Add Python implementation with native Rust module #776

Workflow file for this run

.github/workflows/integration.yml at caa4553

	name: Integration Tests

	on:
	push:
	branches:
	- master
	- main
	pull_request:

	permissions:
	id-token: write
	contents: read

	# Cancel previous runs for PRs but not pushes to main
	concurrency:
	group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref \|\| github.sha }}
	cancel-in-progress: true

	jobs:
	build:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	lang: [go, rust]
	defaults:
	run:
	working-directory: ${{matrix.lang}}
	steps:
	- uses: actions/checkout@v4

	- uses: dtolnay/rust-toolchain@stable
	if: ${{ matrix.lang == 'rust'}}

	- uses: Swatinem/[email protected]
	if: ${{ matrix.lang == 'rust'}}
	with:
	workspaces: ./rust -> target

	- uses: actions/setup-go@v5
	if: ${{ matrix.lang == 'go'}}
	with:
	go-version: ">=1.21.0"
	cache-dependency-path: go/go.sum

	- name: Run build script for compiled languages
	run: "./build.sh"

	- name: Upload built binaries
	uses: actions/upload-artifact@v4
	with:
	name: ${{matrix.lang}}
	path: ${{matrix.lang}}/vault

	tests:
	needs: build
	runs-on: ubuntu-latest
	env:
	# VAULT_STACK overwrites default 'vault' for vaults
	VAULT_STACK: nitor-vault-integration-testing
	# at the moment we store to the values to fixed keys so this needs to have limited concurrency
	concurrency: "integration-test"
	steps:
	- name: Configure AWS Credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	role-to-assume: ${{ secrets.AWS_CI_ROLE }}
	role-session-name: GitHubVaultIntegrationTests
	aws-region: eu-west-1

	- uses: actions/checkout@v4

	- name: Download artifacts
	uses: actions/download-artifact@v4
	with:
	path: bin

	- uses: pnpm/action-setup@v4
	with:
	version: 9

	- uses: actions/setup-node@v4
	with:
	node-version: 20
	cache: "pnpm"
	cache-dependency-path: nodejs/pnpm-lock.yaml

	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	cache: pip

	- name: Install zip
	run: sudo apt-get install zip unzip

	- name: Build node vault
	run: pnpm install --frozen-lockfile && pnpm build
	working-directory: nodejs

	- name: Install Python vault
	run: python -m pip install .
	working-directory: python

	- name: Install Python PyO3 vault
	run: python -m pip install .
	working-directory: python-pyo3

	- name: Add execute rights and run --version for all versions
	run: \|
	chmod +x bin/go/vault bin/rust/vault nodejs/dist/cli/vault.js
	vault --version
	pvault --version
	bin/go/vault --version
	bin/rust/vault --version
	nodejs/dist/cli/vault.js --version

	- name: Check help output
	run: \|
	vault --help
	pvault --help
	bin/go/vault --help
	bin/rust/vault --help
	nodejs/dist/cli/vault.js --help

	- name: Store secret with Python
	run: vault -s 'secret-python' -v 'sha-${{github.sha}}' -w

	- name: Store secret with Python-pyo3
	run: pvault store 'secret-python-pyo3' -v 'sha-${{github.sha}}' -w

	- name: Store secret with Go
	run: bin/go/vault -s 'secret-go' -v 'sha-${{github.sha}}' -w

	- name: Store secret with Rust
	run: bin/rust/vault -s 'secret-rust' -v 'sha-${{github.sha}}' -w

	- name: Store secret with Nodejs
	run: nodejs/dist/cli/vault.js s 'secret-nodejs' 'sha-${{github.sha}}' -w

	- name: Validate storing worked Python
	run: diff <(vault -l secret-python) <(echo -n sha-${{github.sha}})

	- name: Validate storing worked Python-pyo3
	run: diff <(pvault lookup secret-python-pyo3) <(echo -n sha-${{github.sha}})

	- name: Validate Go and Rust secret equality with Python
	run: diff <(vault -l secret-go) <(vault -l secret-rust)

	- name: Validate Go and Rust secret equality with Python-pyo3
	run: diff <(pvault lookup secret-go) <(pvault lookup secret-rust)

	- name: Validate Python secret equality with Rust and Go
	run: diff <(bin/rust/vault -l secret-python) <(bin/go/vault -l secret-python)

	- name: Validate Python-pyo3 secret equality with Rust and Go
	run: diff <(bin/rust/vault -l secret-python-pyo3) <(bin/go/vault -l secret-python-pyo3)

	- name: Validate Rust and Python secret equality with Go and Nodejs
	run: diff <(bin/go/vault -l secret-rust) <(nodejs/dist/cli/vault.js l secret-python)

	- name: Validate Go and Python secret equality with Rust and Go
	run: diff <(bin/rust/vault -l secret-go) <(bin/go/vault -l secret-python)

	- name: Validate Python and Nodejs secret equality with Rust
	run: diff <(bin/rust/vault -l secret-python) <(bin/rust/vault -l secret-nodejs)

	- name: Validate Rust and Go secret equality with Nodejs and Go
	run: diff <(bin/rust/vault -l secret-rust) <(nodejs/dist/cli/vault.js l secret-nodejs)

