From 05a2b600e540dffdc45b683111bf75eec250c32f Mon Sep 17 00:00:00 2001 From: "Wayne E. Seguin" Date: Tue, 28 Jul 2026 17:40:04 -0400 Subject: [PATCH 1/3] Add target to run the integration suite The suite in ci/scripts/tests is driven by TEST_PATH, SAFE_PATH, and VAULT_VERSIONS. The make target that once passed those through became a plain `go test` invocation, so the variables were accepted and ignored and the suite stopped running. Add a separate target rather than folding it back into `test`, which `check` depends on and which must stay hermetic. Rebuild first when driving the in-tree binary so the suite cannot run against a stale build; an overridden SAFE_PATH is used as given. --- Makefile | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/Makefile b/Makefile index 6f04cb6..97913c6 100644 --- a/Makefile +++ b/Makefile @@ -19,6 +19,14 @@ LDFLAGS := -X main.Version="$(VERSION)" -X main.BuildTime="$(BUILD_TIME)" -X mai BINARY_NAME := safe GO_FILES := $(shell find . -name '*.go' -type f -not -path "./vendor/*") +# Integration suite. TEST_PATH is the suite script, SAFE_PATH the binary it +# drives, and VAULT_VERSIONS the space-separated Vault versions to run +# against. CI overrides all three; the defaults run the in-tree suite +# against a freshly built binary over the suite's own default versions. +TEST_PATH ?= ci/scripts/tests +SAFE_PATH ?= ./$(BINARY_NAME) +VAULT_VERSIONS ?= + ##@ General .PHONY: help @@ -77,6 +85,21 @@ test: ## Run all tests with race detector @go test -race -v $(shell go list ./... | grep -v vendor) @echo "$(GREEN)✓ Tests complete$(RESET)" +.PHONY: test-integration +test-integration: ## Run the end-to-end suite against real Vault servers + @echo "$(GREEN)Running integration suite...$(RESET)" + @test -x "$(TEST_PATH)" || { echo "$(YELLOW)No suite at $(TEST_PATH)$(RESET)"; exit 2; } +# Rebuild when driving the in-tree binary so the suite never runs against a +# stale build. An overridden SAFE_PATH is taken as-is: CI supplies the +# release artifact it means to test. +ifeq ($(SAFE_PATH),./$(BINARY_NAME)) + @$(MAKE) --no-print-directory build +else + @test -x "$(SAFE_PATH)" || { echo "$(YELLOW)No safe binary at $(SAFE_PATH)$(RESET)"; exit 2; } +endif + @$(TEST_PATH) $(SAFE_PATH) $(VAULT_VERSIONS) + @echo "$(GREEN)✓ Integration suite complete$(RESET)" + .PHONY: test-short test-short: ## Run tests in short mode (no race detector) @echo "$(GREEN)Running short tests...$(RESET)" From e69340627bc0a604d0069325d4de9532398c8037 Mon Sep 17 00:00:00 2001 From: "Wayne E. Seguin" Date: Tue, 28 Jul 2026 17:45:55 -0400 Subject: [PATCH 2/3] Run the integration suite from the vault job The script guarded on VAULT_VERSION while every test-vault job passes VAULT_VERSIONS, so each job bailed before running anything. Guard and report the name the jobs actually set. Call the target that runs the suite. The previous target ignored the TEST_PATH, SAFE_PATH, and VAULT_VERSIONS it was given and ran only the unit tests. --- ci/scripts/test-release-against-vault | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ci/scripts/test-release-against-vault b/ci/scripts/test-release-against-vault index 01bb5bf..b382e88 100755 --- a/ci/scripts/test-release-against-vault +++ b/ci/scripts/test-release-against-vault @@ -21,7 +21,7 @@ bail() { exit 2 } test -n "${PROJECT:-}" || bail "PROJECT must be set to the name of this package." -test -n "${VAULT_VERSION:-}" || bail "VAULT_VERSION must be set to the version of HashiCorp Vault to test against." +test -n "${VAULT_VERSIONS:-}" || bail "VAULT_VERSIONS must be set to the version(s) of HashiCorp Vault to test against." test -f "${VERSION_FROM}" || bail "Version file (${VERSION_FROM}) not found." VERSION=$(cat "${VERSION_FROM}") @@ -33,10 +33,10 @@ ARCH=$(uname -m | sed -e 's/^x86_/amd/') [[ -e "$BUILD_ROOT/$PROJECT-$VERSION-$OS-$ARCH" ]] || \ bail "Cannot find safe executable for v$VERSION on $OS/$ARCH" -header "Testing $PROJECT v$VERSION ($OS/$ARCH) against Vault $VAULT_VERSION" +header "Testing $PROJECT v$VERSION ($OS/$ARCH) against Vault $VAULT_VERSIONS" cd "$REPO_ROOT" -make test \ +make test-integration \ TEST_PATH="../$CI_ROOT/ci/scripts/tests" \ SAFE_PATH="../$BUILD_ROOT/$PROJECT-$VERSION-$OS-$ARCH" \ VAULT_VERSIONS="$VAULT_VERSIONS" From 22292c8730beb9e92bda9a9f3ccb749f3811e30e Mon Sep 17 00:00:00 2001 From: "Wayne E. Seguin" Date: Tue, 28 Jul 2026 17:46:39 -0400 Subject: [PATCH 3/3] Restore the script the pull-request job runs The job invokes ci/scripts/test, which was removed when the suite was renamed. Every pull-request build has failed on the missing file since. Run the hermetic checks only. The job has no Vault server, so the end-to-end suite stays in the test-vault jobs that do. --- ci/scripts/test | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100755 ci/scripts/test diff --git a/ci/scripts/test b/ci/scripts/test new file mode 100755 index 0000000..1186c89 --- /dev/null +++ b/ci/scripts/test @@ -0,0 +1,22 @@ +#!/bin/bash +# +# Gate for the pull-request job. No Vault server is available here, so this +# runs the hermetic checks only: fmt, vet, staticcheck, and the unit tests. +# The end-to-end suite runs in the test-vault-* jobs, which have a server. + +set -eu + +export GOPATH="${PWD}/gopath" +export PATH="${PATH}:${GOPATH}/bin" + +test -n "${MODULE:-}" || { + echo >&2 "MODULE must be set to the Go module path. Did you misconfigure Concourse?" + exit 2 +} + +cd "${GOPATH}/src/${MODULE}" + +go version +echo + +make check