Update pipeline build

.github/workflows/build_docker_images.yml

@@ -15,8 +15,9 @@ name: Build and push base docker images
 on:
   push:
     paths:
-    - 'data/dockerfiles/Dockerfile.*'
-    - 'requirements*.txt'
+      - 'data/dockerfiles/Dockerfile.*'
+      - '.github/workflows/build_docker_images.yml'
+      - 'requirements*.txt'
   workflow_dispatch:
 
 jobs:
@@ -36,28 +37,33 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Some accounts did not use a lowercase repository owner, so we need to ensure
+      # that the repository owner is always in lowercase to be able to build the images.
+      - name: Set lowercase GitHub owner
+        run: echo "REPO_OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV
+
       - name: Build and push base Docker image
         run: |
           docker buildx build \
-            --tag ghcr.io/${{ github.repository_owner }}/cmp-test-base:latest \
+            --tag ghcr.io/${REPO_OWNER_LC}/cmp-test-base:latest \
             --push \
             -f data/dockerfiles/Dockerfile.base .
 
       - name: Build and push dev Docker image
         run: |
           docker buildx build \
-            --tag ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest \
-            --build-arg BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/cmp-test-base:latest \
+            --tag ghcr.io/${REPO_OWNER_LC}/cmp-test-dev:latest \
+            --build-arg BASE_IMAGE=ghcr.io/${REPO_OWNER_LC}/cmp-test-base:latest \
             --push \
             -f data/dockerfiles/Dockerfile.dev .
 
       - name: Build and push the production test suite Docker image
-      # This one is meant to be directly invoked by end-users who don't want to get into the details
-      # of how the test suite works, they just want to run it to test their CA. For their convenience,
-      # we give it a short name, to be invoked as `docker run --rm -it ghcr.io/siemens/cmp-test`
+        # This one is meant to be directly invoked by end-users who don't want to get into the details
+        # of how the test suite works, they just want to run it to test their CA. For their convenience,
+        # we give it a short name, to be invoked as `docker run --rm -it ghcr.io/siemens/cmp-test`
         run: |
           docker buildx build \
-            --tag ghcr.io/${{ github.repository_owner }}/cmp-test:latest \
-            --build-arg BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/cmp-test-base:latest \
+            --tag ghcr.io/${REPO_OWNER_LC}/cmp-test:latest \
+            --build-arg BASE_IMAGE=ghcr.io/${REPO_OWNER_LC}/cmp-test-base:latest \
             --push \
             -f data/dockerfiles/Dockerfile.tests .

.github/workflows/check_quality.yml

@@ -17,70 +17,111 @@ jobs:
   # Stage 1: fast and basic checks, we run them in parallel to provide more feedback to the contributor at once,
   # instead of running them sequentially and giving feedback one piece at a time, requiring more iterations.
   ruff_lint:
+    needs: prepare_env
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Code style
-        run: ruff check
+      - uses: actions/checkout@v4
+      - name: Code style (ruff)
+        run: docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" ruff check
 
   license_check:
+    needs: prepare_env
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: License check
-        run: reuse lint
+      - uses: actions/checkout@v4
+      - name: License check (reuse)
+        run: docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" reuse lint
 
-  rf_style_check:
+  rf-run-able:
+    # Checks if the RobotFramework tests can be executed (dryrun). If not, uploads the artifacts for debugging.
+    # Sometimes it is import error or some sub dependency missing, this helps to identify such issues early.
+    needs: prepare_env
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: RobotFramework style check
-        run: robocop check --ignore VAR04
+      - uses: actions/checkout@v4
+
+      # 1) Run dryrun but don't stop the job on failure
+      - name: RobotFramework run-ability check
+        id: dryrun
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" \
+            make dryrun
+
+      # 2) Upload ONLY if the dryrun step failed
+      - name: Upload RobotFramework artifacts (only if dryrun failed)
+        if: ${{ steps.dryrun.outcome == 'failure' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: robot-dryrun-artifacts-${{ github.run_id }}
+          path: |
+            ./output.xml
+            ./log.html
+            ./report.html
+          if-no-files-found: warn
+          retention-days: 14
+
+      # 3) Fail the job if dryrun failed (after uploading)
+      - name: Mark job as failed if dryrun failed
+        if: ${{ steps.dryrun.outcome == 'failure' }}
+        run: exit 1
+
+  rf_style_check:
+    needs: prepare_env
+    runs-on: ubuntu-22.04
     # We haven't settled on a style for RobotFramework yet, enforce check when consensus is reached
     continue-on-error: true
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: RobotFramework style check (robocop)
+        run: docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" robocop check --ignore VAR04
 
   spelling_check:
+    needs: prepare_env
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Spelling checker
-        run: codespell . --check-filenames --skip *.html,*.pem,*.xml,*venv*,*fips/*.py,*/announcement.py,./data/rfc_test_vectors/*
+      - uses: actions/checkout@v4
+      - name: Spelling checker (codespell)
+        run: |
+          docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" \
+            codespell . --check-filenames --skip "*.html,*.pem,*.xml,*venv*,*fips/*.py,*/announcement.py,./data/rfc_test_vectors/*"
 
