refactor(fortios): modernize the native wrapper and bundled runtime workflow #145
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: iOS Security Checks | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| paths: | |
| - '.github/workflows/ios-security.yml' | |
| - '.tool-versions' | |
| - 'Makefile' | |
| - 'README.md' | |
| - 'bridge-contract.json' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - 'vitest.config.ts' | |
| - 'tools/**' | |
| - 'KeriWallet/**' | |
| - 'KeriWalletTests/**' | |
| - 'KeriWalletUITests/**' | |
| - 'generated/**' | |
| - 'Config/**' | |
| - 'xcodeproj/**' | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - '.github/workflows/ios-security.yml' | |
| - '.tool-versions' | |
| - 'Makefile' | |
| - 'README.md' | |
| - 'bridge-contract.json' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - 'vitest.config.ts' | |
| - 'tools/**' | |
| - 'KeriWallet/**' | |
| - 'KeriWalletTests/**' | |
| - 'KeriWalletUITests/**' | |
| - 'generated/**' | |
| - 'Config/**' | |
| - 'xcodeproj/**' | |
| workflow_dispatch: | |
| jobs: | |
| payload-checks: | |
| runs-on: ubuntu-latest | |
| env: | |
| FORTWEB_DIR: ${{ github.workspace }}/.deps/fortweb | |
| FORTWEB_RUNTIME_SOURCE_URL: https://github.com/keri-foundation/fortweb/releases/download/runtime-source-pyodide-314-20260909/runtime-source.tar.gz | |
| FORTWEB_RUNTIME_SOURCE_ARCHIVE_SHA256: e04833249eec88596e0f2f88d32baa6d5fae6b2e964996587061ddac4bd78c72 | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST: build/runtime-source/manifest.json | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256: 87bcc689d7778840a76284471ff599cef21be41df2b429724f7f4fdc5f022135 | |
| FORTWEB_PACKAGE_REF: refs/heads/pyodide-314-runtime | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check out FortWeb dependency | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | |
| with: | |
| repository: keri-foundation/fortweb | |
| ref: bdb81afa7593603141e8db306f0636a583d2db02 | |
| path: .deps/fortweb | |
| - name: Set up Node | |
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 | |
| with: | |
| node-version: '22.12.0' | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Build canonical FortWeb runtime | |
| run: | | |
| npm ci --prefix "$FORTWEB_DIR" | |
| (cd "$FORTWEB_DIR" && python3 scripts/acquire_runtime_source.py \ | |
| --url "$FORTWEB_RUNTIME_SOURCE_URL" \ | |
| --sha256 "$FORTWEB_RUNTIME_SOURCE_ARCHIVE_SHA256" \ | |
| --manifest-sha256 "$FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256" \ | |
| --output build/runtime-source) | |
| python3 -m pip install --disable-pip-version-check --no-index --no-deps \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/packaging-26.1-py3-none-any.whl" \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/setuptools-83.0.0-py3-none-any.whl" \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/wheel-0.47.0-py3-none-any.whl" | |
| (cd "$FORTWEB_DIR" && npm run build:runtime && \ | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST="$FORTWEB_RUNTIME_SOURCE_MANIFEST" \ | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256="$FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256" \ | |
| npm run package:runtime -- --runtime-dir dist/runtime --python python3 --output-dir dist/package --ref "$FORTWEB_PACKAGE_REF") | |
| test -f "$FORTWEB_DIR/dist/package/fortweb-runtime-0.0.0.zip" | |
| - name: Verify bridge contract output | |
| run: make bridge-check | |
| - name: Enforce wrapper payload contract | |
| run: make payload-contract | |
| - name: Validate runtime platform configuration | |
| run: npm run validate:runtime-platform-config | |
| - name: Test runtime platform configuration | |
| run: npm run test:runtime-platform-config | |
| - name: Validate runtime requirements compatibility | |
| run: npm run validate:runtime-requirements-compatibility | |
| - name: Test runtime requirements compatibility | |
| run: npm run test:runtime-requirements-compatibility | |
| - name: Run Node tool tests (Vitest) | |
