Crypto2

.github/scripts/mobile-ci/configure-android-device-phase.sh

@@ -4,6 +4,12 @@ set -euo pipefail
 phase="${1:?Android device test phase is required}"
 
 case "$phase" in
+  crypto2-signum)
+    script="./waltid-identity/.github/scripts/mobile-ci/run-android-crypto2-signum-tests.sh"
+    emulator_options="-no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim"
+    report_paths="waltid-identity/waltid-libraries/crypto/waltid-crypto2-signum/build/outputs/androidTest-results/**/*.xml"
+    artifact_paths=$'waltid-identity/waltid-libraries/crypto/waltid-crypto2-signum/build/reports/androidTests/**\nwaltid-identity/waltid-libraries/crypto/waltid-crypto2-signum/build/outputs/androidTest-results/**'
+    ;;
   wallet-mobile)
     script="./waltid-identity/.github/scripts/mobile-ci/run-android-wallet-mobile-tests.sh"
     emulator_options="-no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim"

.github/scripts/mobile-ci/run-android-compose-demo-tests.sh

@@ -6,4 +6,5 @@ identity_dir="$(cd "$script_dir/../../.." && pwd -P)"
 
 "$identity_dir/gradlew" -p "$identity_dir" \
   :waltid-applications:waltid-wallet-demo-compose:androidApp:connectedDebugAndroidTest \
+  -PtransactionDataProfiles.url=https://wallet.demo.walt.id/wallet-api/transaction-data-profiles \
   --info

.github/scripts/mobile-ci/run-android-crypto2-signum-tests.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+identity_dir="$(cd "$script_dir/../../.." && pwd -P)"
+
+"$identity_dir/gradlew" -p "$identity_dir" \
+  :waltid-libraries:crypto:waltid-crypto2-signum:connectedAndroidDeviceTest \
+  --info

.github/workflows/android-device-tests.yml

@@ -2,24 +2,48 @@ name: Android device tests
 
 on:
   workflow_dispatch:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, labeled, unlabeled]
   push:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: read
+
 jobs:
+  android-eligibility:
+    uses: ./.github/workflows/android-eligibility.yml
+    with:
+      event-name: ${{ github.event_name }}
+      ref: ${{ github.ref }}
+      pr-number: ${{ github.event.pull_request.number || '' }}
+      pr-head-repo: ${{ github.event.pull_request.head.repo.full_name || '' }}
+      pr-labels: ${{ toJson(github.event.pull_request.labels.*.name) }}
+      pr-draft: ${{ github.event.pull_request.draft || false }}
+
   android-device-test-phase:
     name: android-device-tests (${{ matrix.phase }})
+    needs: android-eligibility
+    if: ${{ needs.android-eligibility.outputs.should-run == 'true' }}
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        phase: [wallet-mobile, compose-demo, enterprise-mobile]
+        phase: [crypto2-signum, wallet-mobile, compose-demo, enterprise-mobile]
     env:
       MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
       MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
     steps:
       - name: Checkout all repos with ref fallback
-        uses: walt-id/waltid-identity/.github/actions/checkout-repos@c95b601fc5095d5668eb8c906af992d8e00ed513
+        uses: walt-id/waltid-identity/.github/actions/checkout-repos@4296a7f80cacf7e60cb1a20321956768892eb7e3
         with:
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
+          ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
 
       - name: Configure gradle
         uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
@@ -86,7 +110,7 @@ jobs:
           script: ${{ steps.android-device-phase.outputs.script }}
 
       - name: Publish Android device test report
-        if: always()
+        if: always() && steps.android-device-phase.outputs.report_paths != ''
         uses: mikepenz/action-junit-report@v6
         with:
           update_check: true
@@ -99,7 +123,7 @@ jobs:
           require_tests: false
 
       - name: Upload Android device test reports
-        if: always()
+        if: always() && steps.android-device-phase.outputs.artifact_paths != ''
         uses: actions/upload-artifact@v4
         with:
           name: android-device-test-reports-${{ matrix.phase }}
@@ -108,11 +132,18 @@ jobs:
 
   android-device-tests:
     runs-on: ubuntu-24.04
-    needs: android-device-test-phase
+    needs:
+      - android-eligibility
+      - android-device-test-phase
     if: always()
     steps:
       - name: Check Android device test phases
         run: |
+          if [ "${{ needs.android-eligibility.outputs.should-run }}" != "true" ]; then
+            echo "Android eligibility skipped this run: ${{ needs.android-eligibility.outputs.reason }}"
+            exit 0
+          fi
+
           if [ "${{ needs.android-device-test-phase.result }}" != "success" ]; then
             echo "::error::One or more Android device test phases failed."
             exit 1

