Repository navigation
fix(TC-887): refresh the w5 lockfile and check separate workspace lockfiles in CI - #332
Merged
Merged
Conversation
…kfiles in CI test/w5-policy-runtime-node-e2e/Cargo.lock lacked tinycloud-core's new aes, hkdf and zeroize dependencies and the aes/aes-gcm zeroize features (#320, #322), so cargo --locked failed there. Regenerated minimally. CI built only the main workspace and m1-realdata-e2e. A new lockfiles job resolves every fetchable workspace with --locked and runs scripts/ci/check-separate-lockfiles.py, which checks the w5 lockfile (its private git dependency is not fetchable in CI) for in-repo crates' direct dependencies and requested dependency features.
Contributor
Author
|
REQUEST_CHANGES: see TC-887 (head 341d861) |
Keep the w5 lockfile fix and the --locked resolves of main, m1 and test/load/signer. w5 coverage follows separately with real cargo.
Contributor
Author
|
APPROVE: see TC-887 (head ae6d4d9) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of TC-887 (encryption at rest). This fixes
cargo … --lockedin the separate w5 workspace on main, and makes CI resolve the separate workspaces it can fetch with--locked.What changed
test/w5-policy-runtime-node-e2e/Cargo.lock: thetinycloud-coreentry gains theaes,hkdfandzeroizedependencies, andaes/aes-gcmgainzeroize. These are the dependencies and features feat(TC-887): at_rest data key types and DataKeyProvider trait #320/feat(TC-887): TCE1 segmented AES-256-GCM envelope #322 added to tinycloud-core. The lock was regenerated by cargo's minimal resolve: 5 added lines, no version changes.cargo update -p tinycloud-corewould also have re-picked unrelatedsyn/socket2/windows-sysedges, so it wasn't used.lockfiles(.github/workflows/rust.yml): runscargo metadata --lockedfor main,test/m1-realdata-e2eandtest/load/signer. The comment above the m1 job now records that w5's lockfile still isn't checked in CI, because its privatepolicy-enginegit dependency can't be fetched there. That coverage follows in a separate PR.Why CI missed it
The workspace jobs build only the main workspace, and
m1-realdatacoverstest/m1-realdata-e2e.test/w5-policy-runtime-node-e2ehas no CI job because of its private git dependency, andtest/load/signerhad none either. #320/#322 refreshed the main and m1 lockfiles but not w5.How it's tested
cargo metadata --lockedpasses for main, m1, w5 and load/signer.cargo tree --locked -e normal,features -p tinycloud-coreshows the sameaes,aes-gcm,hkdf,hmacandzeroizefeature lines for w5 and m1 as for main. The only main-only lines are pre-existingbase45/multibaseversions and main'sslabpatch.