Support MFA-protected AWS profiles via mfaToken on @initAws #5159
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI test suite | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-and-test: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| includes-varlock: ${{ steps.check-release.outputs.includes-varlock }} | |
| release-packages: ${{ steps.check-release.outputs.packages }} | |
| swift-changed: ${{ steps.check-swift.outputs.changed }} | |
| rust-changed: ${{ steps.check-rust.outputs.changed }} | |
| swift-cache-hit: ${{ steps.swift-cache-check.outputs.cache-hit }} | |
| rust-cache-hit: ${{ steps.rust-cache-final.outputs.cache-hit }} | |
| rust-source-hash: ${{ steps.rust-hash.outputs.hash }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Use Node.js 24.x | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24.x" | |
| - name: Install js deps (w/ bun) | |
| run: bun install | |
| - name: Audit dependencies | |
| run: bun run audit:changed | |
| - name: Enable turborepo build cache | |
| uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14 | |
| # Note: the bumpy release-plan check + comment live in their own workflows | |
| # (bumpy-check.yaml emits the comment on `pull_request`; bumpy-comment.yaml | |
| # posts it on `workflow_run`) so it can post on fork PRs without running | |
| # PR-defined code with write permissions. | |
| # lint, build, tests --------------------------------- | |
| - name: ESLint | |
| run: bun run lint | |
| - name: TypeScript type check | |
| run: bun run typecheck:all | |
| - name: Build libraries | |
| run: bun run build:libs | |
| - name: Run tests | |
| run: bun run test:ci | |
| # The vitest suite runs under Node; this check runs the proxy's verified-TLS | |
| # injection (Invariant #1) under Bun, the runtime the compiled binary uses — | |
| # Node cannot catch the Bun-specific pre-write leak it guards against. | |
| - name: Proxy verified-TLS injection (Bun) | |
| run: bun run --filter varlock test:proxy:bun | |
| # Determine which packages will be preview-released (used to gate native builds) | |
| - name: Check release packages | |
| if: github.ref_name != 'main' | |
| id: check-release | |
| run: bun run scripts/check-release-packages.ts | |
| # Check if native binary source changed (used to gate native builds) | |
| - name: Check for Swift source changes | |
| id: check-swift | |
| if: steps.check-release.outputs.includes-varlock == 'true' | |
| run: | | |
| if git diff --name-only origin/main...HEAD | grep -qE '^(packages/encryption-binary-swift/|\.github/workflows/build-native-macos\.yaml)'; then | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "changed=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Check for Rust source changes | |
| id: check-rust | |
| if: steps.check-release.outputs.includes-varlock == 'true' | |
| run: | | |
| if git diff --name-only origin/main...HEAD | grep -qE '^(packages/encryption-binary-rust/|\.github/workflows/build-native-rust\.yaml)'; then | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "changed=false" >> $GITHUB_OUTPUT | |
| fi | |
| # Check if native binary caches exist (lookup-only, no download) | |
| - name: Check Swift binary cache | |
| id: swift-cache-check | |
| if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-swift.outputs.changed != 'true' | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: packages/varlock/native-bins/darwin/VarlockEnclave.app | |
| key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/Package.swift', 'packages/encryption-binary-swift/swift/Sources/**') }} | |
| lookup-only: true | |
| # Compute Rust source hash once on Ubuntu — used for cache keys everywhere | |
| # (hashFiles can differ across OSes, so we normalize it here) | |
| - name: Compute Rust source hash | |
| id: rust-hash | |
| if: steps.check-release.outputs.includes-varlock == 'true' | |
| run: | | |
| HASH=${{ hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }} | |
| echo "hash=$HASH" >> $GITHUB_OUTPUT | |
| - name: Check Rust cache - linux-x64 | |
| id: rust-cache-check-linux-x64 | |
| if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true' | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: packages/varlock/native-bins/linux-x64/ | |
| key: native-bin-rust-linux-x64-${{ steps.rust-hash.outputs.hash }} | |
| lookup-only: true | |
| - name: Check Rust cache - linux-arm64 | |
| id: rust-cache-check-linux-arm64 | |
| if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true' | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: packages/varlock/native-bins/linux-arm64/ | |
| key: native-bin-rust-linux-arm64-${{ steps.rust-hash.outputs.hash }} | |
| lookup-only: true | |
| - name: Check Rust cache - win32-x64 | |
| id: rust-cache-check-win32-x64 | |
| if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true' | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: packages/varlock/native-bins/win32-x64/ | |
| key: native-bin-rust-win32-x64-${{ steps.rust-hash.outputs.hash }} | |
| lookup-only: true | |
| - name: Determine Rust cache status | |
| id: rust-cache-final | |
| if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true' | |
| run: | | |
| if [[ "${{ steps.rust-cache-check-linux-x64.outputs.cache-hit }}" == "true" \ | |
| && "${{ steps.rust-cache-check-linux-arm64.outputs.cache-hit }}" == "true" \ | |
| && "${{ steps.rust-cache-check-win32-x64.outputs.cache-hit }}" == "true" ]]; then | |
| echo "cache-hit=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "cache-hit=false" >> $GITHUB_OUTPUT | |
| echo "::warning::Some Rust binary caches missing — will trigger rebuild" | |
| fi | |
| # Build + sign the macOS native binary if varlock is being released AND (source changed or cache missing) | |
| build-native-macos: | |
| needs: build-and-test | |
| if: >- | |
| needs.build-and-test.outputs.includes-varlock == 'true' | |