.github/workflows/android-eligibility.yml

@@ -0,0 +1,88 @@
+name: Android eligibility
+
+on:
+  workflow_call:
+    inputs:
+      event-name:
+        description: "Caller event name"
+        required: true
+        type: string
+      ref:
+        description: "Caller git ref"
+        required: true
+        type: string
+      pr-number:
+        description: "Pull request number, if the caller is a PR event"
+        required: false
+        type: string
+        default: ""
+      pr-head-repo:
+        description: "Pull request head repository, if the caller is a PR event"
+        required: false
+        type: string
+        default: ""
+      pr-labels:
+        description: "JSON array of pull request label names"
+        required: false
+        type: string
+        default: "[]"
+      pr-draft:
+        description: "Whether the pull request is currently a draft"
+        required: false
+        type: boolean
+        default: false
+    outputs:
+      should-run:
+        description: "Whether Android jobs should run"
+        value: ${{ jobs.decide.outputs.should-run }}
+      reason:
+        description: "Human-readable decision reason"
+        value: ${{ jobs.decide.outputs.reason }}
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  decide:
+    uses: ./.github/workflows/mobile-eligibility.yml
+    with:
+      event-name: ${{ inputs.event-name }}
+      ref: ${{ inputs.ref }}
+      pr-number: ${{ inputs.pr-number }}
+      pr-head-repo: ${{ inputs.pr-head-repo }}
+      pr-labels: ${{ inputs.pr-labels }}
+      pr-draft: ${{ inputs.pr-draft }}
+      platform-name: Android
+      platform-label: ci:android
+      path-patterns: |
+        [
+          ".github/workflows/android-device-tests.yml",
+          ".github/workflows/android-eligibility.yml",
+          ".github/workflows/mobile-eligibility.yml",
+          ".github/workflows/gradle.yml",
+          ".github/actions/checkout-repos/*",
+          ".github/actions/gradle-setup-action/*",
+          ".github/actions/set-properties/*",
+          ".github/scripts/mobile-ci/*android*",
+          "build-logic/*",
+          "build.gradle.kts",
+          "gradle/*",
+          "gradle.properties",
+          "gradlew",
+          "settings.gradle.kts",
+          "gradle/libs.versions.toml",
+          "*/src/commonMain/*",
+          "*/src/commonTest/*",
+          "*/src/androidMain/*",
+          "*/src/androidTest/*",
+          "*/src/androidDeviceTest/*",
+          "*/src/androidUnitTest/*",
+          "*/src/androidInstrumentedTest/*",
+          "waltid-applications/waltid-wallet-demo-compose/*",
+          "waltid-libraries/*/build.gradle.kts",
+          "waltid-libraries/*/*/build.gradle.kts",
+          "waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/*",
+          "waltid-libraries/protocols/waltid-openid4vc-wallet-persistence-mobile/*",
+          "waltid-libraries/web/waltid-web-data-fetching/*"
+        ]

.github/workflows/build.yml

@@ -8,14 +8,26 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  android-eligibility:
+    uses: ./.github/workflows/android-eligibility.yml
+    with:
+      event-name: ${{ github.event_name }}
+      ref: ${{ github.ref }}
+      pr-number: ${{ github.event.pull_request.number || '' }}
+      pr-head-repo: ${{ github.event.pull_request.head.repo.full_name || '' }}
+      pr-labels: ${{ toJson(github.event.pull_request.labels.*.name) }}
+      pr-draft: ${{ github.event.pull_request.draft || false }}
   version:
     uses: walt-id/waltid-identity/.github/workflows/version.yml@main
   gradle-build:
     uses: walt-id/waltid-identity/.github/workflows/gradle.yml@main
     secrets: inherit
-    needs: version
+    needs:
+      - android-eligibility
+      - version
     with:
       version: ${{ needs.version.outputs.release_version }}
+      enable-android-build: ${{ needs.android-eligibility.outputs.should-run == 'true' }}
       report-check-name: 'gradle-build / gradle (ubuntu-22.04)'
   docker-matrix:
     uses: walt-id/waltid-identity/.github/workflows/load-json.yml@main

