tests-golang.yml

name: Tests (Go)

# The Go module (languages/golang) and the WASI guests it embeds, ported from
# cipherstash-suite's `test-wasi.yml`. The guests are detached Cargo
# workspaces and the Go module is its own module, so nothing else in CI
# compiles, tests or links them: this workflow is their only gate.
#
#   wasi-check  the stack crates build for wasm32-wasip1 with no JS-host or
#               native-HTTP dependencies, the no-http shape passes its tests
#               and docs, both guests pass lint and tests and are built with
#               their import surfaces checked (the stack-encrypt guest four
#               times: the real build, the build with the EQL types, and the
#               deterministic-kms test build of each), their
#               sha256 is recorded, `go:test` runs against them, and
#               `go generate` leaves the tree unchanged.
#   go-lint     golangci-lint, Linux only.
#   go-binding-cross
#               the same Go tests on macOS and Windows, against the guests
#               Linux built, after checking their sha256.
#   live        the Go live tests and the stack-encrypt examples, against real
#               ZeroKMS with the repository's CS_* credentials.
#
# Every job except go-binding-cross runs mise at the repository root. The
# macOS and Windows jobs install only Go, reading the version from the root
# mise.toml, so they need no Rust.

on:
  pull_request:
    paths:
      - packages/stack-auth/**
      - packages/stack-profile/**
      - packages/stack-kms/**
      - packages/stack-encrypt/**
      - packages/stack-encrypt-derive/**
      - packages/stack-guest-abi/**
      # The eql guest build links eql-bindings.
      - packages/eql/crates/eql-bindings/**
      - packages/eql/crates/eql-domains/**
      - languages/golang/**
      - scripts/check-wasm-imports.py
      - scripts/go-binding-test.sh
      - Cargo.toml
      - Cargo.lock
      - .cargo/**
      - mise.toml
      - mise.test.toml
      - .github/actions/require-cs-secrets/**
      - .github/workflows/tests-golang.yml
      # Keep these excludes last so docs-only changes are skipped.
      - "!**.md"
      - "!**.example"
  push:
    branches: [main]
    paths:
      - packages/stack-auth/**
      - packages/stack-profile/**
      - packages/stack-kms/**
      - packages/stack-encrypt/**
      - packages/stack-encrypt-derive/**
      - packages/stack-guest-abi/**
      # The eql guest build links eql-bindings.
      - packages/eql/crates/eql-bindings/**
      - packages/eql/crates/eql-domains/**
      - languages/golang/**
      - scripts/check-wasm-imports.py
      - scripts/go-binding-test.sh
      - Cargo.toml
      - Cargo.lock
      - .cargo/**
      - mise.toml
      - mise.test.toml
      - .github/actions/require-cs-secrets/**
      - .github/workflows/tests-golang.yml
      - "!**.md"
      - "!**.example"
  workflow_dispatch: {}

defaults:
  run:
    shell: bash

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  RUSTFLAGS: "-D warnings"
  RUST_BACKTRACE: full
  CARGO_TERM_COLOR: always
  CARGO_NET_GIT_FETCH_WITH_CLI: true

jobs:
  wasi-check:
    name: WASI check, guests and Go (Linux)
    runs-on: blacksmith-16vcpu-ubuntu-2204
    timeout-minutes: 60
    env:
      # wasm:guest:test and wasm:auth-guest:test run nextest, which is pinned
      # in mise.test.toml. In the test environment mise-action installs (and
      # caches) the whole test toolset, which `mise run` would otherwise
      # install uncached.
      MISE_ENV: test
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
        with:
          version: 2026.4.0
          install: true
          working_directory: .
          cache: true
          # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
          cache_key_prefix: mise-v1-ubuntu-2204

      # mise caches its rust install as a symlink into ~/.rustup, which the
      # cache does not hold. On a runner image that already carries a 1.94.1
      # toolchain, a cache hit makes mise skip the components mise.toml
      # declares, and the lint steps below fail. A no-op when they are there.
      # Held by scripts/__tests__/crates-ci.test.mjs.
      - name: Add rustfmt and clippy to the pinned toolchain
        run: rustup component add rustfmt clippy

      # The root workspace and both guest workspaces, each with its own
      # target/.
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            .
            languages/golang/encrypt/guest
            languages/golang/auth/guest

      # The HTTP-free core compiles for wasm32-wasip1 with no JS-host backend
      # and no native HTTP/TLS stack in its graph: the invariant the wazero
      # binding is built on. See docs/wasm-analysis.md Layer 6.
      - name: WASI core check
        run: mise run wasm:wasi-check

      # The same no-http shape on the host: unit tests, doctests and rustdoc
      # with default features off. The compile gate above cannot see doc
      # examples or intra-doc links.
      - name: No-http tests and docs
        run: mise run wasm:no-http-test

