name: RustFS KMS Test on: workflow_call: inputs: chain_manifest: description: Verified candidate and chain attempt from the chain driver type: string required: true workflow_dispatch: inputs: rustfs_version: description: 'RustFS release tag to test. Leave empty for nightly.' required: false default: '' package_url: description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.' required: false type: string enforce_sse_key_policy: description: 'Enable RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY (runs KMS-401/402)' type: boolean default: false frame_v2: description: 'Enable RUSTFS_ENCRYPTION_FRAME_V2 (runs KMS-318)' type: boolean default: false config_secret: description: 'Set RUSTFS_KMS_CONFIG_SECRET (runs KMS-107 config sealing)' required: false type: string repository_dispatch: # Chain handoff: dispatched when the S3 compatibility suite finishes. types: [rustfs-chain-kms] permissions: contents: read concurrency: group: rustfs-shared-functional-tests-v2 cancel-in-progress: false defaults: run: shell: bash env: RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }} RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }} RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }} RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }} RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }} PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }} jobs: kms-test: runs-on: smoke-testing timeout-minutes: 60 if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }} steps: - name: Checkout repository (for report parser) uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - name: Initialize functional evidence id: evidence run: | set -euo pipefail umask 077 FUNCTIONAL_ARTIFACTS_DIR="${RUNNER_TEMP}/rustfs-kms-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" mkdir -- "${FUNCTIONAL_ARTIFACTS_DIR}" "${FUNCTIONAL_ARTIFACTS_DIR}-scratch" { printf 'FUNCTIONAL_ARTIFACTS_DIR=%s\n' "${FUNCTIONAL_ARTIFACTS_DIR}" printf 'LOG_FILE=%s/suite.log\n' "${FUNCTIONAL_ARTIFACTS_DIR}" printf 'REPORT_FILE=%s/report.md\n' "${FUNCTIONAL_ARTIFACTS_DIR}" printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}" } >> "${GITHUB_ENV}" - name: Bind functional candidate id: chain if: ${{ inputs.chain_manifest != '' }} env: CHAIN_MANIFEST: ${{ inputs.chain_manifest }} run: python3 scripts/functional_chain_evidence.py consume - name: Checkout auto-testing scripts uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: rustfs/auto-testing ref: ${{ steps.chain.outputs.testing_sha || 'main' }} token: ${{ secrets.PF_TESTING_GH_TOKEN }} path: auto-testing persist-credentials: false - name: Show environment run: | uname -a jq --version openssl version docker --version || true - name: Cleanup environment (before) timeout-minutes: 5 run: | set -euo pipefail read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}" SSH_USER="${RUSTFS_SSH_USER:-azureuser}" for node in "${NODES[@]}"; do ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" ' set -euo pipefail SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n" ${SUDO} systemctl stop rustfs 2>/dev/null || true if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then ${SUDO} dpkg -P rustfs fi for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup ' done - name: Ensure docker (Vault container) run: | if ! command -v docker >/dev/null 2>&1; then sudo apt-get update sudo apt-get install -y docker.io fi sudo systemctl enable --now docker docker info >/dev/null 2>&1 || sudo docker info >/dev/null 2>&1 - name: Run KMS suite id: test timeout-minutes: 45 # Case failures keep the run green: the report and the backlog # issue manager carry the product signal. continue-on-error: true run: | set -euo pipefail chmod +x auto-testing/rustfs-kms-test.sh PACKAGE_URL='${{ inputs.package_url }}' RUSTFS_VERSION='${{ inputs.rustfs_version }}' ARGS=(--all-topologies --backends "local,vault-kv2" -y --log-file "${LOG_FILE}") EXTRA_ENV="" if [ "${{ inputs.enforce_sse_key_policy }}" = "true" ]; then EXTRA_ENV+="RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY=true"$'\n' fi if [ "${{ inputs.frame_v2 }}" = "true" ]; then EXTRA_ENV+="RUSTFS_ENCRYPTION_FRAME_V2=true"$'\n' fi if [ -n "${{ inputs.config_secret }}" ]; then EXTRA_ENV+="RUSTFS_KMS_CONFIG_SECRET=${{ inputs.config_secret }}"$'\n' fi if [ -n "${EXTRA_ENV}" ]; then ARGS+=(--extra-env "${EXTRA_ENV}") fi if [ -n "${PACKAGE_URL}" ]; then ARGS+=(--package-url "${PACKAGE_URL}") elif [ -n "${RUSTFS_VERSION}" ]; then ARGS+=(--version "${RUSTFS_VERSION}") else ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}") fi ./auto-testing/rustfs-kms-test.sh "${ARGS[@]}" - name: Generate report id: chain_report timeout-minutes: 2 if: ${{ always() && steps.evidence.outcome == 'success' }} run: | set -euo pipefail PACKAGE_URL='${{ inputs.package_url }}' RUSTFS_VERSION='${{ inputs.rustfs_version }}' if [ -n "${PACKAGE_URL}" ]; then PACKAGE_SOURCE="${PACKAGE_URL}" elif [ -n "${RUSTFS_VERSION}" ]; then PACKAGE_SOURCE="version ${RUSTFS_VERSION}" else PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}" fi CASE_TABLE="${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" CASE_RESULT=success python3 scripts/functional_case_report.py "${LOG_FILE}" "${CASE_TABLE}" || CASE_RESULT=failure RESULT=failure if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then RESULT=success fi # Product gate: failing cases keep the run green — they are reported # below and tracked in rustfs/backlog. Only harness/environment # breakdowns (the suite never reached case level, or a wholesale # failure with zero passes) turn the workflow red. CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)" CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)" CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 )) CASES_PASS=$(( CASES_TOTAL - CASES_FAIL )) HARNESS_OK=0 if [ '${{ steps.test.outcome }}' = 'success' ]; then HARNESS_OK=1 elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then HARNESS_OK=1 fi { echo "# RustFS KMS test report" echo "" echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" echo "- Attempt: ${GITHUB_RUN_ATTEMPT}" echo "- Workflow Commit: ${GITHUB_SHA}" echo "- Trigger: ${{ github.event_name }}" echo "- Package: ${PACKAGE_SOURCE}" echo "- Test Step Outcome: ${RESULT}" echo "- Suite Step Outcome: ${{ steps.test.outcome }}" echo "" if [ -s "${CASE_TABLE}" ]; then cat "${CASE_TABLE}" echo "" fi echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)" echo "" if [ -s "${CASE_TABLE}" ]; then echo "## Log tail" echo '```text' tail -n 200 "${LOG_FILE}" 2>/dev/null || true echo '```' else echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log." fi } | tee "${REPORT_FILE}" cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}" # Red only for harness/environment breakdowns; case failures stay green. [ "${HARNESS_OK}" = "1" ] - name: Upload functional report to dashboard timeout-minutes: 2 if: ${{ always() && steps.evidence.outcome == 'success' }} continue-on-error: true env: GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }} SUITE: kms run: | set -euo pipefail if [ -z "${GH_TOKEN:-}" ]; then echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload" exit 0 fi DATE="$(date -u +%Y-%m-%d)" REPORT_PATH="functional-reports/${SUITE}/${DATE}.md" # Base64-encode the report into a temp file and feed it to jq via # --rawfile: large reports (e.g. pool) exceed the OS argv limit and # make `jq --arg content "${CONTENT}"` fail with "Argument list too long". B64_FILE="$(mktemp)" python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}" > "${B64_FILE}" SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)" if [ -n "${SHA}" ]; then jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" --arg sha "${SHA}" \ '{message:$msg, content:($content|rtrimstr("\n")), sha:$sha}' \ | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null else jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" \ '{message:$msg, content:($content|rtrimstr("\n"))}' \ | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null fi rm -f "${B64_FILE}" - name: Manage backlog issues (dedup / label / auto-close) timeout-minutes: 2 # Replaces the old per-run failure filing. One entry point that: # - dedups by signal: failing cases are matched against open backlog # issues by label (category + case ID); covered cases become a # comment on the existing issue, only uncovered cases file a new one # - labels new issues (functional-test, category, case IDs, env) # - closes fixed issues after a fully green run # - never files or closes on cancelled runs if: ${{ always() && steps.evidence.outcome == 'success' }} continue-on-error: true env: GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }} SUITE: 'kms' SUITE_LABEL: 'KMS' RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} run: | set -euo pipefail if [ -z "${GH_TOKEN:-}" ]; then echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management" exit 0 fi if [ ! -f auto-testing/scripts/issue_manager.py ]; then echo "issue_manager.py not found in auto-testing checkout; skipping" exit 0 fi PACKAGE_URL='${{ inputs.package_url }}' RUSTFS_VERSION='${{ inputs.rustfs_version }}' PACKAGE_SOURCE="" if [ -n "${PACKAGE_URL}" ]; then