docs: add Vault SecretProvider requirements spec (Use Case A) #406
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # =============================================================== | |
| # CI - Rust lint, test, examples, and docs gate | |
| # =============================================================== | |
| name: CI | |
| on: | |
| push: | |
| branches: ["main", "dev"] | |
| pull_request: | |
| types: [opened, synchronize, ready_for_review] | |
| branches: ["main", "dev"] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: "-D warnings" | |
| jobs: | |
| lint: | |
| name: Lint (fmt + clippy) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Install Rust 1.96.0 | |
| uses: dtolnay/rust-toolchain@1.96.0 | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: rustfmt | |
| run: cargo fmt --all -- --check | |
| - name: clippy | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| unused-deps: | |
| name: Unused deps (advisory) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Advisory only: cargo-machete static analysis false-positives on | |
| # macro/derive-only crates (thiserror, tracing, serde, async-trait). Surfaced | |
| # as a non-blocking signal until the reports are triaged in a follow-up. | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Install cargo-machete | |
| run: cargo install cargo-machete --locked | |
| - run: cargo machete | |
| test: | |
| name: Test (workspace) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Install Rust 1.96.0 | |
| uses: dtolnay/rust-toolchain@1.96.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: cargo test | |
| # Valkey/testcontainers integration tests are `#[ignore]`d by default | |
| # and run out-of-band, so this needs no Docker daemon. The Python host | |
| # e2e tests are also `#[ignore]`d here — the `python-e2e` job below runs | |
| # them with a real interpreter and framework checkout. | |
| run: cargo test --workspace | |
| # The Python host's end-to-end tests, actually run. | |
| # | |
| # These are `#[ignore]`d so the workspace job reports them as ignored rather | |
| # than passing bodies that never executed. This job builds the environment they | |
| # need and sets CPEX_REQUIRE_PYTHON_E2E=1, under which an unmet prerequisite | |
| # panics instead of skipping. So a missing interpreter or a stale worker.py | |
| # fails this job loudly — it cannot go quiet and still report green. | |
| python-e2e: | |
| name: Python host e2e (skips fail) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| # The Python framework lives on its own branch, and PyPI's `cpex` is behind | |
| # it (its worker.py predates the credential and extensions fields). The | |
| # *stable* 0.1.x branch is not enough either: it carries no | |
| # cpex/framework/isolated/worker.py at all. The companion branch below is | |
| # the one whose worker.py both consumes `credential` and delivers | |
| # `extensions=` to execute_plugin, which is what these tests gate on. | |
| # | |
| # This is a cross-branch dependency: when the Python side merges, retarget | |
| # this ref. Until then a wrong ref fails loudly (skips are errors here) | |
| # rather than silently skipping — which is the whole point of this job. | |
| - name: Checkout the cpex Python framework | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: "0.1.x" | |
| path: cpex-python | |
| fetch-depth: 1 | |
| - name: Install Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install Rust 1.96.0 | |
| uses: dtolnay/rust-toolchain@1.96.0 | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: make test-python-e2e | |
| env: | |
| CPEX_PYTHON_SOURCE: ${{ github.workspace }}/cpex-python | |
| run: make test-python-e2e | |
| examples: | |
| name: Examples build (Rust + Go FFI) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Install Rust 1.96.0 | |
| uses: dtolnay/rust-toolchain@1.96.0 | |
| - name: Install Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.25.4" | |
| - uses: Swatinem/rust-cache@v2 | |
| # Builds every Rust example plus the Go demo (which links the release | |
| # cpex-ffi cdylib) — the cheapest guard against stale public-API usage. | |
| - name: make examples-build | |
| run: make examples-build | |
| package: | |
| name: Package (publish dry-run) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - name: Install Rust 1.96.0 | |
| uses: dtolnay/rust-toolchain@1.96.0 | |
| # NOTE: intentionally NO Swatinem/rust-cache here, AND we wipe the registry | |
| # index before packaging. The committed Cargo.lock is byte-identical to a | |
| # fresh x86_64 resolution (verified in an amd64 container), so the lock is | |
| # not the problem. The failure comes from stale `~/.cargo/registry` state | |
| # the hosted runner carries: under the sparse protocol `cargo package | |
| # --locked` consults that partial local index, decides it can't satisfy the | |
| # committed lock, and aborts with "cannot update the lock file ... --locked" | |
| # ~1.4s in (too fast for a real network fetch). Removing the index forces a | |
| # clean fetch, against which Cargo.lock resolves cleanly — keeping this | |
| # dry-run deterministic. | |
| # Continuous dry-run of the crates.io release: build + verify a .crate for | |
| # every publishable member without uploading. Catches publishability | |
| # regressions (missing version reqs, packaging-excluded files, broken | |
| # inter-crate deps) on every push/PR, long before a release tag. Mirrors | |
| # `make publish-dry` and the release workflow's dry-run. The | |
| # `publish = false` crates are excluded (not part of the registry set): | |
| # the two FFI crates and the tutorial companion crate. | |
| - name: cargo package (no upload) | |
| run: | | |
| # Drop any pre-seeded registry index/cache so cargo fetches fresh and | |
| # --locked resolves against a clean index (see note above). | |
| rm -rf ~/.cargo/registry/index ~/.cargo/registry/cache | |
| cargo package --workspace --locked --exclude cpex-ffi --exclude cpex-demo-ffi --exclude cpex-tutorial | |
| docs: | |
| name: Docs Build | |
| uses: ./.github/workflows/docs-build.yaml |