   dependency_check:
     # See if newer versions of our Python dependencies are available. This does
     # not enforce anything, and only has an informational character.
+    needs: prepare_env
     runs-on: ubuntu-22.04
     continue-on-error: true
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
       - name: Check for outdated dependencies
         run: |
-          echo "Checking for outdated packages..."
-          OUTDATED=$(pip list --outdated --format=columns)
-          if [ -z "$OUTDATED" ]; then
-            echo "All packages are up to date!"
-            exit 0
-          else
-            echo "Outdated packages detected, think about it:"
-            echo "$OUTDATED"
-            exit 1
-          fi
+          docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" bash -c '
+            echo "Checking for outdated packages..."
+            OUTDATED=$(pip list --outdated --format=columns)
+            if [ -z "$OUTDATED" ]; then
+              echo "All packages are up to date!"
+              exit 0
+            else
+              echo "Outdated packages detected, think about it:"
+              echo "$OUTDATED"
+              exit 1
+            fi'
 
   version_check:
+    needs: prepare_env
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
@@ -98,41 +139,40 @@ jobs:
   # Stage 2: these checks are more expensive and do more with the code, e.g., attempt to import dependencies,
   # execute some logic, etc.
   pylint:
-    needs: [ruff_lint, license_check, rf_style_check, spelling_check]
+    # needs must include prepare_env, as it is used to set the image name.
+    needs: [prepare_env, ruff_lint, license_check, rf_style_check, spelling_check]
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
       - name: Pylint check
-        run: pylint --fail-under=9.4 resources
+        run: docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" pylint --fail-under=9.4 resources
 
   unit_test:
-    needs: [ruff_lint, license_check, rf_style_check, spelling_check]
+    # needs must include prepare_env, as it is used to set the image name.
+    needs: [prepare_env, ruff_lint, license_check, rf_style_check, spelling_check]
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
-      env:
-        OQS_INSTALL_PATH: "/root/_oqs"
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Unit tests
-        run:  python3 -m unittest discover -s unit_tests
+      - uses: actions/checkout@v4
+      - name: Run unit tests
+        run: |
+          docker run --rm -v "$PWD:/workspace" -w /workspace -e OQS_INSTALL_PATH=/root/_oqs "$IMAGE" \
+            python3 -m unittest discover -s unit_tests
 
   type_check:
+    needs: prepare_env
     runs-on: ubuntu-22.04
-    container:
-      image: ghcr.io/${{ github.repository_owner }}/cmp-test-dev:latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Pyright check
-        run: pyright
-    # not enforced yet, but it is still executed to provide some info
+    # not enforced yet, but it is still executed to provide some info.
     continue-on-error: true
+    env:
+      IMAGE: ${{ needs.prepare_env.outputs.image_lc }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Pyright type check
+        run: docker run --rm -v "$PWD:/workspace" -w /workspace "$IMAGE" pyright
 
   prepare_env:
     runs-on: ubuntu-22.04

client_tests/cmp_client.py

@@ -55,8 +55,8 @@ def get_cmp_command(client: str = "openssl", **kwargs) -> list:  # noqa: D417
     -------
     - List of command-line arguments suitable for use with Run Process
 
-    Example:
-    -------
+    Examples:
+    --------
     | ${args}= | Get CMP Command | openssl | cmd=ir | server=http://localhost:5000 | ... |
 
     """

client_tests/cmp_tests_jinja.robot

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright 2025 Siemens AG
+# SPDX-FileCopyrightText: Copyright 2025 Siemens AG   # robocop: off=COM04
 #
 # SPDX-License-Identifier: Apache-2.0
 
@@ -48,7 +48,6 @@ IR 01 - Valid IR CMP Request Should Pass
     ...                The OpenSSL client output should not contain any errors,
     ...                and a certificate should be written to the specified path.
     [Tags]    ir    valid    positive
-
     ${args}=    Get CMP Command
     ...    ${CMP_CLIENT}
     ...    cmd=${INITIATION_REQUEST}

data/dockerfiles/Dockerfile.base

@@ -17,8 +17,8 @@ RUN pip3 install --upgrade pip && \
     pip3 install -r /app/requirements.txt
 
 # Build and install liboqs-python
-RUN git clone --depth=1 https://github.com/open-quantum-safe/liboqs-python && \
-    pip3 install ./liboqs-python && \
+RUN git clone --depth=1 https://github.com/Guiliano99/liboqs-python-stateful-sig && \
+    pip3 install ./liboqs-python-stateful-sig && \
     python3 -c "import oqs"  # Trigger the build of liboqs, by importing it
 
 # Remove unnecessary packages after we're done

requirements-dev.txt

@@ -5,7 +5,7 @@
 safety>= 3.3.1, < 4.0.0
 pylint>= 4.0.2, < 5.0.0
 black>= 25.0.0, < 26.0.0
-ruff>= 0.12.12, < 1.0.0
+ruff>= 0.14.3, < 1.0.0
 robotframework-robocop==6.9.2
 robotframework-tidy==4.18.0
 pyright==1.1.407