Merge branch 'main' into vault-16845-oss

.github/scripts/generate-test-package-lists.sh

@@ -46,6 +46,7 @@ test_packages[4]+=" $base/http"
 test_packages[4]+=" $base/sdk/helper/pluginutil"
 test_packages[4]+=" $base/serviceregistration/kubernetes"
 test_packages[4]+=" $base/tools/godoctests/pkg/analyzer"
+test_packages[4]+=" $base/tools/gonilnilfunctions/pkg/analyzer"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[4]+=" $base/vault/external_tests/apilock"
     test_packages[4]+=" $base/vault/external_tests/filteredpaths"
@@ -146,6 +147,7 @@ test_packages[6]+=" $base/sdk/helper/kdf"
 test_packages[6]+=" $base/sdk/helper/locksutil"
 test_packages[6]+=" $base/sdk/helper/pathmanager"
 test_packages[6]+=" $base/sdk/helper/roottoken"
+test_packages[6]+=" $base/sdk/helper/testhelpers"
 test_packages[6]+=" $base/sdk/helper/testhelpers/schema"
 test_packages[6]+=" $base/sdk/helper/xor"
 test_packages[6]+=" $base/sdk/physical/file"
@@ -276,6 +278,7 @@ test_packages[15]+=" $base/physical/mysql"
 test_packages[15]+=" $base/plugins/database/cassandra"
 if [ "${ENTERPRISE:+x}" == "x" ] ; then
     test_packages[15]+=" $base/vault/external_tests/namespaces"
+    test_packages[15]+=" $base/vault/external_tests/census"
 fi
 test_packages[15]+=" $base/vault/external_tests/sealmigrationext"
 

.github/scripts/test-generate-test-package-lists.sh

@@ -21,23 +21,11 @@ dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 source generate-test-package-lists.sh
 
 get_module_packages() {
-    local package_list=($(go list -test -json ./... | jq -r '.ForTest | select(.!=null)' | grep -v vault/integ | grep '^github.com/hashicorp/'))
-
-    for package in "${package_list[@]}" ; do
-        # Check if the current package already exists in all_packages
-        if ! grep "\b$package\b" <<< "${all_packages[@]}" &> /dev/null; then
-            all_packages+=($package)
-        fi
-    done
-}
-
-find_packages() {
-    for package in "${all_packages[@]}" ; do
-        if ! grep "\b${package}\b" <<< "${test_packages[@]}" &> /dev/null ; then
-            echo "Error: package ${package} is not present in test_packages"
-            exit 1
-        fi
-    done
+    for d in "../.." "../../sdk" "../../api"; do
+        cd "$dir/$d"
+        go list -test -json ./... | jq -r '.ForTest | select(.!=null)' |
+          grep -v vault/integ | grep '^github.com/hashicorp/'
+    done |sort -u
 }
 
 count_test_packages() {
@@ -49,18 +37,24 @@ count_test_packages() {
     echo $count
 }
 
-all_packages=()
-
-cd "$dir/../.."
-get_module_packages
-
-cd "$dir/../../sdk"
-get_module_packages
+contains() {
+    target=$1; shift
+    for i; do
+        if [[ "$i" == "$target" ]]; then
+            return 0
+        fi
+    done
+    return 1
+}
 
-cd "$dir/../../api"
-get_module_packages
+all_packages=( $(get_module_packages) )
 
-find_packages
+for package in "${all_packages[@]}" ; do
+    if ! contains $package ${test_packages[@]}; then
+        echo "Error: package ${package} is not present in test_packages"
+        exit 1
+    fi
+done
 
 test_package_count=$(count_test_packages)
 if (( ${#all_packages[@]} != $test_package_count )) ; then
@@ -72,4 +66,5 @@ if (( ${#all_packages[@]} != $test_package_count )) ; then
     done
 
     echo "Packages in test_packages that aren't used: ${unused_packages// /}"
+    exit 1
 fi

.github/workflows/ci.yml

@@ -294,6 +294,7 @@ jobs:
   tests-completed:
     needs:
     - setup
+    - setup-go-cache
     - test-go
     - test-ui
     if: always()

.github/workflows/nil-nil-function-checker.yml

@@ -0,0 +1,26 @@
+name: Check Functions For nil, nil returns
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    # Runs on PRs to main
+    branches:
+      - main
+
+jobs:
+  # Note: if there is a function we want to ignore this check for,
+  # You can add 'ignore-nil-nil-function-check' somewhere in the
+  # godoc for the function.
+  nil-nil-function-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+        with:
+          fetch-depth: 0
+      - name: Set Up Go
+        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+        with:
+          cache: true
+          go-version-file: ./.go-version
+      - name: Verify functions don't return nil, nil
+        run: make ci-vet-gonilnilfunctions

