From 9ddd136ab8e601dcd6f776a2eb1fc4942fb01aef Mon Sep 17 00:00:00 2001 From: Ignacio Van Droogenbroeck Date: Mon, 22 Jun 2026 14:43:20 -0600 Subject: [PATCH] ci: run the test suite with the shipping build tags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a CI workflow that runs `go test` on every PR and push to main with the same build tags the release uses — duckdb_arrow (standard) and duckdb_arrow,fips with GOFIPS140=v1.0.0 (FIPS variant) — plus go vet. Previously the only workflow (release-build.yml) built and signed binaries but ran NO tests, and a bare `go test` without -tags=duckdb_arrow does not even compile the Arrow query path: the DuckDB driver (duckdb-go/v2) gates its Arrow CGO API behind that tag. So automated testing of the code that actually ships was missing entirely — the gap that let the PR #489 Arrow-handler bug through. This makes tested == shipped. No -race: bcrypt-based auth tests hard-code 1000ms request timeouts that the race detector's overhead exceeds (the suite is race-clean — 0 DATA RACE). No gofmt gate: Go 1.26's gofmt rewrites doc-comment content (mangles the `'it''s'` SQL-escape example in internal/sql/mask.go), so enforcing it would propagate comment corruption; formatting is left to local tooling. Closes #490 (proposed dropping the tag; not feasible — the driver requires it). --- .github/workflows/ci.yml | 67 ++++++++++++++++++++++++++++++++++++++ RELEASE_NOTES_2026.06.2.md | 2 ++ 2 files changed, 69 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..03851af --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,67 @@ +name: CI + +# Run the Go test suite with the SHIPPING build tags on every PR and push to +# main, so what we test is what we ship. The duckdb_arrow tag is mandatory — +# the DuckDB driver gates its Arrow CGO API behind it (see issue #490), so a +# bare `go test` does not compile the Arrow path. Both shipped variants are +# covered: standard (-tags=duckdb_arrow) and FIPS (-tags=duckdb_arrow,fips, +# GOFIPS140), mirroring the build-binaries matrix in release-build.yml. + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Test (${{ matrix.variant }}) + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + include: + - variant: standard + build_tags: duckdb_arrow + gofips: "" + - variant: fips + build_tags: duckdb_arrow,fips + gofips: "v1.0.0" + steps: + - name: Checkout code + uses: actions/checkout@v5 + + - name: Set up Go + uses: actions/setup-go@v6 + with: + go-version: '1.26.4' + cache: true + + # vet only on the standard variant (vet findings are tag-independent; + # running once avoids duplicate annotations). No gofmt gate: Go 1.26's + # gofmt rewrites doc-comment content (e.g. mangles the `'it''s'` SQL-escape + # example in internal/sql/mask.go), so enforcing it in CI would propagate + # comment corruption. Format is left to local tooling / review. + - name: go vet + if: matrix.variant == 'standard' + env: + CGO_ENABLED: 1 + run: go vet -tags=duckdb_arrow ./... + + # No -race: bcrypt-based auth tests hard-code 1000ms request timeouts that + # the race detector's CPU overhead blows past (not real races — the suite + # is race-clean). The #490 goal is tag-correct coverage (test == ship), + # which -race is orthogonal to. Race coverage can be added later behind a + # carve-out for the timeout-sensitive auth/api packages. + - name: go test + env: + CGO_ENABLED: 1 + GOFIPS140: ${{ matrix.gofips }} + run: go test -tags=${{ matrix.build_tags }} ./... diff --git a/RELEASE_NOTES_2026.06.2.md b/RELEASE_NOTES_2026.06.2.md index bd698cf..a78c52e 100644 --- a/RELEASE_NOTES_2026.06.2.md +++ b/RELEASE_NOTES_2026.06.2.md @@ -57,6 +57,8 @@ Both files are attached to the GitHub release and can be ingested directly by DC The deliverable is signed scan evidence attached to each release, not "zero findings" — transitive OS CVEs from the Debian base layer outside Arc's control are reported but do not gate the release. +**CI now runs the test suite against the shipped build.** A new `CI` workflow runs `go test` on every pull request and push to `main` with the same build tags the release uses — `duckdb_arrow` (standard) and `duckdb_arrow,fips` with `GOFIPS140=v1.0.0` (FIPS variant) — plus `go vet`. Previously the only workflow built and signed binaries but ran no tests, and a bare `go test` (without `-tags=duckdb_arrow`) does not even compile the Arrow query path, because the DuckDB driver gates its Arrow API behind that tag — so automated testing of the code that actually ships was missing. This closes that gap; what CI tests is now what the release builds. (Issue #490, which proposed dropping the tag, was closed: the tag is required by the driver and cannot be removed without a driver change.) + **Signed releases and SLSA Level 3 provenance.** Every release binary and container image is cryptographically signed using [Sigstore/cosign](https://github.com/sigstore/cosign) with keyless OIDC signing — no key material is stored or managed; the GitHub Actions OIDC token is the identity, anchored in the [Rekor](https://rekor.sigstore.dev) public transparency log. Air-gapped and Zarf-based deployments can verify artifacts offline using the bundled signature files. - `arc-linux-amd64.bundle`, `arc-linux-arm64.bundle` — cosign signature bundles for each binary (signature + Rekor transparency-log entry). Verify with: `cosign verify-blob arc-linux-amd64 --bundle arc-linux-amd64.bundle --certificate-identity-regexp "^https://github.com/Basekick-Labs/arc/" --certificate-oidc-issuer https://token.actions.githubusercontent.com`