Initial Commit
This commit is contained in:
59
.github/pull_request_template/flip-primitive.md
vendored
Normal file
59
.github/pull_request_template/flip-primitive.md
vendored
Normal file
@@ -0,0 +1,59 @@
|
||||
# Flip primitive to `native`
|
||||
|
||||
This PR changes one or more `crypto.config.ts` entries from `'noble'` to
|
||||
`'native'`. Landing a flip permanently swaps the repo's routing for the
|
||||
primitive — every consumer picks up the in-house implementation on the
|
||||
next build.
|
||||
|
||||
Do not merge this PR without every box checked. Dangerous-tier primitives
|
||||
(curves, AEADs, argon2id) additionally require a linked audit document.
|
||||
|
||||
## Primitive(s) affected
|
||||
|
||||
<!-- List each flipped primitive and its new flavour. -->
|
||||
- [ ] `<primitive-id>`: `noble` → `native`
|
||||
|
||||
## Gate 1 — KAT (known-answer tests)
|
||||
|
||||
- [ ] All vectors pass on the new impl.
|
||||
- [ ] Link to the KAT run:
|
||||
<!-- paste CI link for `bunx turbo crypto:kat` -->
|
||||
|
||||
## Gate 2 — Differential fuzz history
|
||||
|
||||
- [ ] At least 7 consecutive nightly `crypto:fuzz` runs pass native-vs-noble
|
||||
with zero mismatches.
|
||||
- [ ] Link to the 7-day nightly history:
|
||||
<!-- paste CI dashboard link -->
|
||||
|
||||
## Gate 3 — Timing report
|
||||
|
||||
- [ ] `crypto:timing` run for this primitive reports `constantTime: true`
|
||||
against the default threshold (t < 4.5).
|
||||
- [ ] Link to the timing report:
|
||||
<!-- paste artifact link -->
|
||||
|
||||
## Audit document (dangerous tier only)
|
||||
|
||||
Required for: `secp256k1`, `ed25519`, `x25519`, `p256`, `aes-256-gcm`,
|
||||
`chacha20-poly1305`, `xchacha20-poly1305`, `argon2id`.
|
||||
|
||||
- [ ] N/A — primitive is not dangerous tier.
|
||||
- [ ] Audit document linked below. Include: reviewer name, scope, findings,
|
||||
sign-off date.
|
||||
<!-- link to audit doc -->
|
||||
|
||||
## Rollback plan
|
||||
|
||||
- [ ] Reverting `crypto.config.ts` and regenerating selects restores `noble`
|
||||
routing with zero other changes.
|
||||
- [ ] Legacy noble impl at `impl/<id>.noble.ts` is untouched by this PR.
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] `bun scripts/gen-crypto-selects.ts` has been run and `<id>.select.ts`
|
||||
has been updated to re-export from `./impl/<id>.native.js`.
|
||||
- [ ] `bun scripts/check-crypto-selects.ts` is green.
|
||||
- [ ] `bun scripts/ct-lint.ts` is green.
|
||||
- [ ] `bunx turbo lint typecheck test` is green across every crypto-*
|
||||
package.
|
||||
180
.github/workflows/registry-deploy.yml
vendored
Normal file
180
.github/workflows/registry-deploy.yml
vendored
Normal file
@@ -0,0 +1,180 @@
|
||||
name: registry-deploy
|
||||
|
||||
# Builds the @suaveplan/react-ui shadcn registry + Storybook static
|
||||
# and deploys both to ui.suaveplan.com on every push to genesis that
|
||||
# touches the registry sources or the ops scaffolding.
|
||||
#
|
||||
# Required secrets (set via `gh secret set ...`):
|
||||
# OVH_SSH_HOST — OVH hostname or IP
|
||||
# OVH_SSH_USER — scoped deploy user (NOT root)
|
||||
# OVH_SSH_PRIVATE_KEY — Ed25519 private key whose public side is
|
||||
# in the deploy user's authorized_keys
|
||||
#
|
||||
# Security note: this workflow does NOT consume any github.event.*
|
||||
# strings (issue titles, PR bodies, commit messages) inside `run:`
|
||||
# scripts. All variable expansion is from `secrets.*` or job
|
||||
# `outputs.*`, both of which are trusted.
|
||||
#
|
||||
# See ops/registry/README.md for first-time OVH setup.
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [genesis]
|
||||
paths:
|
||||
- "packages/react/react-ui/**"
|
||||
- "packages/react/react-ui-theme-*/**"
|
||||
- "packages/react/react-ui-pack-*/**"
|
||||
- "ops/registry/**"
|
||||
- ".github/workflows/registry-deploy.yml"
|
||||
workflow_dispatch: {}
|
||||
|
||||
# Only one deploy at a time per ref. Back-to-back pushes serialise
|
||||
# rather than race; the second push waits for the first to finish.
|
||||
concurrency:
|
||||
group: registry-deploy-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: build registry + storybook
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
outputs:
|
||||
snapshot_tag: ${{ steps.tag.outputs.tag }}
|
||||
steps:
|
||||
- name: checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: setup bun
|
||||
uses: oven-sh/setup-bun@v2
|
||||
with:
