[CI] Adopt GitHub actions

.editorconfig

@@ -0,0 +1,13 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+
+[*.yml]
+indent_style = space
+indent_size = 2

.github/workflows/main.yml

@@ -0,0 +1,26 @@
+name: Main
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  unit-tests:
+    name: Unit tests
+    uses: ./.github/workflows/unit_tests.yml
+    with:
+      linux_5_8_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_5_9_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_5_10_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_nightly_6_0_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_nightly_main_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+
+  benchmarks:
+    name: Benchmarks
+    uses: ./.github/workflows/benchmarks.yml
+    with:
+      benchmark_package_path: "Benchmarks"
+
+  cxx-interop:
+    name: Cxx interop
+    uses: ./.github/workflows/cxx_interop.yml

.github/workflows/pull_request.yml

@@ -0,0 +1,39 @@
+name: PR
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+jobs:
+  soundness:
+    name: Soundness
+    uses: apple/swift-nio/.github/workflows/soundness.yml@main
+    with:
+      license_header_check_project_name: "SwiftCertificates"
+
+  cmake-lists:
+    name: Check cmake lists
+    uses: apple/swift-nio/.github/workflows/swift_matrix.yml@main
+    with:
+      name: "Check cmake lists"
+      matrix_linux_command: ./scripts/check-cmake-lists.sh"
+
+  unit-tests:
+    name: Unit tests
+    uses: apple/swift-nio/.github/workflows/unit_tests.yml@main
+    with:
+      linux_5_8_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_5_9_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_5_10_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_nightly_6_0_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_nightly_main_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+
+  benchmarks:
+    name: Benchmarks
+    uses: apple/swift-nio/.github/workflows/benchmarks.yml@main
+    with:
+      benchmark_package_path: "Benchmarks"
+
+  swift-6-language-mode:
+    name: Swift 6 Language Mode
+    uses: apple/swift-nio/.github/workflows/swift_6_language_mode.yml@main

.github/workflows/pull_request_label.yml

@@ -0,0 +1,18 @@
+name: PR label
+
+on:
+  pull_request:
+    types: [labeled, unlabeled, opened, reopened, synchronize]
+
+jobs:
+  semver-label-check:
+    name: Semantic Version label check
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Check for Semantic Version label
+        uses: apple/swift-nio/.github/actions/pull_request_semver_label_checker@main

.github/workflows/scheduled.yml

@@ -0,0 +1,22 @@
+name: Scheduled
+
+on:
+  schedule:
+    - cron: "0 8,20 * * *"
+
+jobs:
+  unit-tests:
+    name: Unit tests
+    uses: ./.github/workflows/unit_tests.yml
+    with:
+      linux_5_8_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_5_9_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_5_10_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_nightly_6_0_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+      linux_nightly_main_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error"
+
+  benchmarks:
+    name: Benchmarks
+    uses: ./.github/workflows/benchmarks.yml
+    with:
+      benchmark_package_path: "Benchmarks"

.licenseignore

@@ -0,0 +1,35 @@
+.gitignore
+**/.gitignore
+.licenseignore
+.gitattributes
+.git-blame-ignore-revs
+.mailfilter
+.mailmap
+.spi.yml
+.swift-format
+.editorconfig
+.github/*
+*.md
+*.txt
+*.yml
+*.yaml
+*.json
+Package.swift
+**/Package.swift
+Package@-*.swift
+**/Package@-*.swift
+Package.resolved
+**/Package.resolved
+Makefile
+*.modulemap
+**/*.modulemap
+**/*.docc/*
+*.xcprivacy
+**/*.xcprivacy
+*.symlink
+**/*.symlink
+Dockerfile
+**/Dockerfile
+Snippets/*
+dev/git.commit.template
+dev/update-benchmark-thresholds.template

