src.startswith('git+'):
                  git_deps.append(p['name'] + ' (' + src + ')')
          for d in git_deps:
              print(d)
          sys.exit(1 if git_deps else 0)
          ")
          if [ $? -ne 0 ]; then
            echo ""
            echo "ERROR: Found git-sourced dependencies:"
            echo "$GIT_DEPS"
            echo ""
            echo "All external dependencies must be vendored under vendor/ or published to crates.io."
            echo "See: https://github.com/rayketcham-lab/PKI-Client/issues/5 (self-contained build policy)"
            exit 1
          fi
          echo "OK: All dependencies are from crates.io or local paths — build is fully self-contained."

  artifact-strategy-guard:
    name: Artifact Strategy Guard
    runs-on: [self-hosted, Linux]
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Forbid .deb / .rpm / tarball packaging
        # Release artifact policy (issue #106): the only release deliverable is
        # the bare static-musl binary `pki-${VERSION}-linux-x86_64-musl`.
        # No .deb, no .rpm, no tar.gz wrapper. This guard fails the build if
        # the forbidden patterns reappear (cargo-deb / cargo-generate-rpm
        # metadata, packaging tooling in release.yml, or non-musl assets in
        # the release upload glob).
        run: |
          set -euo pipefail
          fail=0
          msg() { echo "::error::$1"; fail=1; }

          # 1. No cargo-deb / cargo-generate-rpm metadata in any Cargo.toml.
          if grep -RIn --include='Cargo.toml' -E '^\[package\.metadata\.(deb|generate-rpm)\]' . ; then
            msg "Forbidden [package.metadata.deb] or [package.metadata.generate-rpm] block found. Release artifact is bare musl binary only — no .deb or .rpm."
          fi

          # 2. No cargo-deb / cargo-generate-rpm tooling in release.yml.
          if grep -nE '(cargo[- ]deb|cargo[- ]generate[- ]rpm)' .github/workflows/release.yml ; then
            msg "Forbidden cargo-deb / cargo-generate-rpm reference in .github/workflows/release.yml."
          fi

          # 3. No .deb / .rpm / .tar.gz / .zip in the release upload step.
          #    The release workflow's gh release create line is the source of truth.
          if grep -nE 'gh release create.*\.(deb|rpm|tar\.gz|tgz|zip)' .github/workflows/release.yml ; then
            msg "Forbidden non-musl asset (.deb/.rpm/.tar.gz/.tgz/.zip) in release upload."
          fi

          if [[ "$fail" -ne 0 ]]; then
            echo ""
            echo "Release artifact policy: only pki-\${VERSION}-linux-x86_64-musl is shipped."
            echo "See: https://github.com/rayketcham-lab/PKI-Client/issues/106"
            exit 1
          fi
          echo "OK: release artifact strategy is bare musl binary only."

  vendor-check:
    name: Vendor Freshness
    runs-on: [self-hosted, Linux]
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: vendor-check
      - name: Verify vendored deps are up-to-date
        run: |
          # Re-run cargo vendor and check for diff
          cargo vendor vendor/crates-io
          if [ -n "$(git status --porcelain vendor/crates-io/)" ]; then
            echo ""
            echo "ERROR: Vendored dependencies are out of date!"
            echo "Changed files:"
            git status --porcelain vendor/crates-io/ | head -30
            echo ""
            echo "Run 'cargo vendor vendor/crates-io' locally and commit the result."
            exit 1
          fi
          echo "OK: All vendored dependencies match Cargo.lock."

  offline-build:
    name: Offline Build
    needs: [vendor-check]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 20
    env:
      CARGO_NET_OFFLINE: "true"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-offline
      - name: Build with no network access
        run: cargo build --release --frozen
      - name: Verify binary exists
        run: |
          if [ ! -f "target/release/pki" ]; then
            echo "ERROR: Offline build did not produce pki binary"
            exit 1
          fi
          echo "OK: Offline build produced pki ($(du -h target/release/pki | cut -f1))"

  fmt:
    name: Format
    needs: [self-contained]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          components: rustfmt
      - name: cargo fmt --check
        run: cargo fmt --all --check

  clippy:
    name: Clippy
    needs: [fmt, offline-build]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          components: clippy
          cache-prefix: v3-clippy

      - name: cargo clippy
        run: cargo clippy --all-targets -- -D warnings

  clippy-pqc:
    name: Clippy (PQC)
    needs: [fmt]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          components: clippy
          cache-prefix: v3-clippy-pqc

      - name: cargo clippy --features pqc
        run: cargo clippy --all-targets --features pqc -- -D warnings

  clippy-fips:
    name: Clippy (FIPS)
    needs: [fmt]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 15
    # Static check — no entropy, no runtime FIPS init. Must gate merges.
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          components: clippy
          cache-prefix: v3-clippy-fips

