ci: migrate main CI to Buildkite

[jdx]

Summary

• Replaces .github/workflows/ci.yml with .buildkite/pipeline.yml. The pipeline fans build → ci-bats (matrix × 3 tranches) → ci-other → msrv across queue: linux and queue: macos agents using Buildkite matrix expansion, and uses buildkite-agent artifact for the build → test handoff (Buildkite has no first-class equivalent of actions/upload-artifact).
• Splits the heavy service bring-up (vault, vaultwarden, infisical, bitwarden, gnome-keyring) into reusable scripts under .buildkite/scripts/ so the pipeline YAML stays declarative.
• Leaves the release/release-plz/docs/autofix/semantic-pr-lint workflows on GitHub Actions — those are tightly coupled to GH-specific features (Releases, PRs, Pages, autofix.ci, PR-title checks) and don't have a clean Buildkite equivalent.
• Updates the test docs (CRUSH.md, BITWARDEN_TESTING.md, VAULT_TESTING.md) to describe the new Buildkite-based service setup, and removes the now-broken GitHub Actions CI badge from the README.

Notes for reviewer

Things to set up on the Buildkite side before this lands cleanly:

• Register agents tagged queue=linux and queue=macos (Linux agents need Docker; macOS agents need Homebrew).
• Expose AGE_SECRET to agents (env var or a secrets plugin) — setup-age.sh skips silently when it's missing, mirroring the fork-PR behavior of the old workflow.
• Create a Buildkite pipeline pointing at .buildkite/pipeline.yml.

The bats job keeps the same retry policy (3 attempts) and tranche split (TRANCHE 0/1/2 over TRANCHE_COUNT=3) as before — no test code changes.

Test plan

• Configure Buildkite agents with the required queues and AGE_SECRET
• Trigger a build of .buildkite/pipeline.yml and confirm all four jobs succeed on both linux and macos
• Verify the bats tranches still run in parallel and that vault/vaultwarden/infisical/bitwarden tests pick up their env vars from BUILDKITE_ENV_FILE
• Confirm the GH Actions workflows still in place (release, release-plz, docs, autofix, semantic-pr-lint) are unaffected

🤖 Generated with Claude Code

---

Note

Medium Risk
CI is fully migrated to Buildkite with new artifact handoff and service-provisioning scripts, so misconfiguration of agents, env propagation, or Docker/service startup could break builds across platforms.

Overview
Migrates primary CI from GitHub Actions to Buildkite by deleting .github/workflows/ci.yml and adding a new .buildkite/pipeline.yml that builds per-OS, fans out bats tranches, runs cargo test/lint/clippy, and verifies MSRV, handing off the compiled fnox binary via Buildkite artifacts.

Adds reusable Buildkite scripts for tool bootstrap (install-mise.sh), selective bats tag filtering (bats-filter.sh), CI secret handling (setup-age.sh, redact.sh), and integration-service provisioning (setup-keychain.sh, setup-services.sh) including Vault/Vaultwarden/Infisical/LocalStack setup and env propagation via BUILDKITE_ENV_FILE.

Updates docs to reference Buildkite-based CI setup (Bitwarden/Vault testing) and removes the GitHub Actions CI badge from README.md; refreshes mise.lock with platform-pinned URLs/checksums.

^{Reviewed by Cursor Bugbot for commit 35f6136. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR migrates primary CI from GitHub Actions to Buildkite, replacing .github/workflows/ci.yml with .buildkite/pipeline.yml and a set of reusable setup scripts. The pipeline correctly splits builds per-OS (avoiding the cross-platform depends_on pitfall), restores LocalStack/AWS coverage, properly quotes env-file writes, and handles release-plz expensive-test gating via bats-filter.sh. Only P2 issues remain: macOS Vault startup uses an unconditional sleep 2 rather than a readiness poll (flaky on slow agents), and the Linux service healthcheck loops continue silently on timeout instead of failing with a diagnostic message.

Confidence Score: 5/5

Safe to merge; all findings are P2 quality-of-life improvements with no blocking defects.

Only P2 issues found (flaky macOS vault readiness check, silent healthcheck loop timeouts). All previously flagged P1 concerns (cross-platform depends_on, LocalStack dropped, libudev-dev missing, unquoted env values, tranche count, hardcoded expensive filter) are resolved in the current code.

.buildkite/scripts/setup-services.sh — macOS vault readiness and Linux service healthcheck timeout handling.

Important Files Changed

Filename	Overview
.buildkite/pipeline.yml	New Buildkite pipeline: correctly splits build per-OS with scoped depends_on keys, 2-tranche bats matrix, libudev-dev installed on all Linux steps, and redact/keychain steps in ci-other. No new blocking issues beyond those already addressed in previous threads.
.buildkite/scripts/setup-services.sh	Comprehensive service setup including LocalStack provisioning (restoring AWS coverage). Two P2 issues: macOS Vault readiness uses a bare sleep instead of a poll loop, and all three Linux healthcheck loops silently continue on timeout rather than failing with a diagnostic message.
.buildkite/scripts/bats-filter.sh	Correctly mirrors the old GHA release-plz expensive-test logic using BUILDKITE_PULL_REQUEST + BUILDKITE_BRANCH. Properly writes to BUILDKITE_ENV_FILE with %q quoting.
.buildkite/scripts/install-mise.sh	Installs mise if absent, sets PATH, and trusts the project's mise.toml. HTTP/1.1 retry is a documented workaround for macOS HTTP/2 flakes.
.buildkite/scripts/setup-keychain.sh	Starts gnome-keyring on Linux and writes DBUS_SESSION_BUS_ADDRESS to BUILDKITE_ENV_FILE with proper %q quoting. macOS no-op is correct.
.buildkite/scripts/redact.sh	Registers fnox secrets with Buildkite redaction and verifies round-trip; skips gracefully when no age key is present.
.buildkite/scripts/setup-age.sh	Writes the AGE_SECRET to ~/.config/fnox/age.txt with chmod 600; silently skips when absent, mirroring fork-PR behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[push / PR] --> BL[build-linux\nqueue: linux]
    A --> BM[build-macos\nqueue: macos]