      - name: stack-encrypt guest lint and tests
        run: mise run wasm:guest:test

      # Builds the release module and checks its host-import surface is
      # exactly WASI (minus ambient filesystem and sockets) plus the two
      # `cipherstash_transport` functions.
      - name: stack-encrypt guest release build and import-surface gate
        run: mise run wasm:guest:build

      # The deterministic-kms TEST build, under encrypt/testdata where no
      # build or embed sees it: the Go tests open the record fixture Rust
      # sealed through it, and run round trips with no ZeroKMS. The tests
      # skip when it is absent, so a build that forgets this step would pass
      # with less coverage, which is why the job builds it unconditionally.
      - name: stack-encrypt guest deterministic test build
        run: mise run wasm:guest:build:deterministic

      # The build with the EQL types (ADR-0007, amended 2026-10-06), which
      # package encrypt/eql embeds and registers on import, and its
      # deterministic test build, which the hermetic tests of a TextEq field
      # load. Same import-surface gate. The build task prints both builds'
      # sizes: the plan asks for that measurement before the SDK settles on
      # one build or two.
      - name: stack-encrypt guest eql build and import-surface gate
        run: mise run wasm:guest:build:eql

      - name: stack-encrypt guest eql deterministic test build
        run: mise run wasm:guest:build:eql:deterministic

      - name: Credential guest lint and tests
        run: mise run wasm:auth-guest:test

      - name: Credential guest release build and import-surface gate
        run: mise run wasm:auth-guest:build

      # The modules checked above are what every platform tests. Their
      # checksums travel with them, so the other jobs can prove they got the
      # same bytes rather than a stale or rebuilt guest.
      - name: Record the guests' checksums
        run: |
          for guest in encrypt/wasm/stack_encrypt_guest.wasm encrypt/testdata/stack_encrypt_guest_deterministic.wasm encrypt/eql/wasm/stack_encrypt_guest_eql.wasm encrypt/testdata/stack_encrypt_guest_eql_deterministic.wasm auth/wasm/stack_auth_guest.wasm; do
            (cd languages/golang && openssl dgst -sha256 "$guest" | awk '{print $NF}' > "$guest.sha256" && echo "$guest sha256 $(cat "$guest.sha256")")
          done

      - name: Hand the guests to the other jobs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: wasm-guests
          path: |
            languages/golang/encrypt/wasm/stack_encrypt_guest.wasm
            languages/golang/encrypt/wasm/stack_encrypt_guest.wasm.sha256
            languages/golang/encrypt/testdata/stack_encrypt_guest_deterministic.wasm
            languages/golang/encrypt/testdata/stack_encrypt_guest_deterministic.wasm.sha256
            languages/golang/encrypt/eql/wasm/stack_encrypt_guest_eql.wasm
            languages/golang/encrypt/eql/wasm/stack_encrypt_guest_eql.wasm.sha256
            languages/golang/encrypt/testdata/stack_encrypt_guest_eql_deterministic.wasm
            languages/golang/encrypt/testdata/stack_encrypt_guest_eql_deterministic.wasm.sha256
            languages/golang/auth/wasm/stack_auth_guest.wasm
            languages/golang/auth/wasm/stack_auth_guest.wasm.sha256
          if-no-files-found: error
          retention-days: 1

      # Format, vet and hermetic tests on amd64 and 386. The guest's memory
      # lock is best effort, so its test skips where RLIMIT_MEMLOCK refuses
      # it; CI raises the limit and sets STACK_ENCRYPT_TESTS_REQUIRE_LOCK so
      # the skip is an error here.
      - name: Go binding
        env:
          STACK_ENCRYPT_TESTS_REQUIRE_LOCK: "1"
        run: |
          ulimit -l "$(ulimit -H -l)"
          echo "RLIMIT_MEMLOCK: $(ulimit -l) KiB"
          mise run go:test

      # What is encrypted is fixed before the program ships: every generated
      # file is committed, and this fails when `go generate` would change
      # one. It runs the real stashgen against the guest just built, so it
      # also proves the generator and the engine agree on the module's own
      # examples. `git diff` sees only tracked files, so the status check
      # catches a generated file that was never committed.
      - name: Generated code is committed
        working-directory: languages/golang
        run: |
          CGO_ENABLED=0 go generate ./...
          git diff --exit-code -- .
          untracked="$(git status --porcelain -- .)"
          if [ -n "$untracked" ]; then
            echo "::error::go generate wrote files that are not committed:"
            echo "$untracked"
            exit 1
          fi

  # Linux only: macOS and Windows would report the same findings. Needs no
  # guests: the packages embed a directory and compile without them.
  go-lint:
    name: Go lint
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
        with:
          version: 2026.4.0
          install: true
          working_directory: .
          install_args: go golangci-lint
          cache: true
          # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
          cache_key_prefix: mise-v1-ubuntu-2404

