rust-test.yml

name: WolfTPM Rust Wrapper Tests

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '**' ]
    types: [opened, synchronize, reopened, ready_for_review]
  repository_dispatch:
    types: [nightly-trigger]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # Resolve the latest wolfSSL -stable tag so we also test the shipped release.
  discover:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    uses: ./.github/workflows/_resolve-wolfssl.yml

  rust:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    needs: discover
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
    defaults:
      run:
        shell: bash
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: master
            wolfssl_ref: master
          - name: latest-stable
            wolfssl_ref: ${{ needs.discover.outputs.latest_stable }}
    steps:
      - name: Checkout wolfTPM
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true

      # Build + install wolfSSL with the crypto-callback support the wrapper
      # (and the TPM-backed TLS bridge) needs; installs to /usr/local so
      # pkg-config finds it for both wolfTPM configure and the Rust build.rs.
      - name: Setup wolfSSL
        uses: ./.github/actions/setup-wolfssl
        with:
          ref: ${{ matrix.wolfssl_ref || 'master' }}
          # fwTPM RSA object creation needs WOLFSSL_KEY_GEN and the raw-RSA
          # padding path, or TPM2_Create returns TPM_RC_COMMAND_CODE for RSA
          # keys (see src/fwtpm/README.md).
          configure-flags: --enable-wolftpm --enable-pkcallbacks --enable-keygen
          cflags: -DWC_RSA_NO_PADDING

      - name: Generate TPM port
        run: |
          MATRIX_HASH=$(echo -n "rust-${{ matrix.name }}" | cksum | cut -d' ' -f1)
          TPM_PORT=$((40000 + (MATRIX_HASH % 1000) * 2))
          {
            echo "TPM_PORT=$TPM_PORT"
            echo "TPM2_SWTPM_PORT=$TPM_PORT"
            echo "TPM2_SWTPM_HOST=localhost"
          } >> "$GITHUB_ENV"

      # Build wolfTPM with our in-tree firmware TPM (fwtpm_server) as the
      # software TPM the Rust tests run against — no external simulator.
      - name: Build wolfTPM (swtpm + fwtpm)
        run: |
          ./autogen.sh
          ./configure --enable-swtpm --enable-fwtpm --with-swtpm-port="$TPM_PORT"
          make -j"$(nproc)"

      - name: Build Rust wrapper
        working-directory: ./wrapper/rust/wolftpm
        run: cargo build --locked --all-targets --features swtpm-tests

      # Style gates are advisory on the first runs (annotate, don't fail the
      # pipeline); flip continue-on-error off once a `cargo fmt` pass is landed.
      - name: Clippy
        working-directory: ./wrapper/rust/wolftpm
        continue-on-error: true
        run: cargo clippy --locked --all-targets --features swtpm-tests -- -D warnings

      - name: Rustfmt check
        working-directory: ./wrapper/rust/wolftpm
        continue-on-error: true
        run: cargo fmt --check

      - name: Test against fwTPM
        working-directory: ./wrapper/rust/wolftpm
        run: |
          ../../../src/fwtpm/fwtpm_server --clear --port "$TPM_PORT" \
            --platform-port "$((TPM_PORT + 1))" > /tmp/rust-fwtpm.log 2>&1 &
          server_pid=$!
          trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT
          for _ in $(seq 1 500); do
            ss -tln | grep -q ":$TPM_PORT " && break
            sleep 0.01
          done
          kill -0 "$server_pid"
          ss -tln | grep -q ":$TPM_PORT "
          cargo test --locked --features swtpm-tests -- --test-threads=1

      - name: Docs
        working-directory: ./wrapper/rust/wolftpm
        run: cargo doc --locked --no-deps

  # Compile-only against the Linux kernel-device transport, so the non-swtpm
  # cfg paths and the callback-free open() build are exercised too.
  rust-devtpm-compile:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/wolfssl/wolftpm-ci:v1.1
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout wolfTPM
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true
      - name: Setup wolfSSL
        uses: ./.github/actions/setup-wolfssl
        with:
          ref: master
          configure-flags: --enable-wolftpm --enable-pkcallbacks
      - name: Build wolfTPM (devtpm)
        run: |
          ./autogen.sh
          ./configure --enable-devtpm
          make -j"$(nproc)"
      - name: Compile Rust wrapper (no swtpm)
        working-directory: ./wrapper/rust/wolftpm
        run: cargo build --locked --all-targets

      - name: Upload failure logs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: wolftpm-rust-devtpm-logs
          path: |
            wrapper/rust/wolftpm/target/debug/build/*/output
          retention-days: 5