firma: wrap helpers instead of spilling columns #673
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: demo-e2e | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| demo-ci: | |
| name: make demo-ci | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| submodules: recursive | |
| persist-credentials: false | |
| - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1 | |
| with: | |
| rustflags: "" | |
| - name: Load tool versions | |
| shell: bash | |
| run: grep -E '^[A-Z0-9_]+=' tool-versions.env >> "$GITHUB_ENV" | |
| - name: Install protoc | |
| uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0 | |
| with: | |
| version: ${{ env.PROTOC_VERSION }} | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install jq + netcat | |
| run: sudo apt-get install -y jq netcat-openbsd | |
| - name: Build release binaries | |
| run: cargo build --release -p firma -p firma-demo-fixture | |
| - name: Run demo CI driver | |
| run: timeout 90 make demo-ci | |
| - name: Assert audit ALLOW + DENY events | |
| run: | | |
| set -euo pipefail | |
| log="examples/demo/logs/sidecar.log" | |
| test -s "$log" || (echo "missing $log" >&2; exit 1) | |
| # Audit events are JSON-lines on stdout; decision field is | |
| # 1 = Allow, 2 = Deny (see audit/sink/stdout.rs). | |
| allow=$(grep -c '"decision":1' "$log" || true) | |
| deny=$(grep -c '"decision":2' "$log" || true) | |
| echo "allow_events=$allow deny_events=$deny" | |
| # firma-demo-fixture-client fires exactly one /allow + one /deny; | |
| # any other count means the demo deviated from its contract | |
| # (extra requests, retries, or a regression that lets a request | |
| # through with a different decision) — fail closed. | |
| test "$allow" -eq 1 || (echo "expected exactly 1 ALLOW audit event, got $allow" >&2; exit 1) | |
| test "$deny" -eq 1 || (echo "expected exactly 1 DENY audit event, got $deny" >&2; exit 1) | |
| - name: Upload demo logs | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: demo-logs | |
| path: examples/demo/logs/ |