CI for Confidential Data Hub

.github/workflows/cdh_basic.yml

@@ -0,0 +1,78 @@
+name: confidential-data-hub basic build and unit tests
+
+on:
+  push:
+    branches:
+      - "main"
+    paths:
+      - 'confidential-data-hub/**'
+      - '.github/workflows/cdh_basic.yml'
+      - 'Cargo.toml'
+  pull_request:
+    paths:
+      - 'confidential-data-hub/**'
+      - '.github/workflows/cdh_basic.yml'
+      - 'Cargo.toml'
+  create:
+  workflow_dispatch:
+
+jobs:
+  basic_ci:
+    name: Check
+    defaults:
+      run:
+        working-directory: ./confidential-data-hub
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        rust:
+          - stable
+    steps:
+      - name: Code checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install Rust toolchain (${{ matrix.rust }})
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: ${{ matrix.rust }}
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install protoc
+        run: |
+          sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: Build and install
+        run: |
+          make && make install
+
+      - name: Musl build
+        run: |
+          make LIBC=musl
+
+      - name: s390x build
+        run:
+          make ARCH=s390x
+
+      - name: Run cargo test
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --features kbs,aliyun,sev,bin -p kms -p confidential-data-hub -p secret -p image
+
+      - name: Run cargo fmt check
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: -p kms -p confidential-data-hub -p secret -p image -- --check
+
+      - name: Run rust lint check
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          # We are getting error in generated code due to derive_partial_eq_without_eq check, so ignore it for now
+          args: -p kms -p confidential-data-hub -p secret -p image -- -D warnings -A clippy::derive-partial-eq-without-eq 

confidential-data-hub/hub/src/auth/kbs.rs

@@ -8,12 +8,12 @@
 //!
 //! For the first implementation, it is assumed that all the resource
 //! ids are from the kernel commandline in the following format:
-//! ```
+//! ```shell
 //! cdh.kbs_resources=<resource id 1>::<target path 1>,<resource id 2>::<target path 2>...
 //! ```
 //!
 //! for example
-//! ```
+//! ```shell
 //! cdh.kbs_resources=kbs:///default/key/1::/run/temp1,kbs:///default/key/2::/run/temp2
 //! ```
 //!

confidential-data-hub/kms/src/plugins/aliyun/client.rs

@@ -224,9 +224,9 @@ impl Decrypter for AliyunKmsClient {
 }
 
 impl AliyunKmsClient {
-    const API_VERSION: &str = "dkms-gcs-0.2";
-    const SIGNATURE_METHOD: &str = "RSA_PKCS1_SHA_256";
-    const CONTENT_TYPE: &str = "application/x-protobuf";
+    const API_VERSION: &'static str = "dkms-gcs-0.2";
+    const SIGNATURE_METHOD: &'static str = "RSA_PKCS1_SHA_256";
+    const CONTENT_TYPE: &'static str = "application/x-protobuf";
 
     fn build_headers(&self, api_name: &str, body: &[u8]) -> anyhow::Result<HeaderMap> {
         let mut headers = HeaderMap::new();
@@ -317,9 +317,10 @@ mod tests {
 
     use crate::{plugins::aliyun::client::AliyunKmsClient, Decrypter, Encrypter};
 
-    #[ignore]
     #[rstest]
+    #[ignore]
     #[case(b"this is a test plaintext")]
+    #[ignore]
     #[case(b"this is a another test plaintext")]
     #[tokio::test]
     async fn key_lifetime(#[case] plaintext: &[u8]) {