feat(ci): migrate to self-hosted Mac Mini runner with Nix

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ['*']
+  pull_request:
+    branches: [main]
+
+jobs:
+  ci:
+    name: Lint & Test
+    if: >
+      github.event_name == 'push' ||
+      github.actor == 'jasoet'
+    runs-on: [self-hosted, local, macOS, ARM64]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Lint
+        run: nix develop --command golangci-lint run ./...
+
+      - name: Test
+        run: nix develop --command go test -race -count=1 ./...
+
+  compatibility:
+    name: Compatibility Tests
+    needs: ci
+    if: >
+      github.event_name == 'push' ||
+      github.actor == 'jasoet'
+    runs-on: [self-hosted, local, macOS, ARM64]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: OpenSSL Compatibility
+        run: nix develop --command go test ./compatibility/... -v -tags=compatibility -timeout=10m -p=1

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Test
+    runs-on: [self-hosted, local, macOS, ARM64]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Test
+        run: nix develop --command go test -race -count=1 ./...
+
+  release:
+    name: Release
+    needs: test
+    runs-on: [self-hosted, local, macOS, ARM64]
+    permissions:
+      contents: write
+      issues: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install semantic-release
+        run: nix develop --command bun install -g semantic-release @semantic-release/github conventional-changelog-conventionalcommits
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: nix develop --command bunx semantic-release

Taskfile.yml

@@ -81,7 +81,7 @@ tasks:
     silent: false
 
   test:compatibility:bao:
-    desc: Run GoPKI ↔ OpenBao compatibility tests
+    desc: Run GoPKI ↔ OpenBao compatibility tests (requires Podman)
     env:
       CGO_ENABLED: 1
     cmds:
@@ -90,7 +90,7 @@ tasks:
         echo "Running GoPKI ↔ OpenBao Compatibility Tests..."
         echo "   This tests interoperability between GoPKI modules and OpenBao"
         echo "   Requires Podman for OpenBao testcontainers"
-      - "{{.N}} go test ./compatibility/bao -v -tags=compatibility -race -timeout=10m -coverprofile=output/bao-compatibility-coverage.out"
+      - "{{.N}} go test ./compatibility/bao -v -tags=bao_compatibility -race -timeout=10m -coverprofile=output/bao-compatibility-coverage.out"
       - "{{.N}} go tool cover -func=output/bao-compatibility-coverage.out | tail -1"
       - 'echo "GoPKI ↔ OpenBao compatibility tests completed"'
     silent: false

bao/pki/certificate.go

@@ -452,17 +452,17 @@ func generateCertificate[K keypair.KeyPair](ctx context.Context, client *Client,
 		var zero K
 		switch any(zero).(type) {
 		case *algo.RSAKeyPair:
-			opts.KeyType = "rsa"
+			opts.KeyType = keyTypeRSA
 			if opts.KeyBits == 0 {
 				opts.KeyBits = 2048 // Default RSA key size
 			}
 		case *algo.ECDSAKeyPair:
-			opts.KeyType = "ec"
+			opts.KeyType = keyTypeEC
 			if opts.KeyBits == 0 {
 				opts.KeyBits = 256 // Default ECDSA key size (P-256)
 			}
 		case *algo.Ed25519KeyPair:
-			opts.KeyType = "ed25519"
+			opts.KeyType = keyTypeED25519
 			// Ed25519 has fixed key size, no key_bits needed
 		}
 	}
@@ -635,17 +635,17 @@ func issueCertificateWithKeyRef[K keypair.KeyPair](ctx context.Context, client *
 		var zero K
 		switch any(zero).(type) {
 		case *algo.RSAKeyPair:
-			opts.KeyType = "rsa"
+			opts.KeyType = keyTypeRSA
 			if opts.KeyBits == 0 {
 				opts.KeyBits = 2048 // Default RSA key size
 			}
 		case *algo.ECDSAKeyPair:
-			opts.KeyType = "ec"
+			opts.KeyType = keyTypeEC
 			if opts.KeyBits == 0 {
 				opts.KeyBits = 256 // Default ECDSA key size (P-256)
 			}
 		case *algo.Ed25519KeyPair:
-			opts.KeyType = "ed25519"
+			opts.KeyType = keyTypeED25519
 			// Ed25519 has fixed key size, no key_bits needed
 		}
 	}