diff --git a/.github/workflows/xtest.yml b/.github/workflows/xtest.yml
index 773448892..59350831f 100644
--- a/.github/workflows/xtest.yml
+++ b/.github/workflows/xtest.yml
@@ -28,6 +28,11 @@ on:
type: string
default: all
description: "SDK to focus on (go, js, java, all)"
+ otdfctl-source:
+ required: false
+ type: string
+ default: auto
+ description: "otdfctl source: 'auto' (standalone for releases, detect platform for head builds), 'standalone', or 'platform'"
workflow_call:
inputs:
platform-ref:
@@ -50,6 +55,10 @@ on:
required: false
type: string
default: all
+ otdfctl-source:
+ required: false
+ type: string
+ default: auto
schedule:
- cron: "30 6 * * *" # 0630 UTC
- cron: "0 5 * * 1,3" # 500 UTC (Monday, Wednesday)
@@ -78,6 +87,14 @@ jobs:
JS_REF: "${{ inputs.js-ref }}"
OTDFCTL_REF: "${{ inputs.otdfctl-ref }}"
JAVA_REF: "${{ inputs.java-ref }}"
+ # When explicitly set to 'platform', tells the Go resolver to resolve
+ # against opentdf/platform tags instead of the standalone otdfctl repo.
+ # In 'auto' mode, releases resolve from standalone; the detect-otdfctl
+ # step later probes the platform checkout for an embedded otdfctl
+ # directory, and setup-cli-tool acts on this only for versions that need
+ # a source checkout (head or artifact-install failure), reusing the
+ # platform checkout only when the resolved SHA matches.
+ OTDFCTL_SOURCE: "${{ inputs.otdfctl-source == 'platform' && 'platform' || '' }}"
steps:
- name: Validate focus-sdk input
if: ${{ inputs.focus-sdk != '' }}
@@ -116,6 +133,7 @@ jobs:
sparse-checkout: |
xtest/sdk
otdf-sdk-mgr
+ otdf-local
- uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
with:
python-version: "3.14"
@@ -170,7 +188,7 @@ jobs:
core.summary.addHeading('Versions under Test', 3);
- function artifactLink(sdkType, tag, release, head) {
+ function artifactLink(sdkType, tag, release, head, source) {
if (head || !release) return '';
const v = tag.replace(/^v/, '');
if (sdkType === 'js') {
@@ -182,7 +200,10 @@ jobs:
return `Maven Central`;
}
if (sdkType === 'go') {
- const url = `https://pkg.go.dev/github.com/opentdf/otdfctl@${encodeURIComponent(tag)}`;
+ const modulePath = source === 'platform'
+ ? `github.com/opentdf/platform/otdfctl`
+ : `github.com/opentdf/otdfctl`;
+ const url = `https://pkg.go.dev/${modulePath}@${encodeURIComponent(tag)}`;
return `pkg.go.dev`;
}
return '';
@@ -198,14 +219,15 @@ jobs:
const tagToSha = {};
const headTags = [];
- for (const { tag, head, sha, alias, err, release } of refInfo) {
- const sdkRepoUrl = `https://github.com/opentdf/${encodeURIComponent(sdkType == 'js' ? 'web-sdk' : sdkType == 'go' ? 'otdfctl' : sdkType == 'java' ? 'java-sdk' : sdkType)}`;
+ for (const { tag, head, sha, alias, err, release, source } of refInfo) {
+ const goRepoName = source === 'platform' ? 'platform' : 'otdfctl';
+ const sdkRepoUrl = `https://github.com/opentdf/${encodeURIComponent(sdkType == 'js' ? 'web-sdk' : sdkType == 'go' ? goRepoName : sdkType == 'java' ? 'java-sdk' : sdkType)}`;
const sdkLink = `${htmlEscape(sdkType)}`;
const commitLink = sha ? `${htmlEscape(sha.substring(0, 7))}` : ' . ';
const tagLink = (release && tag)
? `${htmlEscape(tag)}`
: tag ? htmlEscape(tag) : 'N/A';
- const artifactCell = artifactLink(sdkType, tag, release, head);
+ const artifactCell = artifactLink(sdkType, tag, release, head, source);
table.push([sdkLink, tagLink, commitLink, alias || 'N/A', artifactCell || 'N/A', err || 'N/A']);
if (err) {
errorCount += 1;
@@ -231,6 +253,76 @@ jobs:
throw new Error('Errors detected in version resolution. Failing the run.');
}
+ - name: Generate xtest configs
+ id: xtest-configs
+ continue-on-error: true
+ shell: bash
+ run: |
+ set +e # Don't abort on errors; this step is supplementary
+ OTDF_LOCAL_DIR="${GITHUB_WORKSPACE}/otdf-sdk/otdf-local"
+ FOCUS_SDK="${FOCUS_SDK_INPUT:-all}"
+ OTDFCTL_SRC="${OTDFCTL_SOURCE_INPUT:-auto}"
+ GO_REFS="${OTDFCTL_REF:-${DEFAULT_TAGS}}"
+ JS_REFS="${JS_REF:-${DEFAULT_TAGS}}"
+ JAVA_REFS="${JAVA_REF:-${DEFAULT_TAGS}}"
+
+ mkdir -p xtest-configs
+
+ # Generate one config per (platform-tag, sdk) matrix cell
+ PLATFORM_TAGS=$(echo "$PLATFORM_TAG_LIST_JSON" | jq -r '.[]')
+ for ptag in $PLATFORM_TAGS; do
+ for sdk in go java js; do
+ CONFIG_FILE="xtest-configs/${sdk}-${ptag}.yaml"
+ echo "Generating config: $CONFIG_FILE"
+ uv run --project "$OTDF_LOCAL_DIR" otdf-local xtest resolve \
+ --platform-ref "$ptag" \
+ --go-ref "$GO_REFS" \
+ --js-ref "$JS_REFS" \
+ --java-ref "$JAVA_REFS" \
+ --focus-sdk "$FOCUS_SDK" \
+ --otdfctl-source "$OTDFCTL_SRC" \
+ --output "$CONFIG_FILE" || echo "Warning: config generation failed for ${sdk}-${ptag}"
+ # Patch encrypt-sdk to match the matrix cell
+ if [ -f "$CONFIG_FILE" ]; then
+ sed -i "s/^encrypt-sdk:.*/encrypt-sdk: ${sdk}/" "$CONFIG_FILE"
+ fi
+ done
+ done
+
+ # Emit a sample config to step summary for local reproduction
+ SAMPLE=$(ls xtest-configs/*.yaml 2>/dev/null | head -1)
+ if [ -n "$SAMPLE" ]; then
+ {
+ echo 'Reproduce locally (xtest config)
'
+ echo ''
+ echo '```yaml'
+ cat "$SAMPLE"
+ echo '```'
+ echo ''
+ echo '**To reproduce locally:**'
+ echo '```bash'
+ echo '# Save the above YAML to a file, then:'
+ echo 'cd tests/otdf-local'
+ echo 'uv run otdf-local xtest run ../xtest-config.yaml'
+ echo '```'
+ echo 'Reproduce this failure locally
'
+ echo ''
+ echo '```yaml'
+ cat "$CONFIG"
+ echo '```'
+ echo ''
+ echo '**To reproduce:**'
+ echo '```bash'
+ echo "cat > xtest-config.yaml <<'EOF'"
+ cat "$CONFIG"
+ echo 'EOF'
+ echo 'cd tests/otdf-local'
+ echo 'uv run otdf-local xtest run ../../xtest-config.yaml'
+ echo '```'
+ echo '