fix: accept delegation chains issued by a non-mainnet auth provider #3288
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| env: | |
| # When getting Rust dependencies, retry on network error: | |
| CARGO_NET_RETRY: 10 | |
| # Use the local .curlrc | |
| CURL_HOME: . | |
| # Disable incremental compilation | |
| CARGO_INCREMENTAL: 0 | |
| # Reduce debug info in CI builds: smaller object files mean much faster | |
| # linking (the dominant cost on Windows MSVC) and smaller caches. | |
| # line-tables-only keeps file:line numbers in backtraces. | |
| CARGO_PROFILE_DEV_DEBUG: line-tables-only | |
| # Link with LLVM's lld-link instead of the slow MSVC link.exe. LLVM is | |
| # preinstalled at C:\Program Files\LLVM on the windows-2025 image. This is | |
| # only consumed when building the windows-msvc target, so it is a no-op on | |
| # Linux/macOS, and being scoped to this workflow it does not affect the | |
| # release/dist (thin-LTO) build, which keeps the default linker. | |
| CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER: "C:/Program Files/LLVM/bin/lld-link.exe" | |
| # These variables should be shared with WSL | |
| WSLENV: CARGO_INCREMENTAL:CURL_HOME/p:CARGO_NET_RETRY:GITHUB_ENV/p:GITHUB_OUTPUT/p | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| src: ${{ steps.filter.outputs.src }} | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| # With 'every', a changed file is matched only when it satisfies | |
| # ALL rules: the positive pattern AND every negated pattern. | |
| predicate-quantifier: 'every' | |
| filters: | | |
| src: | |
| - '**' | |
| - '!**.md' | |
| - '!docs/**' | |
| - '!docs-site/**' | |
| - '!npm/**' | |
| discover: | |
| needs: changes | |
| if: needs.changes.outputs.src == 'true' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - id: set-matrix | |
| run: echo "matrix=$(python3 .github/scripts/test-matrix.py)" >> $GITHUB_OUTPUT | |
| # Compile every test binary (unit + integration) plus the `icp` bin ONCE per | |
| # OS. Publish the binaries as a nextest archive so the integration-test jobs | |
| # can run them without recompiling, and run the workspace UNIT tests right | |
| # here (see the "Run unit tests" step for why they don't run from the archive). | |
| build: | |
| name: Build & unit tests on ${{ matrix.os }} | |
| needs: changes | |
| if: needs.changes.outputs.src == 'true' | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| # Don't cancel the other platforms when one fails — we want every OS's | |
| # build + unit-test result from a single run. | |
| fail-fast: false | |
| matrix: | |
| # Keep this os matrix in sync with .github/scripts/test-matrix.py so | |
| # every OS the test jobs run on has a matching archive. | |
| os: [ubuntu-22.04, macos-15, windows-2025] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # Defender real-time scanning of every object/rlib it writes slows | |
| # file-heavy Rust builds and cache extraction considerably on Windows. | |
| - name: Exclude build dirs from Windows Defender | |
| if: ${{ contains(matrix.os, 'windows') }} | |
| shell: pwsh | |
| run: | | |
| Add-MpPreference -ExclusionPath ` | |
| "$env:GITHUB_WORKSPACE", ` | |
| "$env:USERPROFILE\.cargo", ` | |
| "$env:USERPROFILE\.rustup" -ErrorAction SilentlyContinue | |
| - name: Setup image (Linux) | |
| if: ${{ contains(matrix.os, 'ubuntu') }} | |
| run: ./.github/scripts/provision-linux-build.sh | |
| # The macOS runner image pre-taps aws/tap and azure/bicep, which Homebrew | |
| # now flags as untrusted on every `brew install` (including the one inside | |
| # setup-rust-toolchain below). We use neither. bicep (from azure/bicep) is | |
| # the only formula installed from them, so uninstall it first; then both | |
| # taps untap cleanly without --force (which would untap but warn about the | |
| # installed formula). || true keeps the step green if a future image no | |
| # longer ships these. Must run before any brew install to suppress the | |