      - name: cargo clippy --features fips
        run: cargo clippy --all-targets --features fips -- -D warnings

  test:
    name: Test
    needs: [fmt, clippy]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-test

      - name: cargo test
        run: cargo test --all

  test-pqc:
    name: Test (PQC)
    needs: [fmt, clippy-pqc]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-test-pqc

      - name: cargo test --features pqc
        run: cargo test --all --features pqc

  test-fips:
    name: Test (FIPS)
    needs: [fmt, clippy-fips]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 20
    # NB: job-level continue-on-error was removed (DevOps P1 hardening) —
    # it silenced compile errors and real test regressions, not just the
    # flaky entropy check. Compile must always be a hard gate; only the
    # test-execution step is allowed to soft-fail until the entropy
    # health-check is deflaked.
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-test-fips

      - name: cargo build --tests --features fips (hard gate)
        run: cargo build --all --tests --features fips
      - name: cargo test --features fips (soft gate, flaky entropy check)
        continue-on-error: true
        run: cargo test --all --features fips

  build:
    name: Build
    needs: [fmt, clippy]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-build

      - name: cargo build --release
        run: cargo build --release
      - name: Verify pki binary
        run: |
          if [ ! -f "target/release/pki" ]; then
            echo "ERROR: pki binary not found"
            exit 1
          fi
          echo "OK: pki ($(du -h target/release/pki | cut -f1))"

  build-musl:
    name: Build (musl static)
    needs: [fmt, clippy]
    # Pinned to ubuntu3-runner: musl-tools not available on Rocky Linux
    runs-on: [self-hosted, Linux]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          targets: x86_64-unknown-linux-musl
          cache-prefix: v3-build-musl

      - name: Install musl toolchain
        run: |
          if ! command -v musl-gcc &> /dev/null; then
            sudo apt-get update
            sudo apt-get install -y musl-tools
          fi
      - name: Build static binary
        run: cargo build --release --target x86_64-unknown-linux-musl
      - name: Verify static linking
        run: |
          if ldd "target/x86_64-unknown-linux-musl/release/pki" 2>&1 | grep -q "not a dynamic"; then
            echo "OK: pki is statically linked"
          else
            echo "WARN: pki may not be fully static"
          fi

  binary-output-validation:
    name: Binary Output Validation
    needs: [build]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-build

      - name: Build release binary
        run: cargo build --release

      - name: Verify binary exists
        run: |
          set -euo pipefail
          if [ ! -f "target/release/pki" ]; then
            echo "ERROR: pki binary not found at target/release/pki"
            exit 1
          fi
          echo "OK: pki binary present ($(du -h target/release/pki | cut -f1))"

      - name: Check version output
        run: |
          set -euo pipefail
          EXPECTED=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
          VERSION_OUT=$(target/release/pki --version)
          echo "Version output: $VERSION_OUT"
          if ! echo "$VERSION_OUT" | grep -qF "$EXPECTED"; then
            echo "ERROR: version output did not contain expected '$EXPECTED'"
            echo "Got: $VERSION_OUT"
            exit 1
          fi
          echo "OK: version check passed (v$EXPECTED)"

      - name: Generate RSA-4096 key
        run: |
          set -euo pipefail
          target/release/pki key gen rsa --bits 4096 -o /tmp/ci-test.key
          if [ ! -f /tmp/ci-test.key ]; then
            echo "ERROR: RSA key file not created"
            exit 1
          fi
          echo "OK: RSA-4096 key generated"

      - name: Generate EC P-256 key
        run: |
          set -euo pipefail
          target/release/pki key gen ec --curve p256 -o /tmp/ci-test-ec.key
          if [ ! -f /tmp/ci-test-ec.key ]; then
            echo "ERROR: EC key file not created"
            exit 1
          fi
          echo "OK: EC P-256 key generated"

      - name: Create RSA CSR
        run: |
          set -euo pipefail
          target/release/pki csr create --key /tmp/ci-test.key --cn "CI Test" -o /tmp/ci-test.csr
          if [ ! -f /tmp/ci-test.csr ]; then
            echo "ERROR: RSA CSR file not created"
            exit 1
          fi
          echo "OK: RSA CSR created"

      - name: Create EC CSR
        run: |
          set -euo pipefail
          target/release/pki csr create --key /tmp/ci-test-ec.key --cn "CI Test EC" -o /tmp/ci-test-ec.csr
          if [ ! -f /tmp/ci-test-ec.csr ]; then
            echo "ERROR: EC CSR file not created"
            exit 1
          fi
          echo "OK: EC CSR created"

