Skip to content

Add Elixir SDK with precompiled NIFs - #416

Merged
domenkozar merged 20 commits into
cachix:mainfrom
sylvesterroos:main
Oct 21, 2026
Merged

Add Elixir SDK with precompiled NIFs#416
domenkozar merged 20 commits into
cachix:mainfrom
sylvesterroos:main

Conversation

@sylvesterroos

@sylvesterroos sylvesterroos commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Introduce secretspec-ex, a Rustler binding that calls the shared Rust resolver from Elixir. Add a release workflow that attaches precompiled NIF archives to GitHub Releases and publishes the package to Hex.pm, and include the SDK in workspace and devenv setup.

I've tried my best to match the layout of the other SDKs, but I might have missed something.

domenkozar
domenkozar reviewed Sep 1, 2026
View reviewed changes

@domenkozar domenkozar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found several release, aggregate-test, source-build, and cleanup issues. Details are inline.

Comment thread .github/workflows/elixir-package.yml Outdated
Comment thread .github/workflows/elixir-package.yml Outdated
Comment thread .github/workflows/elixir-package.yml Outdated
Comment thread scripts/ci-sdks.sh Outdated
Comment thread .github/workflows/elixir-package.yml Outdated
Comment thread secretspec-ex/native/secretspec_native/Cargo.toml Outdated
Comment thread secretspec-ex/lib/secret_spec/resolved.ex Outdated
Comment thread .github/workflows/pre-release.yml
sylvesterroos added a commit to sylvesterroos/secretspec that referenced this pull request Sep 2, 2026
@sylvesterroos
Address PR cachix#416 review findings for the Elixir SDK
0db4dba 
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability
- Align CARGO_TARGET_DIR with rustler-precompiled-action expectations
- Include the Windows archive in release asset discovery
- Add a pre_release input and release-PR guards to the Elixir workflow
- Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh
- Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD
  source-build path and ship no native/ sources to consumers
- Use workspace inheritance in the native crate manifest, matching the
  other native SDK crates
- Continue cleanup after a file-removal error in Resolved.close/1
domenkozar
domenkozar reviewed Sep 4, 2026
View reviewed changes
Comment thread secretspec-ex/lib/secret_spec/native.ex Outdated
domenkozar
domenkozar reviewed Sep 4, 2026
View reviewed changes
Comment thread secretspec-ex/lib/secret_spec/builder.ex Outdated
domenkozar
domenkozar reviewed Sep 4, 2026
View reviewed changes
Comment thread secretspec-ex/lib/secret_spec.ex Outdated
domenkozar
domenkozar reviewed Sep 4, 2026
View reviewed changes
Comment thread secretspec-ex/lib/secret_spec.ex Outdated
domenkozar
domenkozar reviewed Sep 4, 2026
View reviewed changes
Comment thread CHANGELOG.md Outdated
domenkozar
domenkozar reviewed Sep 4, 2026
View reviewed changes
Comment thread docs/astro.config.ts
sylvesterroos added a commit to sylvesterroos/secretspec that referenced this pull request Sep 7, 2026
@sylvesterroos
Address PR cachix#416 review findings for the Elixir SDK
81d3727 
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability
- Align CARGO_TARGET_DIR with rustler-precompiled-action expectations
- Include the Windows archive in release asset discovery
- Add a pre_release input and release-PR guards to the Elixir workflow
- Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh
- Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD
  source-build path and ship no native/ sources to consumers
- Use workspace inheritance in the native crate manifest, matching the
  other native SDK crates
- Continue cleanup after a file-removal error in Resolved.close/1
@sylvesterroos
sylvesterroos force-pushed the main branch 2 times, most recently from cdefc99 to 108bc6d Compare September 7, 2026 17:23
sylvesterroos added a commit to sylvesterroos/secretspec that referenced this pull request Sep 16, 2026
@sylvesterroos
Address PR cachix#416 review findings for the Elixir SDK
d895266 
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability
- Align CARGO_TARGET_DIR with rustler-precompiled-action expectations
- Include the Windows archive in release asset discovery
- Add a pre_release input and release-PR guards to the Elixir workflow
- Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh
- Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD
  source-build path and ship no native/ sources to consumers
- Use workspace inheritance in the native crate manifest, matching the
  other native SDK crates
- Continue cleanup after a file-removal error in Resolved.close/1
@sylvesterroos
sylvesterroos force-pushed the main branch 2 times, most recently from 7561a2b to a692244 Compare September 17, 2026 07:27
@domenkozar

domenkozar commented Sep 21, 2026

Copy link
Copy Markdown
Member

I think this should be based on #362 otherwise we will have to maintain two protocols :(