.github/workflows/crypto2-platforms.yml

@@ -0,0 +1,141 @@
+name: Crypto2 platform tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'waltid-libraries/crypto/waltid-crypto2/**'
+      - 'waltid-libraries/crypto/waltid-jose/**'
+      - 'waltid-libraries/crypto/waltid-crypto2-*/**'
+      - '.github/workflows/crypto2-platforms.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'waltid-libraries/crypto/waltid-crypto2/**'
+      - 'waltid-libraries/crypto/waltid-jose/**'
+      - 'waltid-libraries/crypto/waltid-crypto2-*/**'
+      - '.github/workflows/crypto2-platforms.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  linux-jvm-browser:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout all repositories
+        uses: walt-id/waltid-identity/.github/actions/checkout-repos@4296a7f80cacf7e60cb1a20321956768892eb7e3
+        with:
+          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
+          ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
+
+      - name: Configure Gradle
+        uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
+
+      - name: Install browser and SoftHSM
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y softhsm2
+
+      - name: Run JVM, browser, Linux, API, and PKCS11 tests
+        run: >-
+          ./gradlew
+          :waltid-libraries:crypto:waltid-crypto2:jvmTest
+          :waltid-libraries:crypto:waltid-crypto2-kms:jvmTest
+          :waltid-libraries:crypto:waltid-crypto2:jsBrowserTest
+          :waltid-libraries:crypto:waltid-crypto2-kms:jsBrowserTest
+          :waltid-libraries:crypto:waltid-crypto2:linuxX64Test
+          :waltid-libraries:crypto:waltid-crypto2-kms:linuxX64Test
+          :waltid-libraries:crypto:waltid-crypto2-pkcs11:test
+          :waltid-libraries:crypto:waltid-crypto2:checkKotlinAbi
+          :waltid-libraries:crypto:waltid-crypto2:checkTypeScriptDefinitions
+
+      - name: Compile non-host crypto2 targets
+        run: >-
+          ./gradlew
+          :waltid-libraries:crypto:waltid-crypto2:compileTestKotlinLinuxArm64
+          :waltid-libraries:crypto:waltid-crypto2:compileTestKotlinMingwX64
+          :waltid-libraries:crypto:waltid-crypto2:compileTestKotlinMacosX64
+          :waltid-libraries:crypto:waltid-crypto2:compileTestKotlinMacosArm64
+
+  android-host:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout all repositories
+        uses: walt-id/waltid-identity/.github/actions/checkout-repos@4296a7f80cacf7e60cb1a20321956768892eb7e3
+        with:
+          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
+          ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
+
+      - name: Configure Gradle
+        uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
+
+      - name: Run Android host tests
+        run: >-
+          ./gradlew -PenableAndroidBuild=true
+          :waltid-libraries:crypto:waltid-crypto2:testAndroidHostTest
+          :waltid-libraries:crypto:waltid-crypto2-kms:testAndroidHostTest
+          :waltid-libraries:crypto:waltid-crypto2-signum:testAndroidHostTest
+          :waltid-libraries:crypto:waltid-crypto2:checkKotlinAbi
+
+  windows:
+    runs-on: windows-2025
+    steps:
+      - name: Checkout all repositories
+        uses: walt-id/waltid-identity/.github/actions/checkout-repos@4296a7f80cacf7e60cb1a20321956768892eb7e3
+        with:
+          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
+          ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
+
+      - name: Configure Gradle
+        uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
+
+      - name: Run Windows native tests
+        shell: bash
+        run: >-
+          ./gradlew
+          :waltid-libraries:crypto:waltid-crypto2:mingwX64Test
+          :waltid-libraries:crypto:waltid-crypto2-kms:mingwX64Test
+
+  macos-x64:
+    runs-on: macos-15-intel
+    steps:
+      - name: Checkout all repositories
+        uses: walt-id/waltid-identity/.github/actions/checkout-repos@4296a7f80cacf7e60cb1a20321956768892eb7e3
+        with:
+          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
+          ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
+
+      - name: Configure Gradle
+        uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
+
+      - name: Run macOS x64 tests
+        run: >-
+          ./gradlew
+          :waltid-libraries:crypto:waltid-crypto2:macosX64Test
+          :waltid-libraries:crypto:waltid-crypto2-kms:macosX64Test
+
+  macos-arm64-ios:
+    runs-on: macos-26
+    steps:
+      - name: Checkout all repositories
+        uses: walt-id/waltid-identity/.github/actions/checkout-repos@4296a7f80cacf7e60cb1a20321956768892eb7e3
+        with:
+          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
+          ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
+
+      - name: Configure Gradle
+        uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
+
+      - name: Run macOS and iOS simulator tests
+        run: >-
+          ./gradlew -PenableIosBuild=true
+          :waltid-libraries:crypto:waltid-crypto2:macosArm64Test
+          :waltid-libraries:crypto:waltid-crypto2-kms:macosArm64Test
+          :waltid-libraries:crypto:waltid-crypto2:iosSimulatorArm64Test
+          :waltid-libraries:crypto:waltid-crypto2-kms:iosSimulatorArm64Test
+          :waltid-libraries:crypto:waltid-crypto2-signum:iosSimulatorArm64Test

.github/workflows/fix-release.yml

@@ -18,6 +18,7 @@ jobs:
     needs: version
     with:
       version: ${{ needs.version.outputs.release_version }}
+      enable-android-build: true
       publish: true
       report-check-name: 'gradle / gradle (ubuntu-22.04)'
   docker-matrix:

.github/workflows/gradle-macos.yml

@@ -105,7 +105,7 @@ jobs:
         uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@c95b601fc5095d5668eb8c906af992d8e00ed513
 
       - name: Run Compose iOS demo tests
-        timeout-minutes: 25
+        timeout-minutes: 40
         uses: walt-id/waltid-identity/.github/actions/gradle-ios@c95b601fc5095d5668eb8c906af992d8e00ed513
         with:
           waltid-directory: 'waltid-identity'