      - name: Validate pki show key output (RSA-4096 and 4096 bits)
        run: |
          set -euo pipefail
          SHOW_OUT=$(target/release/pki show /tmp/ci-test.key)
          echo "$SHOW_OUT"
          if ! echo "$SHOW_OUT" | grep -q "RSA-4096"; then
            echo "ERROR: 'pki show' key output did not contain 'RSA-4096'"
            exit 1
          fi
          if ! echo "$SHOW_OUT" | grep -q "4096 bits"; then
            echo "ERROR: 'pki show' key output did not contain '4096 bits'"
            exit 1
          fi
          echo "OK: RSA key show output is correct"

      - name: Validate pki show RSA CSR output (RSA algorithm, no raw OID)
        run: |
          set -euo pipefail
          SHOW_OUT=$(target/release/pki show /tmp/ci-test.csr)
          echo "$SHOW_OUT"
          if ! echo "$SHOW_OUT" | grep -q "RSA"; then
            echo "ERROR: 'pki show' CSR output did not contain 'RSA'"
            exit 1
          fi
          if echo "$SHOW_OUT" | grep -q "1.2.840.113549"; then
            echo "ERROR: 'pki show' CSR output contains raw OID '1.2.840.113549' — OID leak detected"
            exit 1
          fi
          echo "OK: RSA CSR show output is correct (human-readable, no raw OID leak)"

      - name: Validate pki show EC CSR output (EC algorithm)
        run: |
          set -euo pipefail
          SHOW_OUT=$(target/release/pki show /tmp/ci-test-ec.csr)
          echo "$SHOW_OUT"
          if ! echo "$SHOW_OUT" | grep -q "EC"; then
            echo "ERROR: 'pki show' EC CSR output did not contain 'EC'"
            exit 1
          fi
          echo "OK: EC CSR show output is correct"

      - name: Validate pki diff CSR comparison (exit 0)
        run: |
          set -euo pipefail
          DIFF_OUT=$(target/release/pki diff /tmp/ci-test.csr /tmp/ci-test-ec.csr)
          echo "$DIFF_OUT"
          echo "OK: pki diff exited cleanly"

      - name: "Regression: pki show auto-detects DER CSR (#24)"
        run: |
          set -euo pipefail
          target/release/pki convert /tmp/ci-test.csr --to der -o /tmp/ci-test.csr.der
          if target/release/pki show /tmp/ci-test.csr.der 2>&1 | grep -qiE "CSR|Request|Subject"; then
            echo "OK: pki show auto-detected DER CSR"
          else
            echo "KNOWN BUG #24: pki show does not auto-detect DER CSRs"
            echo "Skipping until #24 is fixed"
          fi

      - name: "Regression: pki key match rejects CSR with clear error (#25)"
        run: |
          set -euo pipefail
          ERR=$(target/release/pki key match /tmp/ci-test.key /tmp/ci-test.csr 2>&1 || true)
          echo "$ERR"
          if echo "$ERR" | grep -q "InvalidAlgorithmIdentifier"; then
            echo "KNOWN BUG #25: key match crashes on CSR with InvalidAlgorithmIdentifier"
            echo "Skipping until #25 is fixed"
          elif echo "$ERR" | grep -qiE "CSR|not supported|does not support"; then
            echo "OK: key match gives clear error for CSR files"
          else
            echo "OK: key match handled CSR input"
          fi

      - name: "Regression: RSA-4096 shows correct key size (#31)"
        run: |
          set -euo pipefail
          SHOW_OUT=$(target/release/pki show /tmp/ci-test.key)
          echo "$SHOW_OUT"
          if echo "$SHOW_OUT" | grep -q "4096"; then
            echo "OK: RSA key shows 4096 bits"
          else
            echo "FAIL: RSA key does not show 4096 bits"
            exit 1
          fi

      - name: "Regression: RSA-512 rejected (#32)"
        run: |
          set -euo pipefail
          if target/release/pki key gen rsa --bits 512 -o /tmp/ci-weak.key 2>&1; then
            echo "FAIL: RSA-512 should be rejected"
            rm -f /tmp/ci-weak.key
            exit 1
          else
            echo "OK: RSA-512 correctly rejected"
          fi

      - name: "Regression: RSA-99999 rejected (#32)"
        run: |
          set -euo pipefail
          if target/release/pki key gen rsa --bits 99999 -o /tmp/ci-huge.key 2>&1; then
            echo "FAIL: RSA-99999 should be rejected"
            rm -f /tmp/ci-huge.key
            exit 1
          else
            echo "OK: RSA-99999 correctly rejected"
          fi

      - name: Cleanup temp files
        if: always()
        run: |
          rm -f /tmp/ci-test.key /tmp/ci-test-ec.key /tmp/ci-test.csr /tmp/ci-test-ec.csr /tmp/ci-test.csr.der

  binary-validation:
    name: Binary Validation
    needs: [fmt, clippy]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-binary-validation

      - name: Build release binary
        run: cargo build --release

      - name: Verify version
        run: |
          set -euo pipefail
          ./target/release/pki --version

      - name: Generate test keys
        run: |
          set -euo pipefail
          ./target/release/pki key gen rsa --bits 4096 -o /tmp/ci-rsa.key
          ./target/release/pki key gen ec --curve p256 -o /tmp/ci-ec.key

      - name: Create test CSRs
        run: |
          set -euo pipefail
          ./target/release/pki csr create --key /tmp/ci-rsa.key --cn "CI RSA Test" -o /tmp/ci-rsa.csr
          ./target/release/pki csr create --key /tmp/ci-ec.key --cn "CI EC Test" -o /tmp/ci-ec.csr

      - name: Validate RSA CSR display
        run: |
          set -euo pipefail
          output=$(./target/release/pki show /tmp/ci-rsa.csr)
          echo "$output"
          echo "$output" | grep -q "RSA"
          echo "$output" | grep -q "4096"
          if echo "$output" | grep -q "1.2.840.113549.1.1.1"; then
            echo "FAIL: Raw OID found in output"
            exit 1
          fi

      - name: Validate EC CSR display
        run: |
          set -euo pipefail
          output=$(./target/release/pki show /tmp/ci-ec.csr)
          echo "$output"
          echo "$output" | grep -q "EC"
          if echo "$output" | grep -q "1.2.840.10045.2.1"; then
            echo "FAIL: Raw OID found in output"
            exit 1
          fi

      - name: Validate CSR diff
        run: |
          set -euo pipefail
          ./target/release/pki diff /tmp/ci-rsa.csr /tmp/ci-ec.csr

      - name: Cleanup test files
        if: always()
        run: rm -f /tmp/ci-rsa.key /tmp/ci-ec.key /tmp/ci-rsa.csr /tmp/ci-ec.csr

  links:
    name: Link Check
    runs-on: [self-hosted, Linux]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install lychee
        run: which lychee || cargo install lychee --locked
      - name: Check markdown links
        run: |
          lychee \
            --no-progress \
            --exclude 'img.shields.io' \
            --exclude 'github.com/rayketcham-lab/PKI-Client/releases$' \
            --exclude-path 'vendor/crates-io' \
            '**/*.md'

  audit:
    name: Security Audit
    needs: [self-contained]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-audit

      - name: Install cargo-audit
        run: |
          # Build from source if cached binary is missing or broken (GLIBC compat)
          if cargo-audit --version >/dev/null 2>&1; then
            echo "cargo-audit $(cargo-audit --version) OK"
          else
            cargo install cargo-audit --locked --force
          fi
      - name: Run cargo audit
        env:
          GITHUB_TOKEN: ""
          GIT_TERMINAL_PROMPT: "0"
        run: |
          git config --unset-all http.https://github.com/.extraheader || true
          git config --global --unset-all http.https://github.com/.extraheader || true
          AUDIT_OK=false
          for i in 1 2 3; do
            if cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2024-0370 --ignore RUSTSEC-2024-0398; then
              AUDIT_OK=true
              break
            fi
            echo "Attempt $i failed, retrying in 5s..."
            sleep 5
          done
          if [ "$AUDIT_OK" != "true" ]; then
            echo "ERROR: cargo audit failed after 3 attempts"
            exit 1
          fi

  cargo-deny:
    name: Dependency Audit (cargo-deny)
    needs: [self-contained]
    runs-on: [self-hosted, Linux]
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/rust-setup
        with:
          cache-prefix: v3-deny

      - name: Install cargo-deny
        run: |
          # Require cargo-deny >= 0.17 for CVSS 4.0 advisory DB support
          # Build from source to avoid GLIBC_2.39 issue with pre-built binaries
          NEED_INSTALL=true
          if cargo-deny --version >/dev/null 2>&1; then
            VER=$(cargo-deny --version | grep -oP '\d+\.\d+' | head -1)
            MAJOR=$(echo "$VER" | cut -d. -f1)
            MINOR=$(echo "$VER" | cut -d. -f2)
            if [ "$MAJOR" -gt 0 ] || [ "$MINOR" -ge 17 ]; then
              NEED_INSTALL=false
              echo "cargo-deny $(cargo-deny --version) OK"
            fi
          fi
          if [ "$NEED_INSTALL" = "true" ]; then
            echo "Installing cargo-deny from source (need >= 0.17 for CVSS 4.0)..."
            cargo install cargo-deny --locked --force
          fi
      - name: Run cargo deny
        run: cargo deny check