samiandClaude Opus 5.5
b5ced32be3
New crate crates/kv-wasm runs the same crypto, item model and sync engine in the browser: - WebStore: in-memory replica of kv-store's Store, each changed entry written to IndexedDB (ciphertext only) before the JS call resolves. - Device key: non-extractable WebCrypto ECDSA P-256 key in IndexedDB (raw r||s signatures). - WebCore mirrors kv-ffi's VaultCore; wasm-bindgen surface in camelCase with TypeScript types, plus a Web Worker wrapper (connectVault) so Argon2id never blocks the page. - Tests: Chrome (IndexedDB, WebCrypto, RFC 9421 verify), shared envelope fixtures both ways with kv-ffi, native sync with kv-ffi via the test server, Node smoke of the built package. Small changes to shared crates so they build for wasm32: - kv-store: SqliteStore moved to a native-only module. - kv-sync: rustls/pinning/tokio native only (fetch on wasm); DeviceSigner::sign_async (default wraps sign) used by ApiClient; unix_now() instead of SystemTime/now_utc. - kv-model: Public Suffix List behind a default `psl` feature (kv-ffi keeps it; the web build drops ~0.9 MB of code and matches same-host only). - wasm-release profile (opt-level z, Argon2 at 3) and a wasm CI job. Co-Authored-By: Claude Opus 5.5 <[email protected]>
75 lines
3.0 KiB
YAML
75 lines
3.0 KiB
YAML
name: ci
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with: { persist-credentials: false }
|
|
- uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
|
|
with: { toolchain: stable, components: "clippy, rustfmt" }
|
|
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
|
- run: cargo fmt --all --check
|
|
- run: cargo clippy --workspace --all-targets -- -D warnings
|
|
- run: cargo test --workspace
|
|
|
|
# The web vault's core (crates/kv-wasm/README.md): wasm32 lints, in-browser tests (IndexedDB,
|
|
# WebCrypto), the package build and a Node smoke test of the built package.
|
|
wasm:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with: { persist-credentials: false }
|
|
- uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
|
|
with: { toolchain: stable, components: clippy, targets: wasm32-unknown-unknown }
|
|
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
|
- run: cargo install wasm-pack --locked
|
|
- run: cargo clippy -p kv-wasm --target wasm32-unknown-unknown --all-targets -- -D warnings
|
|
- run: wasm-pack test --headless --chrome crates/kv-wasm
|
|
- run: crates/kv-wasm/build.sh
|
|
- run: node crates/kv-wasm/js/smoke.mjs
|
|
|
|
deny:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with: { persist-credentials: false }
|
|
- uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
|
|
with: { command: check, arguments: --all-features }
|
|
|
|
# Builds every fuzz target and runs each for a minute from the checked-in seeds (fuzz/README.md).
|
|
fuzz:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with: { persist-credentials: false }
|
|
- uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
|
|
with: { toolchain: nightly }
|
|
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
|
with: { workspaces: fuzz }
|
|
- run: cargo install cargo-fuzz --locked
|
|
- name: Fuzz smoke run
|
|
working-directory: fuzz
|
|
run: |
|
|
for t in $(cargo +nightly fuzz list); do
|
|
mkdir -p "$RUNNER_TEMP/corpus/$t"
|
|
cargo +nightly fuzz run "$t" "$RUNNER_TEMP/corpus/$t" "seeds/$t" -- -max_total_time=60 -max_len=4096
|
|
done
|
|
- if: failure()
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with: { name: fuzz-artifacts, path: fuzz/artifacts }
|