	- name: Validate Python and Python-pyo3 secret equality with Nodejs
	run: diff <(nodejs/dist/cli/vault.js -l secret-python) <(bin/go/vault -l secret-python-pyo3)

	- name: Delete secret with Python
	run: vault -d 'secret-python'

	- name: Delete secret with Python-pyo3
	run: pvault delete 'secret-python-pyo3'

	- name: Delete secret with Go
	run: bin/go/vault -d 'secret-go'

	- name: Delete secret with Rust
	run: bin/rust/vault -d 'secret-rust'

	- name: Delete secret with Nodejs
	run: nodejs/dist/cli/vault.js d 'secret-nodejs'

	- name: Verify that keys have been deleted using Rust
	run: \|
	bin/rust/vault exists secret-python \| grep -q "key 'secret-python' does not exist"
	bin/rust/vault exists secret-python-pyo3 \| grep -q "key 'secret-python-pyo3' does not exist"
	bin/rust/vault exists secret-go \| grep -q "key 'secret-go' does not exist"
	bin/rust/vault exists secret-rust \| grep -q "key 'secret-rust' does not exist"
	bin/rust/vault exists secret-nodejs \| grep -q "key 'secret-nodejs' does not exist"

	- name: Verify that keys have been deleted using Python-pyo3
	run: \|
	pvault exists secret-python \| grep -q "key 'secret-python' does not exist"
	pvault exists secret-python-pyo3 \| grep -q "key 'secret-python-pyo3' does not exist"
	pvault exists secret-go \| grep -q "key 'secret-go' does not exist"
	pvault exists secret-rust \| grep -q "key 'secret-rust' does not exist"
	pvault exists secret-nodejs \| grep -q "key 'secret-nodejs' does not exist"

	- name: Create dummy text file
	run: echo "Vault test ${{ github.sha }} ${{ github.ref_name }}" > test.txt

	- name: Zip the text file
	run: zip "secret-${{github.sha}}.zip" test.txt

	- name: Store zip file using Python
	run: vault --store --file "secret-${{github.sha}}.zip"

	- name: Lookup the stored zip file and write to output
	run: vault -l "secret-${{github.sha}}.zip" > output-python.zip

	- name: Extract the retrieved zip file
	run: unzip output-python.zip -d extracted-python

	- name: Verify the extracted file content
	run: diff extracted-python/test.txt test.txt

	- name: Delete secret with Python
	run: vault -d "secret-${{github.sha}}.zip"

	- name: Verify that key has been deleted with Rust
	run: bin/rust/vault exists secret-${{github.sha}}.zip \| grep -q "does not exist"

	- name: Store zip file using Python-pyo3
	run: pvault store --file "secret-${{github.sha}}.zip"

	- name: Lookup the stored zip file and write to output
	run: pvault lookup "secret-${{github.sha}}.zip" > output-python-pyo3.zip

	- name: Extract the retrieved zip file
	run: unzip output-python-pyo3.zip -d extracted-python-pyo3

	- name: Verify the extracted file content
	run: diff extracted-python-pyo3/test.txt test.txt

	- name: Delete secret with Python-pyo3
	run: pvault delete "secret-${{github.sha}}.zip"

	- name: Verify that key has been deleted with Rust
	run: bin/rust/vault exists secret-${{github.sha}}.zip \| grep -q "does not exist"

	- name: Verify that key has been deleted with Python-pyo3
	run: pvault exists secret-${{github.sha}}.zip \| grep -q "does not exist"

	- name: Store zip file using Rust vault
	run: bin/rust/vault --store --file "secret-${{github.sha}}.zip"

	- name: Lookup the stored zip file and write to output
	run: bin/rust/vault -l "secret-${{github.sha}}.zip" > output-rust.zip

	- name: Extract the retrieved zip file
	run: unzip output-rust.zip -d extracted-rust

	- name: Verify the extracted file content
	run: diff extracted-rust/test.txt test.txt

	- name: Delete secret with Rust
	run: bin/rust/vault -d "secret-${{github.sha}}.zip"

	- name: Verify that key has been deleted with Rust
	run: bin/rust/vault exists secret-${{github.sha}}.zip \| grep -q "does not exist"

	- name: Verify that keys have been deleted using Rust
	run: \|
	bin/rust/vault exists secret-python \| grep -q "key 'secret-python' does not exist"
	bin/rust/vault exists secret-python-pyo3 \| grep -q "key 'secret-python-pyo3' does not exist"
	bin/rust/vault exists secret-go \| grep -q "key 'secret-go' does not exist"
	bin/rust/vault exists secret-rust \| grep -q "key 'secret-rust' does not exist"
	bin/rust/vault exists secret-nodejs \| grep -q "key 'secret-nodejs' does not exist"

	- name: Verify that keys have been deleted using Python-pyo3
	run: \|
	pvault exists secret-python \| grep -q "key 'secret-python' does not exist"
	pvault exists secret-python-pyo3 \| grep -q "key 'secret-python-pyo3' does not exist"
	pvault exists secret-go \| grep -q "key 'secret-go' does not exist"
	pvault exists secret-rust \| grep -q "key 'secret-rust' does not exist"
	pvault exists secret-nodejs \| grep -q "key 'secret-nodejs' does not exist"

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Python implementation with native Rust module #776

Workflow file

Add Python implementation with native Rust module #776

Jobs

Run details

Workflow file for this run