      - name: golangci-lint
        run: mise run go:lint

  # The Go binding on macOS and Windows, against the guests Linux built. The
  # credential guest's refresh lock has Unix and Windows implementations, and
  # its device refresh tests have no skip. Go plus the artifact is the whole
  # toolchain here.
  go-binding-cross:
    name: Go binding (${{ matrix.os }})
    needs: wasi-check
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      # Git for Windows defaults to CRLF on checkout, and gofmt would then
      # report every file. Set this before checkout.
      - name: Keep LF line endings
        run: git config --global core.autocrlf false

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      # One source of truth for the Go version: the root mise pin the Linux
      # job runs under. If the pin changes shape, fail here by name rather
      # than hand setup-go an empty version.
      - name: Go version from mise.toml
        id: go
        run: |
          version=$(sed -n 's/^go = "\(.*\)"/\1/p' mise.toml)
          if [ -z "$version" ]; then
            echo 'no go = "..." line in mise.toml; the Go version pin has changed shape' >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ steps.go.outputs.version }}
          cache-dependency-path: languages/golang/go.sum

      # The artifact keeps its paths relative to their common root
      # (languages/golang), so both guests land where the packages embed them.
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: wasm-guests
          path: languages/golang

      - name: The guests are the ones Linux built and checked
        run: |
          cd languages/golang
          for guest in encrypt/wasm/stack_encrypt_guest.wasm encrypt/testdata/stack_encrypt_guest_deterministic.wasm encrypt/eql/wasm/stack_encrypt_guest_eql.wasm encrypt/testdata/stack_encrypt_guest_eql_deterministic.wasm auth/wasm/stack_auth_guest.wasm; do
            want=$(cat "$guest.sha256")
            got=$(openssl dgst -sha256 "$guest" | awk '{print $NF}')
            if [ "$want" != "$got" ]; then
              echo "$guest checksum mismatch: artifact says $want, file is $got" >&2
              exit 1
            fi
            echo "$guest sha256 $got"
          done

      - name: Go binding
        run: scripts/go-binding-test.sh languages/golang

  # Round trips through real ZeroKMS. The Go live tests skip without their
  # STACK_ENCRYPT_TEST_* variables, so the secrets pre-flight runs first and
  # turns a missing credential into a failure rather than a silent skip. The
  # stack-encrypt examples read CS_* through `StackCipher::new()`; tests-crates
  # builds them, and this job runs them.
  live:
    name: Go live tests and stack-encrypt examples
    needs: wasi-check
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    env:
      CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
      CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
      CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
      CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
      STACK_ENCRYPT_TEST_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
      STACK_ENCRYPT_TEST_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
      STACK_ENCRYPT_TEST_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
      STACK_ENCRYPT_TEST_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      # Fast pre-flight: fail in seconds if a secret was rotated or cleared.
      # Ordering is asserted by scripts/__tests__/ffi-binding-step-order.test.mjs.
      - uses: ./.github/actions/require-cs-secrets
        with:
          workspace-crn: ${{ vars.CS_WORKSPACE_CRN }}
          client-id: ${{ vars.CS_CLIENT_ID }}
          client-key: ${{ secrets.CS_CLIENT_KEY }}
          client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
        with:
          version: 2026.4.0
          install: true
          working_directory: .
          install_args: rust go
          cache: true
          # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
          cache_key_prefix: mise-v1-ubuntu-2404

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: wasm-guests
          path: languages/golang

      - name: The guests are the ones the wasi-check job built and checked
        run: |
          cd languages/golang
          for guest in encrypt/wasm/stack_encrypt_guest.wasm encrypt/testdata/stack_encrypt_guest_deterministic.wasm encrypt/eql/wasm/stack_encrypt_guest_eql.wasm encrypt/testdata/stack_encrypt_guest_eql_deterministic.wasm auth/wasm/stack_auth_guest.wasm; do
            want=$(cat "$guest.sha256")
            got=$(openssl dgst -sha256 "$guest" | awk '{print $NF}')
            if [ "$want" != "$got" ]; then
              echo "$guest checksum mismatch: artifact says $want, file is $got" >&2
              exit 1
            fi
            echo "$guest sha256 $got"
          done

      # The whole package, not a `-run` filter: live tests are the ones that
      # call `liveClient`, and not all of them are named `TestLive*`.
      - name: Go live tests
        working-directory: languages/golang
        run: CGO_ENABLED=0 go test -v ./encrypt/...

      - name: stack-encrypt examples
        run: |
          for example in encrypted_record mixed_user search_terms zerokms_auth; do
            echo "==> $example"
            cargo run --locked -p stack-encrypt --example "$example"
          done