|
||||
bun-version: latest
|
||||
|
||||
- name: install dependencies
|
||||
run: bun install --frozen-lockfile
|
||||
|
||||
- name: build react-ui
|
||||
# The `if` guard is intentional ONLY while @suaveplan/react-ui
|
||||
# does not yet exist on genesis (Wave 2 ships it). Once Wave 2
|
||||
# lands, drop the guard and require the build to succeed.
|
||||
run: |
|
||||
if bunx turbo run build --filter=@suaveplan/react-ui --dry=json | grep -q '"@suaveplan/react-ui"'; then
|
||||
bunx turbo run build --filter=@suaveplan/react-ui
|
||||
else
|
||||
echo "::warning::@suaveplan/react-ui not yet present on genesis; skipping package build"
|
||||
fi
|
||||
|
||||
- name: build registry json
|
||||
run: bun run ops/registry/scripts/build-registry.ts
|
||||
|
||||
- name: build storybook static
|
||||
run: |
|
||||
if [[ -f packages/react/react-ui/package.json ]] && \
|
||||
grep -q '"build-storybook"' packages/react/react-ui/package.json; then
|
||||
cd packages/react/react-ui && bun run build-storybook
|
||||
else
|
||||
echo "::warning::storybook script not yet present; emitting placeholder"
|
||||
mkdir -p packages/react/react-ui/storybook-static
|
||||
printf '<!doctype html><meta charset=utf-8><title>Storybook pending</title><p>Storybook for @suaveplan/react-ui ships in Wave 2.</p>' \
|
||||
> packages/react/react-ui/storybook-static/index.html
|
||||
fi
|
||||
|
||||
- name: stage deploy artifact
|
||||
run: |
|
||||
mkdir -p .deploy/r .deploy/storybook
|
||||
if [[ -d packages/react/react-ui/registry/r ]]; then
|
||||
cp -R packages/react/react-ui/registry/r/. .deploy/r/
|
||||
fi
|
||||
if [[ -d packages/react/react-ui/storybook-static ]]; then
|
||||
cp -R packages/react/react-ui/storybook-static/. .deploy/storybook/
|
||||
fi
|
||||
ls -la .deploy/r .deploy/storybook
|
||||
|
||||
- name: snapshot tag
|
||||
id: tag
|
||||
run: echo "tag=$(date -u +%Y%m%dT%H%M%SZ)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: upload deploy artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: registry-deploy-${{ steps.tag.outputs.tag }}
|
||||
path: .deploy/
|
||||
retention-days: 7
|
||||
if-no-files-found: error
|
||||
|
||||
deploy:
|
||||
name: rsync to ui.suaveplan.com
|
||||
needs: build
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
environment:
|
||||
name: production-registry
|
||||
url: https://ui.suaveplan.com/
|
||||
steps:
|
||||
- name: download deploy artifact
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: registry-deploy-${{ needs.build.outputs.snapshot_tag }}
|
||||
path: .deploy/
|
||||
|
||||
- name: configure ssh
|
||||
env:
|
||||
OVH_SSH_PRIVATE_KEY: ${{ secrets.OVH_SSH_PRIVATE_KEY }}
|
||||
OVH_SSH_HOST: ${{ secrets.OVH_SSH_HOST }}
|
||||
run: |
|
||||
if [[ -z "${OVH_SSH_PRIVATE_KEY:-}" || -z "${OVH_SSH_HOST:-}" ]]; then
|
||||
echo "::error::OVH_SSH_PRIVATE_KEY and OVH_SSH_HOST secrets must be set; see ops/registry/README.md"
|
||||
exit 1
|
||||
fi
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
printf '%s\n' "${OVH_SSH_PRIVATE_KEY}" > ~/.ssh/registry_deploy
|
||||
chmod 600 ~/.ssh/registry_deploy
|
||||
# Pin host key on first run; refuse silent replacement after.
|
||||
ssh-keyscan -H "${OVH_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
||||
|
||||
- name: rsync registry tree (with snapshot)
|
||||
env:
|
||||
OVH_SSH_HOST: ${{ secrets.OVH_SSH_HOST }}
|
||||
OVH_SSH_USER: ${{ secrets.OVH_SSH_USER }}
|
||||
SNAPSHOT_TAG: ${{ needs.build.outputs.snapshot_tag }}
|
||||
run: |
|
||||
rsync -azh --delete \
|
||||
--backup --backup-dir="/srv/registry/.previous/${SNAPSHOT_TAG}/r/" \
|
||||
-e "ssh -i ~/.ssh/registry_deploy -o StrictHostKeyChecking=yes" \
|
||||
.deploy/r/ \
|
||||
"${OVH_SSH_USER}@${OVH_SSH_HOST}:/srv/registry/r/"
|
||||
|
||||
- name: rsync storybook tree (with snapshot)
|
||||
env:
|
||||
OVH_SSH_HOST: ${{ secrets.OVH_SSH_HOST }}
|
||||
OVH_SSH_USER: ${{ secrets.OVH_SSH_USER }}
|
||||
SNAPSHOT_TAG: ${{ needs.build.outputs.snapshot_tag }}
|
||||
run: |
|
||||
rsync -azh --delete \
|
||||
--backup --backup-dir="/srv/registry/.previous/${SNAPSHOT_TAG}/storybook/" \
|
||||
-e "ssh -i ~/.ssh/registry_deploy -o StrictHostKeyChecking=yes" \
|
||||
.deploy/storybook/ \
|
||||
"${OVH_SSH_USER}@${OVH_SSH_HOST}:/srv/registry/storybook/"
|
||||
|
||||
- name: post-deploy health probe
|
||||
run: |
|
||||
for i in 1 2 3 4 5; do
|
||||
if curl -fsSL https://ui.suaveplan.com/health | grep -q '^ok$'; then
|
||||
echo "health probe ok on attempt ${i}"
|
||||
exit 0
|
||||
fi
|
||||
echo "attempt ${i} failed; sleeping 5s"
|
||||
sleep 5
|
||||
done
|
||||
echo "::error::health probe failed after 5 attempts"
|
||||
exit 1
|
||||
|
||||
- name: cleanup
|
||||
if: always()
|
||||
run: rm -f ~/.ssh/registry_deploy
|
||||
Reference in New Issue
Block a user