Benchmarks/Package.swift

@@ -18,12 +18,12 @@ import PackageDescription
 let package = Package(
     name: "benchmarks",
     platforms: [
-        .macOS(.v13),
+        .macOS(.v13)
     ],
     dependencies: [
         .package(path: "../"),
         .package(url: "https://github.com/ordo-one/package-benchmark.git", from: "1.11.1"),
-        .package(url: "https://github.com/apple/swift-crypto.git", "2.5.0" ..< "4.0.0"),
+        .package(url: "https://github.com/apple/swift-crypto.git", "2.5.0"..<"4.0.0"),
         .package(url: "https://github.com/apple/swift-asn1.git", from: "1.0.0"),
     ],
     targets: [
@@ -37,11 +37,11 @@ let package = Package(
             ],
             path: "Benchmarks/CertificatesBenchmark",
             resources: [
-                .copy("ca-certificates/"),
+                .copy("ca-certificates/")
             ],
             plugins: [
                 .plugin(name: "BenchmarkPlugin", package: "package-benchmark")
             ]
-        ),
+        )
     ]
 )

Benchmarks/Thresholds/nightly-main/CertificatesBenchmark.Parse_WebPKI_Roots_from_DER.p90.json

@@ -0,0 +1,6 @@
+{
+  "mallocCountTotal" : 4851,
+  "memoryLeaked" : 0,
+  "readSyscalls" : 0,
+  "writeSyscalls" : 0
+}

Benchmarks/Thresholds/nightly-main/CertificatesBenchmark.Parse_WebPKI_Roots_from_PEM_files.p90.json

@@ -0,0 +1,6 @@
+{
+  "mallocCountTotal" : 5810,
+  "memoryLeaked" : 0,
+  "readSyscalls" : 0,
+  "writeSyscalls" : 0
+}

Benchmarks/Thresholds/nightly-main/CertificatesBenchmark.Parse_WebPKI_Roots_from_multi_PEM_file.p90.json

@@ -0,0 +1,6 @@
+{
+  "mallocCountTotal" : 5818,
+  "memoryLeaked" : 0,
+  "readSyscalls" : 0,
+  "writeSyscalls" : 0
+}

Benchmarks/Thresholds/nightly-main/CertificatesBenchmark.TinyArray.append.p90.json

@@ -0,0 +1,6 @@
+{
+  "mallocCountTotal" : 26,
+  "memoryLeaked" : 0,
+  "readSyscalls" : 0,
+  "writeSyscalls" : 0
+}

Benchmarks/Thresholds/nightly-main/CertificatesBenchmark.TinyArray_non-allocating_functions.p90.json

@@ -0,0 +1,6 @@
+{
+  "mallocCountTotal" : 16,
+  "memoryLeaked" : 0,
+  "readSyscalls" : 0,
+  "writeSyscalls" : 0
+}

Benchmarks/Thresholds/nightly-main/CertificatesBenchmark.Verifier.p90.json

@@ -0,0 +1,6 @@
+{
+  "mallocCountTotal" : 1251,
+  "memoryLeaked" : 0,
+  "readSyscalls" : 0,
+  "writeSyscalls" : 0
+}

CONTRIBUTING.md

@@ -60,29 +60,6 @@ We require that your commit messages match our template. The easiest way to do t
 
     git config commit.template dev/git.commit.template
 
-### Run `./scripts/soundness.sh`
-
-The scripts directory contains a [soundness.sh script](https://github.com/apple/swift-certificates/blob/main/scripts/soundness.sh) 
-that enforces additional checks, like license headers and formatting style.
-
-Please make sure to `./scripts/soundness.sh` before pushing a change upstream, otherwise it is likely the PR validation will fail
-on minor changes such as a missing `self.` or similar formatting issues.
-
-For frequent contributors, we recommend adding the script as a [git pre-push hook](https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks), which you can do via executing the following command in the project root directory: 
-
-```bash
-cat << EOF > .git/hooks/pre-push
-
-if [[ -f "scripts/soundness.sh" ]]; then
-  scripts/soundness.sh
-fi
-EOF
-```
-
-Which makes the script execute, and only allow the `git push` to complete if the check has passed.
-
-In the case of formatting issues, you can then `git add` the formatting changes, and attempt the push again. 
-
 ## How to contribute your work
 
 Please open a pull request at https://github.com/apple/swift-certificates. Make sure the CI passes, and then wait for code review.

