Skip to content

[cryptography/stream] Version SAKE and bind identities before signing #29961

[cryptography/stream] Version SAKE and bind identities before signing

[cryptography/stream] Version SAKE and bind identities before signing #29961

Workflow file for this run

name: Fast
on:
push:
branches: [ "main" ]
pull_request:
merge_group:
permissions:
contents: read
concurrency:
group: tests-fast-${{ github.head_ref || github.ref_name || github.run_id }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
env:
CARGO_TERM_COLOR: always
CARGO_COOLDOWN_VERSION: 0.3.4
UDEPS_VERSION: 0.1.57
NIGHTLY_VERSION: nightly-2026-06-21
PANDOC_VERSION: 3.8.2.1
jobs:
Lint:
runs-on: ${{ matrix.os }}
timeout-minutes: 30
strategy:
matrix:
include:
- os: ubuntu-latest
flags: "--features commonware-runtime/iouring"
- os: ubuntu-latest
flags: ""
- os: macos-latest
flags: ""
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
components: clippy
additional-toolchain: ${{ env.NIGHTLY_VERSION }}
additional-components: ${{ matrix.os == 'ubuntu-latest' && matrix.flags == '' && 'rustfmt,rustc-dev,llvm-tools-preview' || 'rustfmt' }}
additional-cache-key: ${{ matrix.flags || 'default' }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0
- name: Install Dylint
if: matrix.os == 'ubuntu-latest' && matrix.flags == ''
run: |
cargo install cargo-dylint --version 6.0.0 --locked
cargo install dylint-link --version 6.0.0 --locked
- name: Fmt
run: just check-fmt
- name: Lint
run: just clippy ${{ matrix.flags }}
- name: Dylint
if: matrix.os == 'ubuntu-latest' && matrix.flags == ''
run: just dylint
- name: Check docs
run: just check-docs ${{ matrix.flags }}
- name: Test docs
run: just test-docs ${{ matrix.flags }}
Lint-Gate:
name: "Lints"
runs-on: ubuntu-latest
needs: [Lint, lint-toml, zepter]
if: always()
steps:
- name: Checkout swap action
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
with:
sparse-checkout: .github/actions/swap
- name: Configure swap
uses: ./.github/actions/swap
- name: Check lint results
run: |
if [ "${{ needs.Lint.result }}" != "success" ]; then
echo "Lint failed"
exit 1
fi
if [ "${{ needs.lint-toml.result }}" != "success" ]; then
echo "lint-toml failed"
exit 1
fi
if [ "${{ needs.zepter.result }}" != "success" ]; then
echo "zepter failed"
exit 1
fi
echo "All lints passed!"
Tests:
name: "Tests (os: ${{ matrix.os }}${{ matrix.flags && format(', flags: \"{0}\"', matrix.flags) }}) (partition: ${{ matrix.partition }}/2)"
runs-on: ${{ matrix.os }}
timeout-minutes: 60
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
partition: [1, 2]
flags:
- "--features commonware-runtime/iouring"
- "--no-default-features"
- ""
exclude:
# Only run io_uring features on Ubuntu
- os: macos-latest
flags: "--features commonware-runtime/iouring"
# Only run --no-default-features on Ubuntu
- os: macos-latest
flags: "--no-default-features"
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Clear disk space
uses: ./.github/actions/disk
- name: Run setup
uses: ./.github/actions/setup
with:
additional-cache-key: ${{ matrix.flags || 'default' }}
rust-cache-save: ${{ matrix.partition == 1 }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just & nextest
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0,cargo-nextest@0.9.133
- name: Run tests
run: just test ${{ matrix.flags }} --partition hash:${{matrix.partition}}/2 --verbose
Tests-Subset:
name: "Tests-Subset (os: ${{ matrix.os }}, package: ${{ matrix.package }}, flags: \"${{ matrix.flags }}\")"
runs-on: ${{ matrix.os }}
timeout-minutes: 60
strategy:
matrix:
include:
- os: ubuntu-latest
package: commonware-runtime
flags: "--features commonware-runtime/external"
- os: macos-latest
package: commonware-runtime
flags: "--features commonware-runtime/external"
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
additional-cache-key: ${{ matrix.flags || 'default' }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just & nextest
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0,cargo-nextest@0.9.133
- name: Run subset tests
run: just test ${{ matrix.flags }} -p ${{ matrix.package }} --verbose
- name: Run subset doc tests
run: just test-docs ${{ matrix.flags }} -p ${{ matrix.package }}
Stability:
name: "Stability (${{ matrix.level }})"
runs-on: ubuntu-latest
timeout-minutes: 30
strategy:
matrix:
level: [BETA, GAMMA, DELTA, EPSILON]