.github/workflows/test-go.yml

@@ -44,10 +44,43 @@ jobs:
   test-generate-test-package-list:
     runs-on: ${{ fromJSON(inputs.runs-on) }}
     name: Verify Test Package Distribution
+    permissions:
+      id-token: write  # Note: this permission is explicitly required for Vault auth
+      contents: read
     steps:
     - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+    - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      with:
+        go-version-file: ./.go-version
+        cache: true
+    - name: Authenticate to Vault
+      id: vault-auth
+      if: github.repository == 'hashicorp/vault-enterprise'
+      run: vault-auth
+    - name: Fetch Secrets
+      id: secrets
+      if: github.repository == 'hashicorp/vault-enterprise'
+      uses: hashicorp/vault-action@130d1f5f4fe645bb6c83e4225c04d64cfb62de6e
+      with:
+        url: ${{ steps.vault-auth.outputs.addr }}
+        caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+        token: ${{ steps.vault-auth.outputs.token }}
+        secrets: |
+          kv/data/github/${{ github.repository }}/github-token username-and-token | github-token;
+    - id: setup-git-private
+      name: Setup Git configuration (private)
+      if: github.repository == 'hashicorp/vault-enterprise'
+      run: |
+        git config --global url."https://${{ steps.secrets.outputs.github-token }}@github.com".insteadOf https://github.com
+    - id: setup-git-public
+      name: Setup Git configuration (public)
+      if: github.repository != 'hashicorp/vault-enterprise'
+      run: |
+        git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
     - id: test
       working-directory: .github/scripts
+      env:
+        GOPRIVATE: github.com/hashicorp/*
       run: |
         ENTERPRISE=${{ inputs.enterprise }} ./test-generate-test-package-lists.sh
   runner-indexes:

.gitignore

@@ -61,6 +61,7 @@ Vagrantfile
 
 # Enos
 enos/.enos
+enos/enos-local.vars.hcl
 enos/support
 # Enos local Terraform files
 enos/.terraform/*
@@ -132,3 +133,5 @@ website/components/node_modules
 *.log
 
 tools/godoctests/.bin
+tools/gonilnilfunctions/.bin
+

.go-version

@@ -1 +1 @@
-1.20.4
+1.20.5

.release/ci.hcl

@@ -32,145 +32,13 @@ event "build" {
   }
 }
 
-event "upload-dev" {
+event "prepare" {
   depends = ["build"]
-  action "upload-dev" {
+  action "prepare" {
     organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "upload-dev"
-    depends = ["build"]
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "quality-tests" {
-  depends = ["upload-dev"]
-  action "quality-tests" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "quality-tests"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "security-scan-binaries" {
-  depends = ["quality-tests"]
-  action "security-scan-binaries" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "security-scan-binaries"
-    config = "security-scan.hcl"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "security-scan-containers" {
-  depends = ["security-scan-binaries"]
-  action "security-scan-containers" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "security-scan-containers"
-    config = "security-scan.hcl"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "notarize-darwin-amd64" {
-  depends = ["security-scan-containers"]
-  action "notarize-darwin-amd64" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "notarize-darwin-amd64"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "notarize-darwin-arm64" {
-  depends = ["notarize-darwin-amd64"]
-  action "notarize-darwin-arm64" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "notarize-darwin-arm64"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "notarize-windows-386" {
-  depends = ["notarize-darwin-arm64"]
-  action "notarize-windows-386" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "notarize-windows-386"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "notarize-windows-amd64" {
-  depends = ["notarize-windows-386"]
-  action "notarize-windows-amd64" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "notarize-windows-amd64"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "sign" {
-  depends = ["notarize-windows-amd64"]
-  action "sign" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "sign"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "sign-linux-rpms" {
-  depends = ["sign"]
-  action "sign-linux-rpms" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "sign-linux-rpms"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "verify" {
-  depends = ["sign-linux-rpms"]
-  action "verify" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "verify"
+    repository   = "crt-workflows-common"
+    workflow     = "prepare"
+    depends      = ["build"]
   }
 
   notification {
@@ -179,7 +47,7 @@ event "verify" {
 }
 
 event "enos-release-testing-oss" {
-  depends = ["verify"]
+  depends = ["prepare"]
   action "enos-release-testing-oss" {
     organization = "hashicorp"
     repository = "vault"