From c4038bdd72b8777654aa36266ad721710d220f4d Mon Sep 17 00:00:00 2001 From: Dave Mihalcik Date: Tue, 14 Jul 2026 17:10:56 -0400 Subject: [PATCH] fix(ci): always generate opentdf.yaml even when PQC keys absent PR #3594 added an early `exit 0` to the "Map the config to the keys" step to skip PQC config when the platform under test lacks PQC key generation. But that step is also where the base opentdf.yaml is created (`opentdf.yaml yq e ...` at the end of the step), so the guard skipped opentdf.yaml creation entirely whenever kas-xwing-private.pem was missing (e.g. testing released tags like v0.9.0 that predate service/cmd/keygen). Every later step then failed with "stat opentdf.yaml: no such file or directory". Remove the misplaced guard. PQC extra keys are already filtered by the allowed_algorithms allowlist (which no longer lists hpqt:*), and the dedicated "Enable PQ ... wrapping" step keeps its own file-existence guard, so PQC is still correctly skipped when unsupported. --- test/start-up-with-containers/action.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/test/start-up-with-containers/action.yaml b/test/start-up-with-containers/action.yaml index 2ef13367c2..4d961413ea 100644 --- a/test/start-up-with-containers/action.yaml +++ b/test/start-up-with-containers/action.yaml @@ -224,11 +224,6 @@ runs: # For versions 0.7.1 and later, we allow rsa:4096 ec:secp384r1 ec:secp521r1 allowed_algorithms+=(rsa:4096 ec:secp384r1 ec:secp521r1) fi - # Only allow PQC algorithms if the platform generated PQC key files - if [[ ! -f kas-xwing-private.pem ]]; then - printf "PQC key files not found; skipping PQC configuration (platform may not support PQC key types)\n" 1>&2 - exit 0 - fi keyring='[{"kid":"ec1","alg":"ec:secp256r1"},{"kid":"r1","alg":"rsa:2048"}]' keys='[{"kid":"e1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"ec1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"r1","alg":"rsa:2048","private":"kas-private.pem","cert":"kas-cert.pem"}]' while IFS= read -r key_json; do