| && (needs.build-and-test.outputs.swift-changed == 'true' || needs.build-and-test.outputs.swift-cache-hit != 'true') | |
| uses: ./.github/workflows/build-native-macos.yaml | |
| with: | |
| artifact-name: native-bin-macos-ci | |
| secrets: | |
| OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }} | |
| # Build Rust native binaries if varlock is being released AND (source changed or cache missing) | |
| build-native-rust: | |
| needs: build-and-test | |
| # CI builds never sign, so no id-token is granted here (signing is gated on | |
| # the `sign` input, which only the release workflows pass). | |
| permissions: | |
| contents: read | |
| if: >- | |
| needs.build-and-test.outputs.includes-varlock == 'true' | |
| && (needs.build-and-test.outputs.rust-changed == 'true' || needs.build-and-test.outputs.rust-cache-hit != 'true') | |
| uses: ./.github/workflows/build-native-rust.yaml | |
| with: | |
| artifact-name: native-bin-rust-ci | |
| source-hash: ${{ needs.build-and-test.outputs.rust-source-hash }} | |
| # Publish preview packages via pkg-pr-new | |
| release-preview-packages: | |
| needs: [build-and-test, build-native-macos, build-native-rust] | |
| # Run even if native builds were skipped (source unchanged), but not if anything failed. Skip on main. | |
| if: always() && !failure() && !cancelled() && github.ref_name != 'main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Use Node.js 24.x | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24.x" | |
| - name: Install node deps | |
| run: bun install | |
| - name: Enable turborepo build cache | |
| uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14 | |
| # Get signed macOS .app if varlock is being released | |
| # If the macOS build ran this run, download the artifact directly | |
| # Otherwise, restore from cross-run cache | |
| - name: Download macOS native binary (from this run) | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-macos.result == 'success' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: native-bin-macos-ci | |
| path: packages/varlock/native-bins/darwin/VarlockEnclave.app | |
| - name: Restore cached macOS native binary (from prior run) | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-macos.result != 'success' | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: packages/varlock/native-bins/darwin/VarlockEnclave.app | |
| key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/Package.swift', 'packages/encryption-binary-swift/swift/Sources/**') }} | |
| - name: Verify and fix native binary permissions | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' | |
| run: | | |
| BINARY=packages/varlock/native-bins/darwin/VarlockEnclave.app/Contents/MacOS/varlock-local-encrypt | |
| if [ ! -f "$BINARY" ]; then | |
| echo "::error::macOS native binary not found — cannot publish varlock preview without it" | |
| exit 1 | |
| fi | |
| chmod +x "$BINARY" | |
| # Get Rust native binaries if varlock is being released | |
| # If the Rust build ran this run, download the artifacts; otherwise restore from cache | |
| - name: Download Rust binaries (from this run) | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result == 'success' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| pattern: native-bin-rust-ci-* | |
| path: packages/varlock/native-bins/ | |
| merge-multiple: false | |
| # Flatten: download-artifact creates subdirs per artifact name, but we need linux-x64/ etc. | |
| - name: Flatten Rust artifact directories (from this run) | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result == 'success' | |
| run: | | |
| cd packages/varlock/native-bins | |
| for dir in native-bin-rust-ci-*/; do | |
| subdir=$(echo "$dir" | sed 's/native-bin-rust-ci-//' | sed 's/\///') | |
| mv "$dir" "$subdir" 2>/dev/null || true | |
| done | |
| - uses: actions/cache/restore@v5 | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result != 'success' | |
| with: | |
| path: packages/varlock/native-bins/linux-x64/ | |
| key: native-bin-rust-linux-x64-${{ needs.build-and-test.outputs.rust-source-hash }} | |
| - uses: actions/cache/restore@v5 | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result != 'success' | |
| with: | |
| path: packages/varlock/native-bins/linux-arm64/ | |
| key: native-bin-rust-linux-arm64-${{ needs.build-and-test.outputs.rust-source-hash }} | |
| - uses: actions/cache/restore@v5 | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result != 'success' | |
| with: | |
| path: packages/varlock/native-bins/win32-x64/ | |
| key: native-bin-rust-win32-x64-${{ needs.build-and-test.outputs.rust-source-hash }} | |
| - name: Verify and fix Rust binary permissions | |
| if: needs.build-and-test.outputs.includes-varlock == 'true' | |
| run: | | |
| MISSING=() | |
| for SUBDIR in linux-x64 linux-arm64 win32-x64; do | |
| if [ "$SUBDIR" = "win32-x64" ]; then | |
| BIN="packages/varlock/native-bins/$SUBDIR/varlock-local-encrypt.exe" | |
| else | |
| BIN="packages/varlock/native-bins/$SUBDIR/varlock-local-encrypt" | |
| fi | |
| if [ ! -f "$BIN" ]; then | |
| MISSING+=("$BIN") | |
| elif [ "$SUBDIR" != "win32-x64" ]; then | |
| chmod +x "$BIN" && echo "Fixed: $BIN" | |
| fi | |
| done | |
| if [ ${#MISSING[@]} -gt 0 ]; then | |
| echo "::error::Rust native binaries not found: ${MISSING[*]}" | |
| echo "Cache may not be seeded yet — ensure release.yaml has run on main" | |
| exit 1 | |
| fi | |
| - name: Build publishable npm packages | |
| if: needs.build-and-test.outputs.release-packages != '[]' | |
| run: bun run build:libs | |
| env: | |
| BUILD_TYPE: preview | |
| - name: Release preview packages | |
| if: needs.build-and-test.outputs.release-packages != '[]' | |
| run: bun run scripts/release-preview.ts | |
| env: | |
| RELEASE_PACKAGES: ${{ needs.build-and-test.outputs.release-packages }} |