Merge pull request #2221 from versity/sis/aws-compatible-iam

feat: add AWS-compatible standalone IAM service

.github/workflows/functional-iam-oidc.yml

@@ -0,0 +1,51 @@
+name: IAM functional tests (GitHub OIDC live)
+
+# This workflow exercises AssumeRoleWithWebIdentity against a REAL external
+# OIDC identity provider (GitHub Actions' own OIDC issuer) - the one publicly
+# reachable, free IdP available from inside our own CI job, so no self-hosted
+# IdP container is needed.
+#
+# Trigger stays plain `pull_request` (never pull_request_target or
+# workflow_run) plus `push` to main. On a pull_request run, GitHub itself
+# downgrades GITHUB_TOKEN/OIDC permissions to read-only whenever the PR
+# comes from a fork - regardless of what this file requests - so
+# ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN simply won't
+# exist in that case and the test below skips itself. That's the actual
+# security boundary here: a hostile fork-PR author cannot use their own PR
+# to mint a token scoped to this repo's identity through this workflow. Only
+# a same-repo (non-fork) pull_request run, or a push to main, gets real
+# credentials and actually exercises the live OIDC flow.
+permissions:
+  contents: read
+  id-token: write
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    name: RunIAMGitHubOIDCTest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "stable"
+        id: go
+
+      - name: Get Dependencies
+        run: |
+          go mod download
+
+      - name: Build
+        run: |
+          make testbin
+
+      - name: Run GitHub OIDC live web-identity and s3 session tests
+        run: |
+          ./runoidctests.sh

.github/workflows/functional-iam.yml

@@ -0,0 +1,50 @@
+name: IAM functional tests
+permissions:
+  contents: read
+on: pull_request
+
+jobs:
+  build:
+    name: RunIAMTests
+    runs-on: ubuntu-latest
+    services:
+      vault:
+        image: hashicorp/vault:1.21.4@sha256:6c77f568e6b6310d5bc68befb5711b9215c574de7da489e7c24332581176888b
+        env:
+          VAULT_ADDR: http://127.0.0.1:8200
+          VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
+          VAULT_DEV_ROOT_TOKEN_ID: iam-ci-root
+        ports:
+          - 8200:8200
+        options: >-
+          --cap-add=IPC_LOCK
+          --health-cmd "vault status"
+          --health-interval 2s
+          --health-timeout 2s
+          --health-retries 15
+    steps:
+
+    - name: Checkout
+      uses: actions/checkout@v6
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: 'stable'
+      id: go
+
+    - name: Get Dependencies
+      run: |
+        go mod download
+
+    - name: Build and Run
+      env:
+        VAULT_ADDR: http://127.0.0.1:8200
+        VAULT_TOKEN: iam-ci-root
+      run: |
+        make testbin
+        ./runiamtests.sh
+
+    - name: Coverage Report
+      run: |
+        go tool covdata percent -i=/tmp/iam.covdata,/tmp/iam.https.covdata,/tmp/iam.vault.covdata

.github/workflows/shellcheck.yml

@@ -23,5 +23,5 @@ jobs:
           if [ "$rc" -ne 0 ]; then
             overall_rc="$rc"
           fi
-        done < <(find . \( -path './tests/*.sh' -o -path './tests/*/*.sh' \) -print0)
+        done < <(find . \( -path './runiamtests.sh' -o -path './genmtlscerts.sh' -o -path './runoidctests.sh' -o -path './tests/*.sh' -o -path './tests/*/*.sh' \) -print0)
         exit "$overall_rc"