Skip to content

Add integration test scripts and CI workflows (Lint, Build, and Integration Tests)#5

Merged
hyperfinitism merged 3 commits intomainfrom
ci/lint-build-test
Mar 14, 2026
Merged

Add integration test scripts and CI workflows (Lint, Build, and Integration Tests)#5
hyperfinitism merged 3 commits intomainfrom
ci/lint-build-test

Conversation

@hyperfinitism
Copy link
Owner

@hyperfinitism hyperfinitism commented Mar 14, 2026

Changes

  • Add integration test scripts (tests/) using swtpm (software TPM emulator) covering key lifecycle, attestation, ECC, NV, PCR, encryption/decryption, signing, sessions/policies, and more
  • Add GitHub Actions workflows for lint (rustfmt + clippy), build (multi-arch matrix), and integration tests
  • Fix lint errors in existing source

@hyperfinitism hyperfinitism self-assigned this Mar 14, 2026
@hyperfinitism hyperfinitism added the ci/cd CI/CD related items label Mar 14, 2026
@gemini-code-assist
Copy link

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the project's testing infrastructure and continuous integration capabilities. It introduces a robust set of integration tests that validate the tpm2-cli's interaction with a software TPM emulator across a wide range of commands. Concurrently, new GitHub Actions workflows automate code quality checks and ensure the reliability of the build and test processes, improving overall project stability and maintainability.

Highlights

  • Integration Test Suite: A comprehensive suite of integration tests has been added, utilizing swtpm (software TPM emulator) to cover a wide array of TPM functionalities including key lifecycle management, attestation, ECC operations, NV storage, PCRs, encryption/decryption, signing, and session/policy handling.
  • CI Workflows: New GitHub Actions workflows have been introduced to automate linting (rustfmt + clippy), multi-architecture builds, and the execution of the newly added integration tests, ensuring continuous code quality and functional validation.
  • Documentation Updates: The README.md has been updated with detailed instructions for setting up swtpm and running the integration tests, along with a caution regarding operations on native TPMs.
  • Code Quality Fixes: Minor linting errors in existing Rust source files have been addressed, improving code consistency and adherence to style guidelines.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • README.md
    • Updated 'Set up TPM device' section to clarify native TPM usage and add a caution
    • Added a new section 'Set up swtpm (software TPM simulator)' with installation and usage instructions
    • Added a new section 'Run integration tests' detailing how to execute the new test suite
  • src/cmd/create.rs
    • Reordered use statements for consistency
  • src/cmd/startauthsession.rs
    • Refactored SessionAttributesBuilder call for improved readability
  • tests/helpers.sh
    • Added a new shell script containing common functions for integration tests, including swtpm lifecycle management, test result reporting, and tpm2 binary execution
  • tests/run_all.sh
    • Added a new shell script to orchestrate the execution of all integration test suites, aggregate results, and generate GitHub Actions job summaries
  • tests/test_attestation.sh
    • Added integration tests for TPM attestation commands such as quote, checkquote, nvcertify, and getcommandauditdigest
  • tests/test_basic.sh
    • Added integration tests for fundamental TPM operations including startup, shutdown, getrandom, selftest, getcap, hash, rcdecode, and print
  • tests/test_duplicate_import.sh
    • Added placeholder integration tests for duplicate, import, unseal, and hmac commands, focusing on command parsing
  • tests/test_ecc.sh
    • Added integration tests for ECC-related TPM commands like geteccparameters, ecephemeral, and ecdhkeygen
  • tests/test_ek_ak.sh
    • Added integration tests for Endorsement Key (EK) and Attestation Key (AK) management, including createek, createak, makecredential, and activatecredential
  • tests/test_encrypt_decrypt.sh
    • Added integration tests for encryption and decryption commands such as rsaencrypt, encrypt, decrypt, encryptdecrypt, and rsadecrypt
  • tests/test_hierarchy.sh
    • Added integration tests for TPM hierarchy and administrative commands, including dictionarylockout, clear, clearcontrol, setprimarypolicy, clockrateadjust, setclock, changeeps, and changepps
  • tests/test_key_lifecycle.sh
    • Added integration tests for TPM key lifecycle operations, covering createprimary, create, load, readpublic, flushcontext, evictcontrol, changeauth, and loadexternal
  • tests/test_nv.sh
    • Added integration tests for Non-Volatile (NV) storage operations, including nvdefine, nvwrite, nvread, nvreadpublic, and nvundefine
  • tests/test_pcr.sh
    • Added integration tests for Platform Configuration Register (PCR) operations such as pcrread, pcrextend, and pcrreset
  • tests/test_session_policy.sh
    • Added integration tests for TPM sessions and policy commands, including startauthsession, sessionconfig, policyrestart, policypcr, policycommandcode, policyauthvalue, policypassword, policyor, policylocality, policynvwritten, createpolicy, policycountertimer, and policysecret
  • tests/test_sign_verify.sh
    • Added integration tests for TPM signing and verification commands, covering sign and verifysignature for both RSA and ECC keys
Ignored Files
  • Ignored by pattern: .github/workflows/** (4)
    • .github/workflows/build.yml
    • .github/workflows/lint.yml
    • .github/workflows/spdx.yml
    • .github/workflows/test.yml
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a comprehensive integration test suite using bash and swtpm, along with corresponding GitHub Actions workflows. This is a great addition for ensuring the tool's stability and correctness. The changes also include minor lint fixes in the Rust source code. My review focuses on the new test scripts, and I've provided a couple of suggestions to improve their robustness and clarity.

SWTPM_PID=$!

# Wait for swtpm to be ready.
for _ in $(seq 1 20); do

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The wait loop for swtpm has a fixed timeout of 2 seconds (20 * 0.1s). On a heavily loaded CI machine, swtpm might take longer to start up, which could lead to flaky tests when the script fails to connect to the socket. Consider increasing the timeout to make the tests more robust.

Suggested change
for _ in $(seq 1 20); do
for _ in $(seq 1 50); do

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will leave the code as-is until the identified issue actually occurs.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d345476c93

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

hyperfinitism and others added 3 commits March 15, 2026 06:30
Adds integration test scripts using the software TPM emulator swtpm.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
@hyperfinitism hyperfinitism merged commit e397b65 into main Mar 14, 2026
22 checks passed
@hyperfinitism hyperfinitism deleted the ci/lint-build-test branch March 14, 2026 21:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci/cd CI/CD related items

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant