feat(proxy): add SPIFFE/SPIRE workload identity auth for upstream routes

.github/workflows/spire.yml

@@ -0,0 +1,112 @@
+name: SPIRE
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -Dwarnings
+
+jobs:
+  spiffe:
+    name: Integration (Linux)
+    if: ${{ !startsWith(github.head_ref, 'dependabot/github_actions/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-spire-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-spire-
+            ${{ runner.os }}-cargo-
+
+      - name: Download SPIRE
+        run: |
+          set -euo pipefail
+          VERSION="1.9.6"
+          TARBALL="spire-${VERSION}-linux-amd64-musl.tar.gz"
+          curl -fsSL "https://github.com/spiffe/spire/releases/download/v${VERSION}/${TARBALL}" \
+            -o /tmp/spire.tar.gz
+          mkdir -p /tmp/spire-bin
+          tar -xzf /tmp/spire.tar.gz -C /tmp/spire-bin --strip-components=1
+          echo "/tmp/spire-bin/bin" >> "$GITHUB_PATH"
+
+      - name: Start SPIRE server
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/nono-test-spire/data/server
+          spire-server run -config testdata/spire/server.conf &
+          for _ in $(seq 1 30); do
+            [ -S /tmp/nono-test-spire/server.sock ] && break
+            sleep 0.5
+          done
+          [ -S /tmp/nono-test-spire/server.sock ] || { echo "SPIRE server did not start"; exit 1; }
+
+      - name: Start SPIRE agent
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/nono-test-spire/data/agent
+
+          # Generate join token and mask it immediately so it never appears in logs.
+          RAW=$(spire-server token generate \
+            -socketPath /tmp/nono-test-spire/server.sock \
+            -spiffeID spiffe://test.nono/agent)
+          TOKEN=$(echo "$RAW" | grep -oP '(?<=Token: )\S+')
+          echo "::add-mask::$TOKEN"
+
+          spire-agent run -config testdata/spire/agent.conf -joinToken "$TOKEN" &
+
+          for _ in $(seq 1 30); do
+            [ -S /tmp/nono-test-spire/agent.sock ] && break
+            sleep 0.5
+          done
+          [ -S /tmp/nono-test-spire/agent.sock ] || { echo "SPIRE agent did not start"; exit 1; }
+
+      - name: Register workload entry
+        run: |
+          set -euo pipefail
+          spire-server entry create \
+            -socketPath /tmp/nono-test-spire/server.sock \
+            -spiffeID "spiffe://test.nono/nono-proxy" \
+            -parentID "spiffe://test.nono/agent" \
+            -selector "unix:uid:$(id -u)"
+
+          # Wait for the agent to sync the entry before tests start.
+          for _ in $(seq 1 20); do
+            spire-agent api fetch jwt \
+              -socketPath /tmp/nono-test-spire/agent.sock \
+              -audience warmup 2>/dev/null | grep -q "spiffe://" && break
+            sleep 0.5
+          done
+
+      - name: Run SPIFFE proxy-level integration tests
+        env:
+          SPIRE_AGENT_SOCKET: /tmp/nono-test-spire/agent.sock
+          SPIRE_TRUST_DOMAIN: test.nono
+          SPIRE_WORKLOAD_SPIFFE_ID: spiffe://test.nono/nono-proxy
+        run: cargo test -p nono-proxy --test spiffe_integration -- --nocapture
+
+      - name: Run SPIFFE binary-level integration tests
+        env:
+          SPIRE_AGENT_SOCKET: /tmp/nono-test-spire/agent.sock
+          SPIRE_TRUST_DOMAIN: test.nono
+          SPIRE_WORKLOAD_SPIFFE_ID: spiffe://test.nono/nono-proxy
+        run: cargo test -p nono-cli --test spiffe_run -- --nocapture

.gitignore

@@ -6,8 +6,8 @@
 # Claude state and config
 .claude/
 
-# misc
-proj/
+# Demo assets and runtime (not part of the distributed codebase)
+demo/
 .worktrees
 .nono
 diagnostics.json