| run: make test-tools | |
| swift-tests: | |
| runs-on: macos-26 | |
| timeout-minutes: 45 | |
| env: | |
| DEVELOPER_DIR: /Applications/Xcode_26.5.app/Contents/Developer | |
| FORTWEB_DIR: ${{ github.workspace }}/.deps/fortweb | |
| FORTWEB_RUNTIME_SOURCE_URL: https://github.com/keri-foundation/fortweb/releases/download/runtime-source-pyodide-314-20260909/runtime-source.tar.gz | |
| FORTWEB_RUNTIME_SOURCE_ARCHIVE_SHA256: e04833249eec88596e0f2f88d32baa6d5fae6b2e964996587061ddac4bd78c72 | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST: build/runtime-source/manifest.json | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256: 87bcc689d7778840a76284471ff599cef21be41df2b429724f7f4fdc5f022135 | |
| FORTWEB_PACKAGE_REF: refs/heads/pyodide-314-runtime | |
| SIMULATOR_NAME: 'iPhone 17 Pro' | |
| SIMULATOR_OS: '26.5' | |
| RESULT_BUNDLE_PATH: build/TestResults.xcresult | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | |
| - name: Check out FortWeb dependency | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | |
| with: | |
| repository: keri-foundation/fortweb | |
| ref: bdb81afa7593603141e8db306f0636a583d2db02 | |
| path: .deps/fortweb | |
| - name: Set up Node | |
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 | |
| with: | |
| node-version: '22.12.0' | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Build canonical FortWeb runtime | |
| run: | | |
| npm ci --prefix "$FORTWEB_DIR" | |
| (cd "$FORTWEB_DIR" && python3 scripts/acquire_runtime_source.py \ | |
| --url "$FORTWEB_RUNTIME_SOURCE_URL" \ | |
| --sha256 "$FORTWEB_RUNTIME_SOURCE_ARCHIVE_SHA256" \ | |
| --manifest-sha256 "$FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256" \ | |
| --output build/runtime-source) | |
| python3 -m pip install --disable-pip-version-check --no-index --no-deps \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/packaging-26.1-py3-none-any.whl" \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/setuptools-83.0.0-py3-none-any.whl" \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/wheel-0.47.0-py3-none-any.whl" | |
| (cd "$FORTWEB_DIR" && npm run build:runtime && \ | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST="$FORTWEB_RUNTIME_SOURCE_MANIFEST" \ | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256="$FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256" \ | |
| npm run package:runtime -- --runtime-dir dist/runtime --python python3 --output-dir dist/package --ref "$FORTWEB_PACKAGE_REF") | |
| test -f "$FORTWEB_DIR/dist/package/fortweb-runtime-0.0.0.zip" | |
| - name: Enforce wrapper payload contract | |
| run: make payload-contract | |
| - name: Validate runtime requirements compatibility | |
| run: npm run validate:runtime-requirements-compatibility | |
| - name: Resolve simulator destination | |
| id: resolve-sim | |
| run: | | |
| SIM_UDID="$(python3 ./scripts/resolve-ios-simulator.py --udid)" | |
| echo "sim_udid=$SIM_UDID" >> "$GITHUB_OUTPUT" | |
| echo "Resolved: $SIM_UDID" | |
| - name: Build and test Swift (native unit + UI) | |
| timeout-minutes: 40 | |
| run: | | |
| set -euxo pipefail | |
| FORTWEB_DIR="$FORTWEB_DIR" xcodebuild test \ | |
| -project KeriWallet.xcodeproj \ | |
| -scheme KeriWallet \ | |
| -configuration Debug \ | |
| -destination "platform=iOS Simulator,id=${{ steps.resolve-sim.outputs.sim_udid }}" \ | |
| -resultBundlePath "$RESULT_BUNDLE_PATH" \ | |
| -derivedDataPath build/DerivedData-sim | |
| - name: Collect native bundle failure diagnostics | |
| if: failure() | |
| run: | | |
| set -euxo pipefail | |
| SIM_UDID="$(python3 ./scripts/resolve-ios-simulator.py --udid)" | |
| echo "::group::Simulator logs (last 200 lines)" | |
| if [ -n "$SIM_UDID" ]; then | |
| xcrun simctl spawn "$SIM_UDID" log show --last 2m --predicate 'subsystem CONTAINS "com.apple.dt.XCTest" OR process CONTAINS "KeriWallet"' 2>/dev/null | tail -200 || echo "SIM_LOG_FAILED" | |
| else | |
| echo "NO_SIM_UDID" | |
| fi | |
| echo "::endgroup::" | |
