Fix sharp edges in new modules, add 4 property tests #114
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: -Dwarnings | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y passt nftables | |
| - name: Build | |
| run: cargo build --workspace | |
| - name: Run tests | |
| run: cargo test --workspace | |
| sbom: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Build release | |
| run: cargo build --release --bin gleisner | |
| - name: Generate SBOM | |
| run: cargo run --release --bin gleisner -- sbom --json > sbom.cdx.json | |
| - name: Upload SBOM artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom-cyclonedx | |
| path: sbom.cdx.json | |
| verify-attestations: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Build release | |
| run: cargo build --release --bin gleisner | |
| - name: Verify attestation chain | |
| run: | | |
| LATEST=$(ls -t .gleisner/attestation-*.json 2>/dev/null | head -1) | |
| if [ -n "$LATEST" ]; then | |
| echo "Verifying: $LATEST" | |
| cargo run --release --bin gleisner -- verify "$LATEST" --chain --json | |
| else | |
| echo "No attestation bundles found — skipping verification" | |
| fi | |
| # Verify the keyless (Sigstore) feature compiles. | |
| # Full sandboxed attestation recording requires a Docker-based runner | |
| # with user namespace support — deferred until self-hosted runners. | |
| build-keyless: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Build with Sigstore support | |
| run: cargo build --release --bin gleisner --features keyless | |
| - name: Build TUI with Sigstore support | |
| run: cargo build --release --bin gleisner-tui --features keyless |