Package.swift

@@ -27,7 +27,8 @@ let package = Package(
     products: [
         .library(
             name: "X509",
-            targets: ["X509"]),
+            targets: ["X509"]
+        )
     ],
     targets: [
         .target(
@@ -39,34 +40,39 @@ let package = Package(
                 .product(name: "_CryptoExtras", package: "swift-crypto"),
             ],
             exclude: [
-                "CMakeLists.txt",
-            ]),
+                "CMakeLists.txt"
+            ]
+        ),
         .testTarget(
             name: "X509Tests",
             dependencies: [
                 "X509",
                 .product(name: "SwiftASN1", package: "swift-asn1"),
                 .product(name: "Crypto", package: "swift-crypto"),
-            ], resources: [
+            ],
+            resources: [
                 .copy("OCSP Test Resources/www.apple.com.root.der"),
                 .copy("OCSP Test Resources/www.apple.com.intermediate.der"),
                 .copy("OCSP Test Resources/www.apple.com.der"),
                 .copy("OCSP Test Resources/www.apple.com.ocsp-response.der"),
                 .copy("OCSP Test Resources/www.apple.com.intermediate.ocsp-response.der"),
                 .copy("PEMTestRSACertificate.pem"),
                 .copy("CSR Vectors/"),
-                .copy("ca-certificates.crt")
-            ]),
+                .copy("ca-certificates.crt"),
+            ]
+        ),
         .target(
             name: "_CertificateInternals",
             exclude: [
-                "CMakeLists.txt",
-            ]),
+                "CMakeLists.txt"
+            ]
+        ),
         .testTarget(
             name: "CertificateInternalsTests",
             dependencies: [
-                "_CertificateInternals",
-            ]),
+                "_CertificateInternals"
+            ]
+        ),
     ]
 )
 
@@ -75,9 +81,8 @@ let package = Package(
 // we can depend on local versions of our dependencies instead of fetching them remotely.
 if ProcessInfo.processInfo.environment["SWIFTCI_USE_LOCAL_DEPS"] == nil {
     package.dependencies += [
-        .package(url: "https://github.com/apple/swift-crypto.git", "2.5.0" ..< "4.0.0"),
+        .package(url: "https://github.com/apple/swift-crypto.git", "2.5.0"..<"4.0.0"),
         .package(url: "https://github.com/apple/swift-asn1.git", from: "1.1.0"),
-        .package(url: "https://github.com/apple/swift-docc-plugin.git", from: "1.0.0"),
     ]
 } else {
     package.dependencies += [

Tests/X509Tests/VerifierTests.swift

@@ -328,9 +328,9 @@ final class VerifierTests: XCTestCase {
         )
     }()
 
-    // MARK: Deeply insane PKI
+    // MARK: Deeply crazy PKI
     //
-    // This section defines a deeply insane PKI. The PKI has one root CA and two intermediate CAs, and looks roughly like this:
+    // This section defines a deeply crazy PKI. The PKI has one root CA and two intermediate CAs, and looks roughly like this:
     //
     //                       ┌────────────────┐
     //                       │                │
@@ -383,7 +383,7 @@ final class VerifierTests: XCTestCase {
     //
     // Finally, we need two Xs that are considered "different" so that chain building doesn't fail. We differ them by using SAN.
     //
-    // The following section builds this absolutely insane PKI. We re-use `ca1` defined above as our root CA.
+    // The following section builds this absolutely crazy PKI. We re-use `ca1` defined above as our root CA.
     private static let t1t2Key = P256.Signing.PrivateKey()
     private static let t3Key = P256.Signing.PrivateKey()
     private static let xKey = P256.Signing.PrivateKey()