    BL -->|artifact: fnox-linux| BAL0[bats-linux tranche 0]
    BL -->|artifact: fnox-linux| BAL1[bats-linux tranche 1]
    BL -->|artifact: fnox-linux| COL[ci-other-linux\ncargo test + lint + clippy]

    BM -->|artifact: fnox-macos| BAM0[bats-macos tranche 0]
    BM -->|artifact: fnox-macos| BAM1[bats-macos tranche 1]
    BM -->|artifact: fnox-macos| COM[ci-other-macos\ncargo test + lint + clippy]

    A --> MSRV[msrv\ncargo msrv verify\nqueue: linux]

    BAL0 --- SS1[setup-services.sh\nvault · vaultwarden · infisical\nlocalstack · keychain]
    BAL1 --- SS1
    BAM0 --- SS2[setup-services.sh\nvault dev mode · parallel]
    BAM1 --- SS2

    COL --- KC[setup-keychain.sh\ngnome-keyring]
    BAL0 --- BF[bats-filter.sh\nBATS_FILTER_TAGS]
    BAL1 --- BF
    BAM0 --- BF
    BAM1 --- BF

Loading

_{Reviews (9): Last reviewed commit: "[autofix.ci] apply automated fixes" | Re-trigger Greptile}

[gemini-code-assist]

Code Review

This pull request migrates the CI pipeline from GitHub Actions to Buildkite, introducing a new pipeline configuration and setup scripts for services like Vaultwarden, HashiCorp Vault, and Infisical. Feedback focuses on improving script robustness by correctly quoting environment variables, ensuring dependencies like openssl are installed, avoiding Docker naming conflicts, and replacing brittle sleep commands with health checks.

[gemini-code-assist]

The append_env function does not quote the value when writing to $BUILDKITE_ENV_FILE. This can lead to malformed environment files if the value contains spaces or special characters. Additionally, Buildkite environment files typically use KEY="VALUE" format rather than the export command.

Suggested change

	append_env() {
	echo "export $1=${2}" >>"$BUILDKITE_ENV_FILE"
	export "$1=$2"
	}
	append_env() {
	echo "$1=\"${2}\"" >>"$BUILDKITE_ENV_FILE"
	export "$1=$2"
	}

[gemini-code-assist]

The script uses openssl later (line 33) but it is not explicitly installed. While often present on base images, it's safer to include it in the apt-get install list to ensure the script is self-contained and robust across different agent environments.

Suggested change

	sudo apt-get install -y parallel gnome-keyring libsecret-tools dbus-x11
	sudo apt-get install -y parallel gnome-keyring libsecret-tools dbus-x11 openssl

[gemini-code-assist]

Ignoring errors from openssl with || true can lead to confusing failures in the subsequent docker run command if the certificates are not created. It is better to let the script fail here if certificate generation fails so the root cause is clear.

Suggested change

	-addext "subjectAltName=DNS:localhost,IP:127.0.0.1" 2>/dev/null || true
	-addext "subjectAltName=DNS:localhost,IP:127.0.0.1" 2>/dev/null

[gemini-code-assist]

Using a fixed container name (vaultwarden) will cause the job to fail if a previous run left a stale container or if multiple jobs share the same Docker host. Removing any existing container before starting ensures a clean state. Note that if multiple tranches run on the same host, they will also conflict on port 8080.

Suggested change

	docker run -d --name vaultwarden \
	docker rm -f vaultwarden 2>/dev/null || true
	docker run -d --name vaultwarden \

[gemini-code-assist]

Similar to the vaultwarden container, the vault container name should be cleared before starting to avoid conflicts with stale containers from previous runs.

Suggested change

	docker run -d --name vault --cap-add=IPC_LOCK \
	docker rm -f vault 2>/dev/null || true
	docker run -d --name vault --cap-add=IPC_LOCK \

[gemini-code-assist]

Using a fixed sleep 5 is brittle. It may be too short if the system is under heavy load, leading to flaky tests, or unnecessarily long. A health check loop (e.g., using curl to check the Vault or Vaultwarden API) would be more robust and efficient.

[gemini-code-assist]

The environment variable value should be quoted when appended to $BUILDKITE_ENV_FILE to prevent issues with special characters in the D-Bus address, and the export prefix is unnecessary for Buildkite environment files.

Suggested change

	echo "export DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS" >>"$BUILDKITE_ENV_FILE"
	echo "DBUS_SESSION_BUS_ADDRESS=\"$DBUS_SESSION_BUS_ADDRESS\"" >>"$BUILDKITE_ENV_FILE"

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 68f9d90. Configure here.}