Add Python implementation with native Rust module #763
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Integration Tests | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - main | |
| pull_request: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| # Cancel previous runs for PRs but not pushes to main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| lang: [go, rust] | |
| defaults: | |
| run: | |
| working-directory: ${{matrix.lang}} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| if: ${{ matrix.lang == 'rust'}} | |
| - uses: Swatinem/[email protected] | |
| if: ${{ matrix.lang == 'rust'}} | |
| with: | |
| workspaces: ./rust -> target | |
| - uses: actions/setup-go@v5 | |
| if: ${{ matrix.lang == 'go'}} | |
| with: | |
| go-version: ">=1.21.0" | |
| cache-dependency-path: go/go.sum | |
| - name: Run build script for compiled languages | |
| run: "./build.sh" | |
| - name: Upload built binaries | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{matrix.lang}} | |
| path: ${{matrix.lang}}/vault | |
| tests: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| env: | |
| # VAULT_STACK overwrites default 'vault' for vaults | |
| VAULT_STACK: nitor-vault-integration-testing | |
| # at the moment we store to the values to fixed keys so this needs to have limited concurrency | |
| concurrency: "integration-test" | |
| steps: | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_CI_ROLE }} | |
| role-session-name: GitHubVaultIntegrationTests | |
| aws-region: eu-west-1 | |
| - uses: actions/checkout@v4 | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: bin | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: "pnpm" | |
| cache-dependency-path: nodejs/pnpm-lock.yaml | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install zip | |
| run: sudo apt-get install zip unzip | |
| - name: Build node vault | |
| run: pnpm install --frozen-lockfile && pnpm build | |
| working-directory: nodejs | |
| - name: Install Python vault | |
| run: python -m pip install . | |
| working-directory: python | |
| - name: Add execute rights and run --version for all versions | |
| run: | | |
| chmod +x bin/go/vault bin/rust/vault nodejs/dist/cli/vault.js | |
| vault --version | |
| bin/go/vault --version | |
| bin/rust/vault --version | |
| nodejs/dist/cli/vault.js --version | |
| - name: Store secret with Python | |
| run: vault -s 'secret-python' -v 'sha-${{github.sha}}' -w | |
| - name: Store secret with Go | |
| run: bin/go/vault -s 'secret-go' -v 'sha-${{github.sha}}' -w | |
| - name: Store secret with Rust | |
| run: bin/rust/vault -s 'secret-rust' -v 'sha-${{github.sha}}' -w | |
| - name: Store secret with Nodejs | |
| run: nodejs/dist/cli/vault.js s 'secret-nodejs' 'sha-${{github.sha}}' -w | |
| - name: Validate storing worked Python | |
| run: diff <(vault -l secret-python) <(echo -n sha-${{github.sha}}) | |
| - name: Validate Go and Rust secret equality with Python | |
| run: diff <(vault -l secret-go) <(vault -l secret-rust) | |
| - name: Validate Python and Rust secret equality with Go and Nodejs | |
| run: diff <(bin/go/vault -l secret-rust) <(nodejs/dist/cli/vault.js l secret-python) | |
| - name: Validate Go and Python secret equality with Rust and Go | |
| run: diff <(bin/rust/vault -l secret-go) <(bin/go/vault -l secret-python) | |
| - name: Validate Python and Nodejs secret equality with Rust | |
| run: diff <(bin/rust/vault -l secret-python) <(bin/rust/vault -l secret-nodejs) | |
| - name: Validate Rust and Go secret equality with Nodejs | |
| run: diff <(bin/rust/vault -l secret-rust) <(nodejs/dist/cli/vault.js l secret-nodejs) | |
| - name: Delete secret with Python | |
| run: vault -d 'secret-python' | |
| - name: Delete secret with Go | |
| run: bin/go/vault -d 'secret-go' | |
| - name: Delete secret with Rust | |
| run: bin/rust/vault -d 'secret-rust' | |
| - name: Delete secret with Nodejs | |
| run: nodejs/dist/cli/vault.js d 'secret-nodejs' | |
| - name: Verify that keys have been deleted using Rust | |
| run: | | |
| bin/rust/vault exists secret-go | grep -q "key 'secret-go' does not exist" | |
| bin/rust/vault exists secret-nodejs | grep -q "key 'secret-nodejs' does not exist" | |
| bin/rust/vault exists secret-python | grep -q "key 'secret-python' does not exist" | |
| bin/rust/vault exists secret-rust | grep -q "key 'secret-rust' does not exist" | |
| - name: Create dummy text file | |
| run: echo "Vault test ${{ github.sha }} ${{ github.ref_name }}" > test.txt | |