| echo "::group::Crash reports" | |
| find ~/Library/Logs/DiagnosticReports -name 'KeriWallet*' -mmin -30 -print -exec cat {} \; 2>/dev/null || echo "NO_CRASH_REPORTS" | |
| echo "::endgroup::" | |
| echo "::group::dyld reports" | |
| find ~/Library/Logs/DiagnosticReports -name '*.dyld_*' -mmin -30 -print -exec cat {} \; 2>/dev/null || echo "NO_DYLD_REPORTS" | |
| echo "::endgroup::" | |
| - name: Upload native bundle failure diagnostics | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: native-bundle-diagnostics | |
| path: | | |
| ~/Library/Logs/DiagnosticReports/KeriWallet* | |
| ~/Library/Logs/DiagnosticReports/*.dyld_* | |
| if-no-files-found: ignore | |
| - name: Upload Swift test results | |
| if: failure() || cancelled() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: swift-test-results | |
| path: ${{ env.RESULT_BUNDLE_PATH }} | |
| if-no-files-found: ignore | |
| archive-proof: | |
| runs-on: macos-26 | |
| timeout-minutes: 45 | |
| env: | |
| DEVELOPER_DIR: /Applications/Xcode_26.5.app/Contents/Developer | |
| FORTWEB_DIR: ${{ github.workspace }}/.deps/fortweb | |
| FORTWEB_RUNTIME_SOURCE_URL: https://github.com/keri-foundation/fortweb/releases/download/runtime-source-pyodide-314-20260909/runtime-source.tar.gz | |
| FORTWEB_RUNTIME_SOURCE_ARCHIVE_SHA256: e04833249eec88596e0f2f88d32baa6d5fae6b2e964996587061ddac4bd78c72 | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST: build/runtime-source/manifest.json | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256: 87bcc689d7778840a76284471ff599cef21be41df2b429724f7f4fdc5f022135 | |
| FORTWEB_PACKAGE_REF: refs/heads/pyodide-314-runtime | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check out FortWeb dependency | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | |
| with: | |
| repository: keri-foundation/fortweb | |
| ref: bdb81afa7593603141e8db306f0636a583d2db02 | |
| path: .deps/fortweb | |
| - name: Set up Node | |
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 | |
| with: | |
| node-version: '22.12.0' | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Build canonical FortWeb runtime | |
| run: | | |
| npm ci --prefix "$FORTWEB_DIR" | |
| (cd "$FORTWEB_DIR" && python3 scripts/acquire_runtime_source.py \ | |
| --url "$FORTWEB_RUNTIME_SOURCE_URL" \ | |
| --sha256 "$FORTWEB_RUNTIME_SOURCE_ARCHIVE_SHA256" \ | |
| --manifest-sha256 "$FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256" \ | |
| --output build/runtime-source) | |
| python3 -m pip install --disable-pip-version-check --no-index --no-deps \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/packaging-26.1-py3-none-any.whl" \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/setuptools-83.0.0-py3-none-any.whl" \ | |
| "$FORTWEB_DIR/build/runtime-source/wheelhouse/wheel-0.47.0-py3-none-any.whl" | |
| (cd "$FORTWEB_DIR" && npm run build:runtime && \ | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST="$FORTWEB_RUNTIME_SOURCE_MANIFEST" \ | |
| FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256="$FORTWEB_RUNTIME_SOURCE_MANIFEST_SHA256" \ | |
| npm run package:runtime -- --runtime-dir dist/runtime --python python3 --output-dir dist/package --ref "$FORTWEB_PACKAGE_REF") | |
| test -f "$FORTWEB_DIR/dist/package/fortweb-runtime-0.0.0.zip" | |
| - name: Enforce wrapper payload contract (import + validate) | |
| run: make payload-contract | |
| - name: Run release archive verifier unit tests | |
| run: npx vitest run tools/__tests__/release-archive.test.mjs | |
| - name: Build unsigned Release archive | |
| timeout-minutes: 25 | |
| run: | | |
| xcodebuild archive \ | |
| -project KeriWallet.xcodeproj \ | |
| -scheme KeriWallet \ | |
| -configuration Release \ | |
| -destination 'generic/platform=iOS' \ | |
| -archivePath build/KeriWallet.xcarchive \ | |
| -derivedDataPath build/DerivedData-device \ | |
| CODE_SIGNING_ALLOWED=NO | |
| - name: Verify archived payload integrity | |
| run: node tools/assert-release-archive.mjs --archive build/KeriWallet.xcarchive |