@domenkozar
domenkozar marked this pull request as draft September 21, 2026 22:01
@sylvesterroos

sylvesterroos commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Sure no problem

sylvesterroos added a commit to sylvesterroos/secretspec that referenced this pull request Sep 22, 2026
@sylvesterroos
Address PR cachix#416 review findings for the Elixir SDK
fe45fd5 
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability
- Align CARGO_TARGET_DIR with rustler-precompiled-action expectations
- Include the Windows archive in release asset discovery
- Add a pre_release input and release-PR guards to the Elixir workflow
- Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh
- Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD
  source-build path and ship no native/ sources to consumers
- Use workspace inheritance in the native crate manifest, matching the
  other native SDK crates
- Continue cleanup after a file-removal error in Resolved.close/1
@sylvesterroos
Add Elixir SDK with precompiled NIFs
5c14d68 
Introduce secretspec-ex, a Rustler binding that calls the shared Rust resolver from Elixir. Add a release workflow that attaches precompiled NIF archives to GitHub Releases and publishes the package to Hex.pm, and include the SDK in workspace and devenv setup.
@sylvesterroos
Address PR cachix#416 review findings for the Elixir SDK
59e78e2 
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability
- Align CARGO_TARGET_DIR with rustler-precompiled-action expectations
- Include the Windows archive in release asset discovery
- Add a pre_release input and release-PR guards to the Elixir workflow
- Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh
- Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD
  source-build path and ship no native/ sources to consumers
- Use workspace inheritance in the native crate manifest, matching the
  other native SDK crates
- Continue cleanup after a file-removal error in Resolved.close/1
@sylvesterroos
Handle LastPass subprocess signals in Elixir SDK
9f3be59
@sylvesterroos
Complete Elixir SDK integration
7bbd2f7
@sylvesterroos
Expand Elixir SDK conformance coverage and harden tests
4ae73a6 
- Enumerate all conformance fixtures and validate resolve, no-values,
  and report projections per fixture (mirrors Node/Python SDKs)
- Add envelope hardening tests for unsupported schema_version and
  invalid envelopes in checked_envelope/3
- Replace builder change-detector test with observable profile
  selection behavior
- Convert bound function heads to do...end blocks per project style
@sylvesterroos
Gate the Elixir SIGCHLD flip on subprocess-capable requests and unify
c5c97c2 
NIF builds

The SIGCHLD restore now runs only when the request may reach a
subprocess-spawning provider, instead of on every native call. The gate
inspects the request's provider spec, inline aliases, per-secret chains,
profile defaults, and options; anything it cannot prove in-process
(aliases, bare names, unknown schemes) stays fail-safe and engages the
flip. Scheme lists mirror the core's provider registrations, including
akv, whose Azure CLI credential shells out via azure_identity.

The Elixir release workflow folds nif-linux and nif-native into one
matrix job matching the sibling SDK workflows, removing the duplicated
steps and the divergent toolchain pinning.
@sylvesterroos
sylvesterroos marked this pull request as ready for review September 23, 2026 10:29
@sylvesterroos

sylvesterroos commented Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Alright the SDK has been updated to IPC instead of the Rust core

@sylvesterroos

sylvesterroos commented Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

The versions still have to be updated to 0.22+ right?

@sylvesterroos
sylvesterroos marked this pull request as draft September 24, 2026 12:46
@sylvesterroos
Fix Elixir SDK IPC client review findings
c4d2d67 
- Offer absolute-max frame size (1 MiB) and 16 in-flight requests by
  default, configurable via :max_frame_bytes/:max_in_flight start
  options, clamped to protocol ranges; validate_limits stays as the
  safety net
- Reject literal CR anywhere in received frames per the wire contract
  (escaped \r in strings remains legal)
- Populate Secret.name from the requested secret name
- Return flat {:error, :executable_not_found} from Session.start
- Reply to queued get waiters when closing a session that is still
  starting
@sylvesterroos
sylvesterroos marked this pull request as ready for review October 5, 2026 09:47
@domenkozar
domenkozar merged commit 31e3dd9 into cachix:main Oct 21, 2026
90 of 91 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@domenkozar domenkozar Awaiting requested review from domenkozar

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sylvesterroos @domenkozar