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Clear disk space
uses: ./.github/actions/disk
- name: Run setup
uses: ./.github/actions/setup
with:
additional-cache-key: ${{ matrix.level }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0
- name: Check stability (${{ matrix.level }})
run: just check-stability ${{ matrix.level }}
Unstable-Public:
name: "Unstable Public"
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Clear disk space
uses: ./.github/actions/disk
- name: Run setup
uses: ./.github/actions/setup
with:
additional-toolchain: ${{ env.NIGHTLY_VERSION }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0
- name: Check for unmarked public items
run: just unstable-public
Tests-Gate:
name: "Fast-Tests"
runs-on: ubuntu-latest
needs: [Tests, Tests-Subset, Stability, Unstable-Public]
if: always()
steps:
- name: Checkout swap action
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
with:
sparse-checkout: .github/actions/swap
- name: Configure swap
uses: ./.github/actions/swap
- name: Check test results
run: |
if [ "${{ needs.Tests.result }}" != "success" ]; then
echo "Tests failed"
exit 1
fi
if [ "${{ needs.Tests-Subset.result }}" != "success" ]; then
echo "Tests-Subset failed"
exit 1
fi
if [ "${{ needs.Stability.result }}" != "success" ]; then
echo "Stability checks failed"
exit 1
fi
if [ "${{ needs.Unstable-Public.result }}" != "success" ]; then
echo "Unstable-Public check failed"
exit 1
fi
echo "All tests passed!"
Dependencies:
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
additional-toolchain: ${{ env.NIGHTLY_VERSION }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just & cargo-udeps
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0,cargo-udeps@${{ env.UDEPS_VERSION }}
- name: Check for unused dependencies
run: just udeps
Cooldown:
if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
rust-cache-enabled: false
- name: Install just & cargo-cooldown
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0,cargo-cooldown@${{ env.CARGO_COOLDOWN_VERSION }}
- name: Check dependency cooldown
env:
COOLDOWN_BASE_REF: ${{ github.event.pull_request.base.ref }}
run: just cooldown
Lock:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Clear disk space
uses: ./.github/actions/disk
- name: Run setup
uses: ./.github/actions/setup
with:
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Build entire workspace
run: cargo build --workspace --all-targets
- name: Check Cargo.lock unchanged
run: |
if ! git diff --exit-code Cargo.lock; then
echo "ERROR: Cargo.lock was modified during build!"
echo "This suggests that the Cargo.lock file in the repository is not up to date."
echo "Please run 'cargo build' locally and commit the updated Cargo.lock."
exit 1
fi
echo "✓ Cargo.lock remained unchanged after building everything"
Docs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Install pandoc
run: |
wget -q https://github.com/jgm/pandoc/releases/download/${{ env.PANDOC_VERSION }}/pandoc-${{ env.PANDOC_VERSION }}-1-amd64.deb
sudo dpkg -i pandoc-${{ env.PANDOC_VERSION }}-1-amd64.deb || sudo apt-get install -f -y
rm pandoc-${{ env.PANDOC_VERSION }}-1-amd64.deb
- name: Build docs
run: cd docs && make
- name: Check docs unchanged
run: |
if ! git diff --exit-code docs/; then
echo "ERROR: Generated docs assets (HTML or sitemap) were modified during build!"
echo "This suggests that the generated files in docs/ are not up to date."
echo "Please run 'make' in the docs directory locally and commit the updated files."
exit 1
fi
echo "✓ Generated docs assets remained unchanged after running make"
WASM:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
targets: wasm32-unknown-unknown
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Build cryptography
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path cryptography/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_cryptography.wasm"
- name: Build cryptography-curve25519
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path cryptography/curve25519/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_cryptography_curve25519.wasm"
- name: Build macros
run: cargo build --target wasm32-unknown-unknown --release --manifest-path macros/Cargo.toml # can't check size because it is a proc-macro
- name: Build math
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path math/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_math.wasm"