| # warning. | |
| - name: Untap unused Homebrew taps (macOS) | |
| if: ${{ contains(matrix.os, 'macos') }} | |
| run: | | |
| brew uninstall bicep || true | |
| brew untap aws/tap || true | |
| brew untap azure/bicep || true | |
| # rust-cache hashes all installed toolchains; the runner image's `stable` | |
| # drifts as the image updates, which moves the cache key and causes misses. | |
| # Remove it so only the rust-toolchain.toml-pinned version remains. | |
| - name: Remove the runner's bundled Rust toolchain | |
| run: rustup toolchain remove stable 2>/dev/null || true | |
| - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| cache-shared-key: ${{ runner.os }}-test | |
| cache-bin: false | |
| - name: Install nextest | |
| uses: taiki-e/install-action@e9e8e031bcd90cdbe8ac6bb1d376f8596e587fbf # v2.70.2 | |
| with: | |
| tool: nextest | |
| # Build all test binaries + the `icp` bin into a single self-contained | |
| # archive. This is the only place the workspace is compiled for tests. | |
| - name: Build nextest archive | |
| run: cargo nextest archive --workspace --archive-file nextest-archive.tar.zst | |
| - name: Upload nextest archive | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: nextest-archive-${{ runner.os }} | |
| path: nextest-archive.tar.zst | |
| # Only needed by same-run downstream jobs; don't retain it. | |
| retention-days: 1 | |
| - uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # 1.2.0 | |
| if: ${{ contains(matrix.os, 'ubuntu') }} | |
| # Run the workspace unit tests here, NOT from the archive. Some unit tests | |
| # (e.g. icp-sync-plugin's runtime tests) read build-script fixtures under | |
| # OUT_DIR that only exist on the machine that compiled them — nextest | |
| # archives OUT_DIR only one level deep and can't carry the nested wasm, so | |
| # an archived run on another machine can't find it. Running here reuses | |
| # this job's fresh build (fixtures on disk) and avoids compiling the | |
| # workspace a second time in a separate job. | |
| # | |
| # --workspace is required: without it cargo defaults to default-members | |
| # (icp-cli only), which both skips the other crates' unit tests AND | |
| # re-resolves features differently from the `nextest archive --workspace` | |
| # build above, forcing a full recompile. Matching --workspace reuses the | |
| # just-built artifacts (no recompile) and runs every crate's unit tests. | |
| - name: Run unit tests | |
| run: cargo nextest run --workspace -E 'kind(lib) | kind(bin)' | |
| test: | |
| name: ${{ matrix.test }} on ${{ matrix.os }} | |
| # Reuse the prebuilt archive from the build job. | |
| needs: [discover, build] | |
| # Check discover's result (not changes.outputs.src) because this job | |
| # needs discover's matrix output, which is only available when it ran. | |
| if: needs.discover.result == 'success' | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{fromJson(needs.discover.outputs.matrix)}} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # Defender scans the files nextest extracts from the archive; excluding the | |
| # workspace/cargo dirs keeps that cheap on Windows. | |
| - name: Exclude build dirs from Windows Defender | |
| if: ${{ contains(matrix.os, 'windows') }} | |
| shell: pwsh | |
| run: | | |
| Add-MpPreference -ExclusionPath ` | |
| "$env:GITHUB_WORKSPACE", ` | |
| "$env:USERPROFILE\.cargo", ` | |
| "$env:USERPROFILE\.rustup" -ErrorAction SilentlyContinue | |
| # The macOS runner image pre-taps aws/tap and azure/bicep, which Homebrew | |
| # now flags as untrusted on every `brew install` (including our | |
| # provision-macos-test.sh). We use neither. bicep (from azure/bicep) is | |
| # the only formula installed from them, so uninstall it first; then both | |
| # taps untap cleanly without --force (which would untap but warn about the | |
| # installed formula). || true keeps the step green if a future image no | |
| # longer ships these. Must run before any brew install to suppress the | |
