Log encryption failure cause under DEBUG in encryptWithCipher (#511) #1320
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| env: | |
| ANDROID_HOME: /usr/local/lib/android/sdk | |
| NDK_VERSION: "29.0.14206865" | |
| CARGO_NDK_VERSION: "4.1.2" | |
| RUST_VERSION: "1.89.0" | |
| jobs: | |
| build: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false) | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup keep checkout | |
| uses: ./.github/actions/setup-keep | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| - name: Verify toolchain version pins are consistent | |
| run: ./scripts/check-toolchain-pins.sh | |
| - name: Check for hardcoded user-facing strings | |
| run: ./scripts/check-hardcoded-strings.sh | |
| - name: Check for locale drift | |
| run: ./scripts/check-locale-drift.sh | |
| - name: Verify release changelogs exist for this versionCode | |
| run: ./scripts/check-release-changelogs.sh | |
| # Assert the guard's rules before trusting them. A member access split | |
| # after a trailing dot, and a class name assembled by concatenation, both | |
| # walked past the scanner and nothing would have noticed. | |
| - name: Self-test the RNG hygiene guard | |
| run: ./scripts/test-rng-hygiene.sh | |
| - name: Check for silent RNG fallbacks and GCM IV reuse | |
| run: ./scripts/check-rng-hygiene.sh | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 | |
| - name: Install Android NDK | |
| run: sdkmanager --install "ndk;${{ env.NDK_VERSION }}" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| targets: aarch64-linux-android | |
| - name: Cache Rust | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| with: | |
| workspaces: keep/keep-mobile | |
| # The uniffi path assumes uniffi-bindgen only writes into the | |
| # io/privkey/keep/uniffi package (see build-rust.sh). release.yml has an | |
| # analogous cache keyed by github.sha for bit-for-bit reproducibility. | |
| - name: Cache Rust build outputs | |
| id: cache-rust-outputs | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| app/src/main/jniLibs | |
| app/src/main/kotlin/io/privkey/keep/uniffi | |
| key: rust-outputs-${{ runner.os }}-aarch64-linux-android-ndk${{ env.NDK_VERSION }}-rust${{ env.RUST_VERSION }}-ndkcargo${{ env.CARGO_NDK_VERSION }}-keep${{ hashFiles('keep.version') }}-lock${{ hashFiles('keep/Cargo.lock') }}-toolchain${{ hashFiles('keep/rust-toolchain.toml') }}-scripts${{ hashFiles('build-rust.sh', 'scripts/**/*.sh') }} | |
| - name: Install cargo-ndk | |
| uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2 | |
| with: | |
| tool: cargo-ndk@${{ env.CARGO_NDK_VERSION }} | |
| - name: Build native libraries | |
| if: steps.cache-rust-outputs.outputs.cache-hit != 'true' | |
| run: ./build-rust.sh | |
| env: | |
| KEEP_REPO: ${{ github.workspace }}/keep | |
| ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }} | |
| TARGETS: aarch64-linux-android | |
| AWS_LC_SYS_CMAKE_BUILDER: "1" | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 | |
| with: | |
| cache-read-only: ${{ github.event_name == 'pull_request' }} | |
| - name: Build, test, and lint | |
| run: ./gradlew assembleDebug testDebugUnitTest lintDebug --no-daemon | |
| - name: Verify no proprietary dependencies on release classpath | |
| run: ./gradlew :app:verifyNoProprietaryDeps --no-daemon | |
| instrumented-tests: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false) | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup keep checkout | |
| uses: ./.github/actions/setup-keep | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| - name: Verify toolchain version pins are consistent | |
| run: ./scripts/check-toolchain-pins.sh | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 | |
| - name: Install Android NDK | |
| run: sdkmanager --install "ndk;${{ env.NDK_VERSION }}" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| targets: x86_64-linux-android | |
| - name: Cache Rust | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 | |
| with: | |
| workspaces: keep/keep-mobile | |
| # See aarch64 job for rationale. | |
| - name: Cache Rust build outputs | |
| id: cache-rust-outputs | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| app/src/main/jniLibs | |
| app/src/main/kotlin/io/privkey/keep/uniffi | |
| key: rust-outputs-${{ runner.os }}-x86_64-linux-android-ndk${{ env.NDK_VERSION }}-rust${{ env.RUST_VERSION }}-ndkcargo${{ env.CARGO_NDK_VERSION }}-keep${{ hashFiles('keep.version') }}-lock${{ hashFiles('keep/Cargo.lock') }}-toolchain${{ hashFiles('keep/rust-toolchain.toml') }}-scripts${{ hashFiles('build-rust.sh', 'scripts/**/*.sh') }} | |
| - name: Install cargo-ndk | |
| uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2 | |
| with: | |
| tool: cargo-ndk@${{ env.CARGO_NDK_VERSION }} | |
| - name: Build native libraries | |
| if: steps.cache-rust-outputs.outputs.cache-hit != 'true' | |
| run: ./build-rust.sh | |
| env: | |
| KEEP_REPO: ${{ github.workspace }}/keep | |
| ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }} | |
| TARGETS: x86_64-linux-android | |
| AWS_LC_SYS_CMAKE_BUILDER: "1" | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 | |
| with: | |
| cache-read-only: ${{ github.event_name == 'pull_request' }} | |
| - name: Free up disk space for emulator | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/local/share/boost /usr/local/share/powershell /usr/share/swift /opt/hostedtoolcache/CodeQL || true | |
| sudo docker image prune --all --force || true | |
| df -h / | |
| - name: Enable KVM | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| - name: Run instrumented tests | |
| uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2 | |
| env: | |
| KEEP_REPO: ${{ github.workspace }}/keep | |
| ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }} | |
| TARGETS: x86_64-linux-android | |
| AWS_LC_SYS_CMAKE_BUILDER: "1" | |
| with: | |
| api-level: 33 | |
| arch: x86_64 | |
| target: google_apis | |
| profile: pixel_6 | |
| script: ./gradlew connectedDebugAndroidTest --no-daemon |