Skip to content

ci: run crate tests with cargo-nextest and Rust jobs on ev-runner-x-large #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matt-evervault merged 3 commits into from
Jul 28, 2026
Merged

ci: run crate tests with cargo-nextest and Rust jobs on ev-runner-x-large #233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f3f9f73
ci: run crate tests with cargo-nextest
claude Jul 9, 2026
d7b26a9
ci: run Rust compiler jobs on ev-runner-x-large
claude Jul 9, 2026
041aafb
Merge branch 'main' into claude/clippy-nextest-migration-a3o66j
matt-evervault Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .config/nextest.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# cargo-nextest configuration
# https://nexte.st/docs/configuration/
#
# A handful of enclave-build tests are annotated with `#[serial_test::serial]`
# because they share process-wide state (they write `cert.pem`/`key.pem` into,
# and build from, the crate's working directory). `serial_test` enforces this
# with an in-process mutex, which works under `cargo test` because all tests run
# in a single process.
#
# nextest runs each test in its own process, so that in-process mutex no longer
# serializes anything. The `serial` test group below restores the guarantee by
# allowing at most one of these tests to run at a time across the whole run,
# mirroring the previous `cargo test` behaviour.
[test-groups]
serial = { max-threads = 1 }

[[profile.default.overrides]]
filter = 'test(test_choose_output_dir) | test(test_reproducible_enclave_builds_with_pinned_version)'
test-group = 'serial'
2 changes: 1 addition & 1 deletion .github/workflows/build-and-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ permissions:
contents: read
jobs:
build-linux:
runs-on: ubuntu-latest
runs-on: ev-runner-x-large
strategy:
fail-fast: false
matrix:
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/lint-and-test-cli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,26 @@

jobs:
clippy_check_cli:
runs-on: ubuntu-latest
runs-on: ev-runner-x-large
steps:
- uses: actions/checkout@v7
- uses: actions-hub/docker/cli@f5fdbfc3f9d2a9265ead8962c1314108a7b7ec5d
env:
SKIP_LOGIN: true
- uses: actions-rs/toolchain@v1
with:
toolchain: stable
components: rustfmt, clippy
- name: Install nextest
uses: taiki-e/install-action@nextest

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'Lint and Test crates' step
Uses Step
Loading
uses 'taiki-e/install-action' with ref 'nextest', not a pinned commit hash
- name: Compile project
run: cargo build
- name: Prepare pcr-sign package for integration testing
run: |
cd crates/pcr-sign
sh ./scripts/generate-test-signature.sh
- name: Test project
run: cargo test -p ev-cli -p ev-enclave
run: cargo nextest run -p ev-cli -p ev-enclave
- name: Format project
run: cargo fmt --check
- name: Lint project
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/release-cli-version-staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,23 @@

jobs:
clippy_check_cli:
runs-on: ubuntu-latest
runs-on: ev-runner-x-large
steps:
- uses: actions/checkout@v7
- uses: actions-hub/docker/cli@f5fdbfc3f9d2a9265ead8962c1314108a7b7ec5d
env:
SKIP_LOGIN: true
- uses: actions-rs/toolchain@v1
with:
toolchain: stable
override: true
components: rustfmt, clippy
- name: Install nextest
uses: taiki-e/install-action@nextest

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'release-cli-version-staging.yml' step
Uses Step
Loading
uses 'taiki-e/install-action' with ref 'nextest', not a pinned commit hash
- name: Compile project
run: cargo build
- name: Test project
run: cargo test -p ev-cli -p ev-enclave
run: cargo nextest run -p ev-cli -p ev-enclave

@alexander-rw alexander-rw Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we also add this in a precommit hook if we have one that runs tests? i worry about tests running locally being different to what runs in the cloud

@alexander-rw alexander-rw Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or is there any way for us to proxy cargo test to nextest in the background

@matt-evervault matt-evervault Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can, I don't love precommit hooks for tests. I think they work better for things that run almost instantly, such as formatting. I don't believe we can replace what the default cargo test action does :( I think this will be fine, nextest is setup in most if not all of our rust repos, so if it did fail in CI but not locally, a developer could then run nextest locally and get the faster/prettier output; the other main difference is running tests in parallel.

- name: Format project
run: cargo fmt --check
- name: Lint project
Expand Down
Loading