| # warning. | |
| - name: Untap unused Homebrew taps (macOS) | |
| if: ${{ contains(matrix.os, 'macos') }} | |
| run: | | |
| brew uninstall bicep || true | |
| brew untap aws/tap || true | |
| brew untap azure/bicep || true | |
| # Toolchain to invoke `cargo nextest`; cache: false skips the (large) deps | |
| # cache restore since this job never compiles. | |
| - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| cache: false | |
| - name: Setup image (Linux) | |
| if: ${{ contains(matrix.os, 'ubuntu') }} | |
| run: ./.github/scripts/provision-linux-build.sh && ./.github/scripts/provision-linux-test.sh | |
| - name: Setup image (macOS) | |
| if: ${{ contains(matrix.os, 'macos') }} | |
| run: ./.github/scripts/provision-macos-test.sh | |
| - name: Setup image (Windows) | |
| if: ${{ contains(matrix.os, 'windows') }} | |
| run: .github/scripts/provision-windows-test.ps1 | |
| shell: pwsh | |
| - name: Setup WSL2 (Windows) | |
| if: ${{ contains(matrix.os, 'windows') }} | |
| uses: Vampire/setup-wsl@d1da7f2c0322a5ee4f24975344f67fc0f5baf364 # v7.0.0 | |
| with: | |
| distribution: Ubuntu-22.04 | |
| - name: Setup Docker in WSL2 (Windows) | |
| if: ${{ contains(matrix.os, 'windows') }} | |
| run: .github/scripts/init-docker.sh | |
| shell: wsl-bash_Ubuntu-22.04 {0} | |
| - uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # 1.2.0 | |
| if: ${{ contains(matrix.os, 'ubuntu') }} | |
| # mops is only needed for the Motoko (moc) tests, which are all | |
| # #[cfg(unix)], so skip it on Windows. Install the CLI directly rather | |
| # than via dfinity/setup-mops, which only wraps this same script with a | |
| # Linux/macOS-only package cache and Node 20 actions (setup-node/cache). | |
| - name: Install mops | |
| if: ${{ !contains(matrix.os, 'windows') }} | |
| run: | | |
| curl -fsSL cli.mops.one/install.sh | sh | |
| which mops | |
| mops --version | |
| - name: Install ic-wasm | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -LsSf https://github.com/dfinity/ic-wasm/releases/download/0.9.10/ic-wasm-installer.sh | sh | |
| which ic-wasm | |
| ic-wasm --version | |
| - name: Install wasm-tools and nextest | |
| uses: taiki-e/install-action@e9e8e031bcd90cdbe8ac6bb1d376f8596e587fbf # v2.70.2 | |
| with: | |
| tool: nextest, wasm-tools | |
| - name: Verify wasm-tools installation | |
| run: | | |
| which wasm-tools | |
| wasm-tools --version | |
| - name: Download test network launcher | |
| if: ${{ !contains(matrix.os, 'windows') }} | |
| run: ./scripts/download_test_network_launcher.sh | |
| - name: Download nextest archive | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: nextest-archive-${{ runner.os }} | |
| - name: Run ${{ matrix.test }} | |
| # Run just this file's test binary from the archive. binary(=...) is an | |
| # exact match so e.g. canister_call_tests does not also pull in | |
| # canister_call_root_key_tests. The macOS runners do not support Docker, | |
| # so drop the docker-tagged tests there (test-tag bakes ":docker:" into | |
| # their names). --no-tests=warn: some files are entirely #[cfg(unix)], so | |
| # on Windows the binary has zero tests — warn (exit 0) instead of the | |
| # default error, since the auto-generated matrix can't produce a typo'd | |
| # binary name. | |
| run: cargo nextest run --archive-file nextest-archive.tar.zst --no-tests=warn -E "binary(=${{ matrix.test }})${{ contains(matrix.os, 'macos') && ' & not test(~:docker:)' || '' }}" | |
| env: | |
| ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| aggregate: | |
| name: test:required | |
| if: always() && needs.changes.outputs.src == 'true' | |
| runs-on: ubuntu-latest | |
| needs: [changes, build, test] | |
| steps: | |
| # `build` also runs the unit tests, so this covers unit-test failures too. | |
| - name: check build result | |
| if: ${{ needs.build.result != 'success' }} | |
| run: exit 1 | |
| - name: check test result | |
| if: ${{ needs.test.result != 'success' }} | |
| run: exit 1 |