security: zeroize plaintext key material in memory (H2, M3) (#10) #59

	name: Code coverage
	on:
	pull_request:
	paths-ignore:
	- documentation/**
	push:
	branches:
	- main
	paths-ignore:
	- documentation/**

	env:
	pg_version: 18
	# Avoid failures on slow recovery
	PGCTLTIMEOUT: 120
	PG_TEST_TIMEOUT_DEFAULT: 300

	jobs:
	collect:
	name: Collect and upload
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	env:
	PG_TEST_REQUIRE_COSMIAN_KMS: '1'
	PG_TEST_REQUIRE_OPENBAO: '1'
	steps:
	- name: Clone repository
	uses: actions/checkout@v6
	with:
	path: src
	submodules: recursive

	- name: Clone postgres repository
	uses: actions/checkout@v6
	with:
	path: postgres
	repository: percona/postgres.git
	ref: PSP_REL_${{ env.pg_version }}_STABLE

	- name: Install dependencies
	run: src/ci_scripts/ubuntu-deps.sh

	- name: Build postgres
	run: src/ci_scripts/build-and-install-psp.sh coverage

	- name: Build open_pg_tde
	run: src/ci_scripts/build.sh coverage

	- name: Run open_pg_tde tests
	run: src/ci_scripts/test.sh

	- name: Process coverage
	run: \|
	geninfo -o coverage.info --rc lcov_branch_coverage=1 -i .
	geninfo -o coverage.info --rc lcov_branch_coverage=1 .
	working-directory: build

	- name: Upload coverage data to codecov.io
	uses: codecov/codecov-action@v7
	with:
	verbose: true
	fail_ci_if_error: true
	token: ${{ secrets.CODECOV_TOKEN }}
	disable_search: true
	files: ../build/coverage.info
	working-directory: src

	- name: Report on test fail
	uses: actions/upload-artifact@v7
	if: ${{ failure() }}
	with:
	name: coverage-testlog
	path: \|
	build/meson-logs/testlog.txt
	build/regress_install
	build/regress_install.log
	build/regression.diffs
	build/results
	build/testrun
	retention-days: 3

Navigation Menu