PACKAGE_SOURCE="${PACKAGE_URL}" elif [ -n "${RUSTFS_VERSION}" ]; then PACKAGE_SOURCE="version ${RUSTFS_VERSION}" else PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}" fi python3 auto-testing/scripts/issue_manager.py handle \ --repo rustfs/backlog \ --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \ --outcome "${{ steps.test.outcome }}" \ --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \ --report-file "${REPORT_FILE}" \ --log "${LOG_FILE}" \ --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \ --run-id "${GITHUB_RUN_ID}" \ --attempt "${GITHUB_RUN_ATTEMPT}" \ --commit "${GITHUB_SHA}" \ --trigger "${{ github.event_name }}" \ --package-source "${PACKAGE_SOURCE}" \ --date "$(date -u +%Y-%m-%d)" - name: Upload report and logs timeout-minutes: 2 if: ${{ always() && steps.evidence.outcome == 'success' }} uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: rustfs-kms-test-${{ github.run_id }}-${{ github.run_attempt }} path: | ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/report.md ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/suite.log ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/cases.md if-no-files-found: error - name: Cleanup environment (after) timeout-minutes: 5 if: always() run: | set -euo pipefail read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}" SSH_USER="${RUSTFS_SSH_USER:-azureuser}" for node in "${NODES[@]}"; do ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" ' set -euo pipefail SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n" ${SUDO} systemctl stop rustfs 2>/dev/null || true if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then ${SUDO} dpkg -P rustfs fi for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup ' done - name: "Continue functional chain (next: Tier)" # Only chain-triggered runs forward to the next suite; standalone # workflow_dispatch runs stop after their own cleanup. A failed # handoff must never pass silently: it retries, then files an alert # issue in rustfs/backlog so a stalled chain is visible. if: ${{ always() && github.event_name == 'repository_dispatch' }} continue-on-error: true env: GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }} run: | set -uo pipefail if [ -z "${GH_TOKEN:-}" ]; then echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2 exit 1 fi DISPATCHED=0 for attempt in 1 2 3; do if gh api --method POST repos/rustfs/rustfs/dispatches \ -f event_type='rustfs-chain-tier' \ -F 'client_payload[from_suite]=kms'; then echo "dispatched next suite Tier (attempt ${attempt})" DISPATCHED=1 break fi echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2 sleep "${attempt}0" done if [ "${DISPATCHED:-0}" -ne 1 ]; then echo "ERROR: functional chain stalled: could not dispatch Tier after 3 attempts" >&2 TITLE="[functional][chain] stalled after kms (run ${GITHUB_RUN_ID})" BODY_FILE="$(mktemp)" { echo "The functional chain could not hand off from **kms** to **Tier** after 3 attempts." echo "" echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" echo "- Expected next event: 'rustfs-chain-tier'" echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable." echo "- Recovery: re-dispatch manually with" FENCE="$(printf "\x60\x60\x60")"; echo " ${FENCE}" echo " gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-tier'" FENCE="$(printf "\x60\x60\x60")"; echo " ${FENCE}" } > "${BODY_FILE}" gh issue create -R rustfs/backlog --title "${TITLE}" \ --body-file "${BODY_FILE}" --label functional-test \ || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \ || echo "could not file the stall alert issue either; check the token" >&2 exit 1 fi - name: Notify on failure if: failure() run: | echo "RustFS KMS suite failed" echo "See the uploaded report and log artifacts for details." - name: Record chain evidence id: chain_record if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }} env: CHAIN_MANIFEST: ${{ inputs.chain_manifest }} CHAIN_JOB_STATUS: ${{ job.status }} CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }} CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }} run: >- python3 scripts/functional_chain_evidence.py record --suite kms --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" --output "${RUNNER_TEMP}/chain-kms-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/kms.json" - name: Upload chain evidence if: ${{ always() && steps.chain_record.outputs.written == 'true' }} uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: functional-chain-kms-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/chain-kms-${{ github.run_id }}-${{ github.run_attempt }}/kms.json if-no-files-found: error