| - name: Zip the text file | |
| run: zip "secret-${{github.sha}}.zip" test.txt | |
| - name: Store zip file using Python | |
| run: vault --store --file "secret-${{github.sha}}.zip" | |
| - name: Lookup the stored zip file and write to output | |
| run: vault -l "secret-${{github.sha}}.zip" > output-python.zip | |
| - name: Extract the retrieved zip file | |
| run: unzip output-python.zip -d extracted-python | |
| - name: Verify the extracted file content | |
| run: diff extracted-python/test.txt test.txt | |
| - name: Delete secret with Python | |
| run: vault -d "secret-${{github.sha}}.zip" | |
| - name: Verify that key has been deleted with Rust | |
| run: bin/rust/vault exists secret-${{github.sha}}.zip | grep -q "does not exist" | |
| - name: Store zip file using Rust vault | |
| run: bin/rust/vault --store --file "secret-${{github.sha}}.zip" | |
| - name: Lookup the stored zip file and write to output | |
| run: bin/rust/vault -l "secret-${{github.sha}}.zip" > output-rust.zip | |
| - name: Extract the retrieved zip file | |
| run: unzip output-rust.zip -d extracted-rust | |
| - name: Verify the extracted file content | |
| run: diff extracted-rust/test.txt test.txt | |
| - name: Delete secret with Rust | |
| run: bin/rust/vault -d "secret-${{github.sha}}.zip" | |
| - name: Verify that key has been deleted with Rust | |
| run: bin/rust/vault exists secret-${{github.sha}}.zip | grep -q "does not exist" | |
| - name: Install Python PyO3 vault | |
| run: python -m pip install --upgrade . | |
| working-directory: python-pyo3 | |
| - name: Check version | |
| run: vault --version | |
| - name: Store secret with Python-pyo3 | |
| run: vault store 'secret-python-pyo3' -v 'sha-${{github.sha}}' -w | |
| - name: Validate storing worked Python-pyo3 | |
| run: diff <(vault lookup secret-python-pyo3) <(echo -n sha-${{github.sha}}) | |
| - name: Validate Python-pyo3 secret equality with Rust and Go | |
| run: diff <(bin/rust/vault -l secret-python-pyo3) <(bin/go/vault -l secret-python-pyo3) | |
| - name: Store secret with Go | |
| run: bin/go/vault -s 'secret-go' -v 'sha-${{github.sha}}' -w | |
| - name: Store secret with Rust | |
| run: bin/rust/vault -s 'secret-rust' -v 'sha-${{github.sha}}' -w | |
| - name: Validate Go and Rust secret equality with Python-pyo3 | |
| run: diff <(vault lookup secret-go) <(vault lookup secret-rust) | |
| - name: Delete secret with Python-pyo3 | |
| run: vault delete 'secret-python-pyo3' | |
| - name: Delete secret with Python-pyo3 | |
| run: vault delete 'secret-go' | |
| - name: Delete secret with Python-pyo3 | |
| run: vault delete 'secret-rust' | |
| - name: Verify that keys have been deleted using Rust | |
| run: | | |
| bin/rust/vault exists secret-go | grep -q "key 'secret-go' does not exist" | |
| bin/rust/vault exists secret-nodejs | grep -q "key 'secret-nodejs' does not exist" | |
| bin/rust/vault exists secret-python | grep -q "key 'secret-python' does not exist" | |
| bin/rust/vault exists secret-python-pyo3 | grep -q "key 'secret-python-pyo3' does not exist" | |
| bin/rust/vault exists secret-rust | grep -q "key 'secret-rust' does not exist" | |
| - name: Verify that keys have been deleted using Python-pyo3 | |
| run: | | |
| vault exists secret-go | grep -q "key 'secret-go' does not exist" | |
| vault exists secret-nodejs | grep -q "key 'secret-nodejs' does not exist" | |
| vault exists secret-python | grep -q "key 'secret-python' does not exist" | |
| vault exists secret-python-pyo3 | grep -q "key 'secret-python-pyo3' does not exist" | |
| vault exists secret-rust | grep -q "key 'secret-rust' does not exist" | |
| - name: Store zip file using Python-pyo3 | |
| run: vault store --file "secret-${{github.sha}}.zip" | |
| - name: Lookup the stored zip file and write to output | |
| run: vault lookup "secret-${{github.sha}}.zip" > output-python-pyo3.zip | |
| - name: Extract the retrieved zip file | |
| run: unzip output-python-pyo3.zip -d extracted-python-pyo3 | |
| - name: Verify the extracted file content | |
| run: diff extracted-python-pyo3/test.txt test.txt | |
| - name: Delete secret with Python-pyo3 | |
| run: vault delete "secret-${{github.sha}}.zip" | |
| - name: Verify that key has been deleted with Rust | |
| run: bin/rust/vault exists secret-${{github.sha}}.zip | grep -q "does not exist" | |
| - name: Verify that key has been deleted with Python-pyo3 | |
| run: vault exists secret-${{github.sha}}.zip | grep -q "does not exist" |