Add Elixir SDK with precompiled NIFs - #416
Open
sylvesterroos wants to merge 6 commits into
Open
Conversation
domenkozar
reviewed
Sep 1, 2026
domenkozar
left a comment
domenkozar
left a comment
Member
There was a problem hiding this comment.
I found several release, aggregate-test, source-build, and cleanup issues. Details are inline.
sylvesterroos
added a commit
to sylvesterroos/secretspec
that referenced
this pull request
Sep 2, 2026
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability - Align CARGO_TARGET_DIR with rustler-precompiled-action expectations - Include the Windows archive in release asset discovery - Add a pre_release input and release-PR guards to the Elixir workflow - Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh - Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD source-build path and ship no native/ sources to consumers - Use workspace inheritance in the native crate manifest, matching the other native SDK crates - Continue cleanup after a file-removal error in Resolved.close/1
domenkozar
reviewed
Sep 4, 2026
domenkozar
reviewed
Sep 4, 2026
domenkozar
reviewed
Sep 4, 2026
domenkozar
reviewed
Sep 4, 2026
domenkozar
reviewed
Sep 4, 2026
domenkozar
reviewed
Sep 4, 2026
Introduce secretspec-ex, a Rustler binding that calls the shared Rust resolver from Elixir. Add a release workflow that attaches precompiled NIF archives to GitHub Releases and publishes the package to Hex.pm, and include the SDK in workspace and devenv setup.
- Build Linux NIFs in pinned manylinux_2_28 containers and verify portability - Align CARGO_TARGET_DIR with rustler-precompiled-action expectations - Include the Windows archive in release asset discovery - Add a pre_release input and release-PR guards to the Elixir workflow - Bootstrap Mix deps in ci-sdks.sh and conformance/run.sh - Keep the Hex package precompiled-only: drop the SECRETSPEC_EX_BUILD source-build path and ship no native/ sources to consumers - Use workspace inheritance in the native crate manifest, matching the other native SDK crates - Continue cleanup after a file-removal error in Resolved.close/1
- Enumerate all conformance fixtures and validate resolve, no-values, and report projections per fixture (mirrors Node/Python SDKs) - Add envelope hardening tests for unsupported schema_version and invalid envelopes in checked_envelope/3 - Replace builder change-detector test with observable profile selection behavior - Convert bound function heads to do...end blocks per project style
NIF builds The SIGCHLD restore now runs only when the request may reach a subprocess-spawning provider, instead of on every native call. The gate inspects the request's provider spec, inline aliases, per-secret chains, profile defaults, and options; anything it cannot prove in-process (aliases, bare names, unknown schemes) stays fail-safe and engages the flip. Scheme lists mirror the core's provider registrations, including akv, whose Azure CLI credential shells out via azure_identity. The Elixir release workflow folds nif-linux and nif-native into one matrix job matching the sibling SDK workflows, removing the duplicated steps and the divergent toolchain pinning.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce secretspec-ex, a Rustler binding that calls the shared Rust resolver from Elixir. Add a release workflow that attaches precompiled NIF archives to GitHub Releases and publishes the package to Hex.pm, and include the SDK in workspace and devenv setup.
I've tried my best to match the layout of the other SDKs, but I might have missed something.