Merge branch 'main' into ww/explicitcurve

.github/actions/run-harnesses/action.yml

@@ -0,0 +1,51 @@
+name: run harnesses
+description: Run x509-limbo's in-repo harnesses and cache their results
+outputs:
+  cache-hit:
+    description: "Whether or not the cache was hit"
+    value: "${{ steps.restore-cache.outputs.cache-hit }}"
+
+runs:
+  using: composite
+
+  steps:
+    # This action assumes that actions/checkout has run, leaving limbo.json
+    # in place for the cache check.
+
+    # NOTE: We generate the cache key upfront like this because the `harness/`
+    # subdirectory is not static: a cache miss means that builds will happen
+    # under it, changing its hash between the action's start and end.
+    - name: Compute cache key
+      id: compute-cache-key
+      shell: bash
+      run: |
+        echo "HARNESS_CACHE_KEY=limbo-harness-${LIMBO_CACHE_KEY}" >> "${GITHUB_OUTPUT}"
+      env:
+        LIMBO_CACHE_KEY: ${{ hashFiles('Makefile', 'limbo.json', 'harness/**') }}
+
+    - uses: actions/cache/restore@v4
+      id: restore-cache
+      with:
+        key: ${{ steps.compute-cache-key.outputs.HARNESS_CACHE_KEY }}
+        path: results
+
+    - uses: actions/setup-go@v5
+      if: steps.restore-cache.outputs.cache-hit != 'true'
+      with:
+        go-version: ">=1.20.5"
+
+    - name: setup limbo
+      shell: bash
+      if: steps.restore-cache.outputs.cache-hit != 'true'
+      run: make dev
+
+    - name: run harnesses
+      shell: bash
+      if: steps.restore-cache.outputs.cache-hit != 'true'
+      run: make test -j
+
+    - uses: actions/cache/save@v4
+      if: steps.restore-cache.outputs.cache-hit != 'true'
+      with:
+        key: ${{ steps.compute-cache-key.outputs.HARNESS_CACHE_KEY }}
+        path: results

.github/workflows/ci.yml

@@ -32,13 +32,21 @@ jobs:
           cache: "pip"
           cache-dependency-path: pyproject.toml
 
-      - name: regenerate schema
-        run: make limbo-schema.json
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ">=1.20.5"
 
       - name: fail if the schema has changed
         run: |
+          make limbo-schema.json
           git diff --exit-code -- limbo-schema.json
 
+      - name: fail if schema.go has changed
+        run: |
+          make -C harness/gocryptox509 schema.go
+          git diff --exit-code -- harness/gocryptox509/schema.go
+
+
   check-harnesses:
     runs-on: ubuntu-latest
     steps:
@@ -55,7 +63,7 @@ jobs:
           go-version: ">=1.20.5"
 
       - name: check that harnesses build
-        run: make build-harnesses
+        run: make build-harnesses -j
 
   all-checks-pass:
     if: always()

.github/workflows/refresh-bettertls-testcases.yml

@@ -52,7 +52,7 @@ jobs:
           fi
 
       - name: create PR
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
+        uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # v6.0.1
         with:
           commit-message: "[BOT] update BetterTLS testcases"
           branch: update-BetterTLS-testcases

.github/workflows/refresh-online-testcases.yml

@@ -26,7 +26,7 @@ jobs:
         run: make online-cases
 
       - name: create PR
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
+        uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # v6.0.1
         with:
           commit-message: "[BOT] update online testcases"
           branch: update-online-testcases

.github/workflows/regression.yml

@@ -0,0 +1,30 @@
+name: Testcase regression detection
+
+on:
+  pull_request:
+
+jobs:
+  regressions:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for regression comment generation.
+      issues: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ">=3.12"
+          cache: "pip"
+          cache-dependency-path: pyproject.toml
+
+      - uses: ./.github/actions/run-harnesses
+        id: run-harnesses
+
+      - name: run regression checks
+        run: make run ARGS="regression"
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+

.github/workflows/site.yml

@@ -13,32 +13,7 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  run-all-harnesses:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: ">=3.12"
-          cache: "pip"
-          cache-dependency-path: pyproject.toml
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ">=1.20.5"
-
-      - name: run harnesses
-        run: make test
-
-      - name: upload results
-        uses: actions/upload-artifact@v4
-        with:
-          name: results
-          path: results
-
   deploy:
-    needs: ["run-all-harnesses"]
     permissions:
       contents: read
       pages: write
@@ -56,11 +31,7 @@ jobs:
           cache: "pip"
           cache-dependency-path: pyproject.toml
 
-      - name: retrieve results
-        uses: actions/download-artifact@v4
-        with:
-          name: results
-          path: results
+      - uses: ./.github/actions/run-harnesses
 
       - name: build site
         run: make site