- name: Build utils
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path utils/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_utils.wasm"
- name: Build runtime
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path runtime/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_runtime.wasm"
- name: Build consensus
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path consensus/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_consensus.wasm"
- name: Build storage
run: cargo rustc --target wasm32-unknown-unknown --release --manifest-path storage/Cargo.toml --crate-type cdylib && du -h "${CARGO_TARGET_DIR:-target}/wasm32-unknown-unknown/release/commonware_storage.wasm"
no_std:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
rust-cache-enabled: false
- name: Check no_std compatibility
run: ./.github/scripts/check_no_std.sh
lint-toml:
name: Lint Cargo.toml Files
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Install just
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0
- name: Install UV
uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
- name: Check Cargo.toml formatting
run: just fix-toml-fmt && git diff --exit-code
publish-order:
name: Check Publish Order
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Run setup
uses: ./.github/actions/setup
with:
rust-cache-enabled: false
- name: Check publish order
run: python3 .github/scripts/check_publish_order.py
zepter:
name: Feature Propagation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
with:
submodules: true
- name: Configure swap
uses: ./.github/actions/swap
- name: Install zepter
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: zepter@1.85.0
- name: Format features
run: zepter format features
- name: Lint feature propagation
run: zepter run check
build:
name: "Build (toolchain: ${{ matrix.toolchain }}, partition: ${{ matrix.partition.name }})"
runs-on: ubuntu-latest
timeout-minutes: 120
strategy:
fail-fast: false
matrix:
toolchain:
- msrv
- stable
- nightly
# commonware-runtime dominates the feature powerset (~80% of all
# combinations), so it is split into four partitions that fix the
# loom and tokio-console features on or off and enumerate the
# powerset of the remaining features. The union of the runtime
# partitions and `rest` (every other crate) is identical to the
# full workspace powerset (`just hack check`).
partition:
- name: runtime-0
args: -p commonware-runtime --features loom,tokio-console
- name: runtime-1
args: -p commonware-runtime --features loom --exclude-features tokio-console
- name: runtime-2
args: -p commonware-runtime --features tokio-console --exclude-features loom
- name: runtime-3
args: -p commonware-runtime --exclude-features loom,tokio-console
- name: rest
args: --workspace --exclude commonware-runtime
steps:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
- name: Configure swap
uses: ./.github/actions/swap
- name: Clear disk space
uses: ./.github/actions/disk
- name: Determine toolchain version
id: toolchain
run: |
if [ "${{ matrix.toolchain }}" = "msrv" ]; then
echo "version=$(grep -m1 '^rust-version' Cargo.toml | sed 's/.*"\(.*\)"/\1/')" >> "$GITHUB_OUTPUT"
else
echo "version=${{ matrix.toolchain }}" >> "$GITHUB_OUTPUT"
fi
- name: Run setup
uses: ./.github/actions/setup
with:
toolchain: ${{ steps.toolchain.outputs.version }}
rust-cache-save: ${{ matrix.partition.name == 'rest' }}
sccache-r2-bucket: ${{ secrets.SCCACHE_R2_BUCKET }}
sccache-r2-endpoint: ${{ secrets.SCCACHE_R2_ENDPOINT }}
sccache-r2-access-key-id: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
sccache-r2-secret-access-key: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}
- name: Install just & cargo-hack
uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
with:
tool: just@1.43.0,cargo-hack@0.6.43
- name: Print Rust version
run: rustc --version
- name: Check feature powerset
run: RUSTFLAGS="-D warnings" just hack ${{ matrix.partition.args }} check
Build-Gate:
name: "Builds"
runs-on: ubuntu-latest
needs: build
if: always()
steps:
- name: Checkout swap action
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
with:
sparse-checkout: .github/actions/swap
- name: Configure swap
uses: ./.github/actions/swap
- name: Check build results
run: |
if [ "${{ needs.build.result }}" != "success" ]; then
echo "Builds failed or were cancelled"
exit 1
fi
echo "All builds passed successfully!"